pam_rssh
pam_rssh copied to clipboard
Default `auth_key_file` is insecure
A process running as a given user can (in most cases) modify ~/.ssh/authorized_keys
, for instance to add a new key they control before invoking whatever is using pam_rssh
, subverting the authentication it is supposed to provide.
NixOS/nixpkgs#31611 provides an example (ab)using this to bypass pam_ssh_agent_auth
in the context of sudo
, which I believe would work similarly against pam_rssh
.