SOLVED Possible security threat? SMB user can login to root system...

[i716]

Today have used Gnome (on NixOS) in quite a long time. In the file manager I was browsing the network locations under other locations. The TrueNAS box shows up twice, once with the wording file sharing and once with the wording remote login in brackets after the hostname. Out of curiosity, I have clicked the remote login link and entered the username/password combo of an unprivileged user et voila, I was inside the TrueNAS root file system. That should not happen.
Since I am not usually using Gnome, I am unable to reproduce this in other desktop environments including KDE Plasma or Windows.
Any ideas?

 

[anodos]

Today have used Gnome (on NixOS) in quite a long time. In the file manager I was browsing the network locations under other locations. The TrueNAS box shows up twice, once with the wording file sharing and once with the wording remote login in brackets after the hostname. Out of curiosity, I have clicked the remote login link and entered the username/password combo of an unprivileged user et voila, I was inside the TrueNAS root file system. That should not happen.
Since I am not usually using Gnome, I am unable to reproduce this in other desktop environments including KDE Plasma or Windows.
Any ideas?

View attachment 55916

View attachment 55917

You probably have password authentication enabled for SSH? In this case it's expected.

 

[anodos]

This is one of those reasons why it's generally discouraged to use password auth and SSH. If this isn't a case, please PM me a debug. In general it's best form to report security concerns through our bug tracker.

 

[i716]

You probably have password authentication enabled for SSH? In this case it's expected.

Password authentication is indeed enabled for the root user.

The user that was able to login to the root filesystem is however in the group builtin_users
Could this be the culprit?

 

[anodos]

Ah, you're possibly unfamiliar with SSH configuration details. Traditionally, root is treated as something sacred deserving additional protection. You can enable password authentication for users, but not for root. Checking both boxes enables it for everyone. Once again, generally speaking, best practice is to always use key-based authentication for SSH.

 

[i716]

Ah, you're possibly unfamiliar with SSH configuration details. Traditionally, root is treated as something sacred deserving additional protection. You can enable password authentication for users, but not for root. Checking both boxes enables it for everyone. Once again, generally speaking, best practice is to always use key-based authentication for SSH.

Thanks for the clarification.

But this is TrueNAS specific? Normally there is a DenyUsers option in the sshd_config file and I would have expected that standard SMB users would be added there by default. Anyways, I will heed your advice and disable password authentication all together.

 

[i716]

Disabling password authentication has solved the issue for me. I have marked this issue as solved in the title.
@anodos Once again thanks for your support! Much appreciated.