Why is there a plist for OpenSSH in Recovery Mode (OS X Base System.dmg)

Question

Level 1

101 points

Why is there a plist for OpenSSH in Recovery Mode (OS X Base System.dmg)

Why is com.openssh.ssh-agent.plist included in Recovery Mode in /System/Library/Launch Agents?

Why as in what is the exact reason this would be needed? I heard someone who could be anyone really on this Internet forum mention that the plist is only so "you can ssh into someone else's computer" not so yours can be accessed remotely but I suspect they are not entirely accurate since that's about all they could say on the topic.

In either case why would this be needed. If you're in Recovery Mode why would you be sshing into someone else's computer and why would I want someone ssh into mine when I'm already in Recovery Mode trying to fix it? Most people don't even know what ssh is and I doubt they'd be pleased to find out its already included on their computer.

Here's the text of mine. Seems authentic but it it was modified I'd have no way to know as there's no reference of what is and what isn't supposed to be anywhere and no one officially knows. k...

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.openssh.ssh-agent</string>

<key>ProgramArguments</key>

<array>

<string>/usr/bin/ssh-agent</string>

</array>

<key>Sockets</key>

<dict>

<key>Listeners</key>

<dict>

<key>SecureSocketWithKey</key>

</dict>

<key>EnableTransactions</key>

<true/>

</dict>

</plist>

MacBook Pro TouchBar and Touch ID, macOS Sierra (10.12.5), My Last Mac

Posted on Jul 7, 2017 6:22 PM

Reply

Answer 1

etresoft

Level 9

60,658 points

Nov 18, 2017 9:36 AM in response to chase_daniel

chase_daniel wrote:

Why is com.openssh.ssh-agent.plist included in Recovery Mode in /System/Library/Launch Agents?

Why as in what is the exact reason this would be needed?

It isn't needed. It is just a leftover file. Recovery mode is just that, a recovery system. It is only designed to recover the system. It has lots of things that aren't needed.

This particular launch agent isn't loaded. In fact, in recovery mode, this entire class of launch agents isn't loaded. And even if it were, the ssh-agent executable is not even included in the recovery partition.

So then since 99+% of users will never use it should such a glaring security vulnerability be eliminated and made optional for the exceptional case where someone may need it?

It is not a security vulnerability. SSH is but a tiny part of a very complex system. In recovery mode, this is nothing more than leftover clutter.

There are at 42 formally documented exploits for SSH https://www.cvedetails.com/vulnerability-list/vendor_id-120/SSH.html and its not hard to escalate privileges using SSH.

Actually there have been 91 formally documented exploits for the version of SSH included in macOS over its entire lifetime since 1999. You are looking at the reports for a proprietary SSH version that is not found on macOS. In either case, all of those vulnerabilities have been corrected, sometimes decades ago. SSH is considered the gold standard for secure communication over the internet. Unauthorized privilege escalation using ssh is virtually impossible.

I see that the first line of the manual page for ssh-agent mentions it "hold private keys used for public key authentication" but it's not true that it's only for one-way communication with another computer. Holding a private key would work both ways since keys could be stored that would be used to remote into a computer in Recovery mode as well as hold keys other computers would use to verify a user. Seems like a pretty fundamental aspect of the program..

You are welcome to read up on public key cryptography if you want. But I encourage you to avoid posting public comments like that until you have done significantly more study. Such statements seriously undermine any claims you might be attempting to make about security vulnerabilities.

Reply

Answer 2

chase_daniel Author

Level 1

101 points

Nov 13, 2017 9:49 AM in response to Barney-15E

So then since 99+% of users will never use it should such a glaring security vulnerability be eliminated and made optional for the exceptional case where someone may need it?

Kinda wondering exactly in what situation remotely accessing your personal computer's recovery partition could occur. I can't think of any really.

Since System Integrity Protection blocks anyone from blessing a boot partition from outside of the recovery partition it seems like a questionable choice to have included. There are at 42 formally documented exploits for SSH https://www.cvedetails.com/vulnerability-list/vendor_id-120/SSH.html and its not hard to escalate privileges using SSH. Since one would be in the Recovery partition they could bless any drive and have the computer boot from anything they wanted along with give inheritable entitlements to processes and their children that shouldn't have them..

I see that the first line of the manual page for ssh-agent mentions it "hold private keys used for public key authentication" but it's not true that it's only for one-way communication with another computer. Holding a private key would work both ways since keys could be stored that would be used to remote into a computer in Recovery mode as well as hold keys other computers would use to verify a user. Seems like a pretty fundamental aspect of the program..

Apple Open-Source's version of the actual ssh-agent program https://opensource.apple.com/source/OpenSSH/OpenSSH-166/openssh/ssh-agent.c doesn't include the -l option that was indicated in the .plist for the ssh-agent process that .plist would create.

If someone runs ssh-agent with the -l option specified it gives the error message:

"mkdtemp: private socket dir: Read-only file system"

It seems like it's a bug with ssh that makes ssh-agent ignore the environment variables set for the /tmp directory https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=395432 which I'd assume is the app translocation that keeps files from being able to access resources/dylib's outside their code-signed entitlements.

Can't think of why Apple would add a SSH to Recovery mode so considering everything seems more like tampering with launchd. At least its not showing up anymore..

Reply

Answer 3

John Galt

Level 10

162,492 points

Jul 7, 2017 6:58 PM in response to chase_daniel

I heard someone who could be anyone really on this Internet forum mention ...

I recommend you don't devote much attention to someone on any Internet forum.

Here's the text of mine. Seems authentic but it it was modified I'd have no way to know as there's no reference of what is and what isn't supposed to be anywhere and no one officially knows. k...

Why do you believe it was modified? What makes you think no one officially knows?

Reply

Answer 4

Barney-15E

Level 10

125,804 points

Jul 7, 2017 6:33 PM in response to chase_daniel

I know what it is and happy that it is there. I remote into my computer quite a lot from my other computers.

Why would I not want to?

It's Unix. There is probably at least a hundred things that many will never use.

That plist starts up the ssh-agent, which is used for holding private keys that enable public key authentication. It allows you to log into other machines using ssh.

Reply