21

I recently recalled a memory of when I had once, a fair while ago, accidentally tried to login to the wrong (mistyped) SSH server, and it allowed me access without the correct credentials: null authentication.

I thought nothing of it at the time, but thinking back: is this suspicious?

Is there a legitimate reason for this, or would this have been something malicious?

I am not at all worried for my own security now, just curious.

Improve this question
7
  • 11
    A honeypot could do that. Commented Oct 16, 2024 at 12:09
  • 2
    Do you mean wrong "credentials" or just wrong "password", because there is a big difference. Commented Oct 16, 2024 at 23:11
  • 2
    @schroeder What actually happened is I tried to login to my SSH server with my username and password, and it let me in, before I realised it was the wrong server. I had never visited it before, let alone registered etc. Commented Oct 16, 2024 at 23:40
  • 2
    So the accepted answer below doesn't apply? That's for a ssh server with a valid username but a blank password. Your situation is for any credential? Commented Oct 17, 2024 at 8:05
  • 1
    It could be legitimate, according to a nation state, for SSH servers in their territory to be malicious to outsiders. Commented Oct 17, 2024 at 18:36

5 Answers 5

Reset to default
34

There are certainly legitimate reasons for this. Users only need to authenticate if you care about who they are. In the same way that some website or FTP servers require credentials to access and others are anonymously available, you can have the same thing for SSH servers (although it's rather less common).

And it could also be that the application running on the server performs some of its own authentication separate to the SSH protocol.

For instance, there are servers used to host games that allow anyone to SSH into them. The alt.org NetHack server allows anyone to SSH in with just the nethack username and no password (or even to connect over Telnet):

To play NetHack on this server, just telnet alt.org (on normal port 23 or port 14321) or ssh [email protected].

And then once you're connected, you're prompted to login to the game itself:

## nethack.alt.org - http://nethack.alt.org/ ## ## Games on this server are recorded for in-progress viewing and playback! Not logged in. l) Login r) Register new user w) Watch games in progress

The other common instance where you'd see SSH servers accepting any (or empty) credentials would be a honeypot - which can be used both to find out what credentials attackers are trying, and what they do if they manage to successfully authenticate.

Improve this answer
13
  • 3
    Ahh, this answer is really good. I hadn’t considered that maybe the authentication comes after the SSH auth, like possible in your example. Of course it could also possibly be a honeypot, but at least now I know there are some legitimate reasons :P Commented Oct 16, 2024 at 20:13
  • 6
    I believe under best practices, nethack shouldn't do that. They should use keyboard-interactive authentication until the login or lack thereof. Keyboard-interactive sends the whole field at once, to prevent keyboard timing attacks, and also can put the client OS in protected password entry mode. Commented Oct 16, 2024 at 21:13
  • 2
    There are telnet command sequences that can put the terminal into no-echo mode at any point after the initial connection. This is fairly commonplace for this kind of text-mode network game. Commented Oct 17, 2024 at 1:26
  • 2
    I saw this question, and immediately recalled the nethack server, though I did not recall any of the details! Thanks for the writeup, quite a nostalgia flashback. I seem to recall back in the day, SSH was 'often' used like this in a BBS style fashion. Commented Oct 17, 2024 at 7:23
  • 1
    @user71659 Note that there are various embedded devices (think network switches, networked thermometers, UPS systems, etc.) where it makes perfect sense to use SSH just as a channel to an interactive text terminal. Such devices then handle all the user interaction exactly the same, regardless of whether you connect over a serial line, telnet, or SSH: you always receive the same characters drawing the login screen and interact with that. It surely simplifies the implementation of these devices a lot (the user interface code doesn't need to know anything about SSH). Commented Oct 17, 2024 at 13:04
13

It depends on what you mean by "null authentication," whether this fits: I like this privacy demonstrator by Filippo Valsorda. It'll let anyone in, but points out that the server can look you up on GitHub by the public keys you sent it.

whoami.filippo.io

An ssh server that knows who you are.

Try it (it's harmless)

ssh whoami.filippo.io

ED25519 key fingerprint is SHA256:qGAqPqtlvFBCt4LfMME3IgJqZWlcrlBMxNmGjhLVYzY.
RSA key fingerprint is SHA256:O6zDQjQws92wQSA41wXusKquKMuugPVM/oBZXNmfyvI.

There is also the example of the ASCII cinema available at ssh starwarstel.net.

Improve this answer
3
  • Thanks- but this still requires some authentication, right? Is this server just a demonstrator- because I’m not sure how safe it would actually be… Commented Oct 17, 2024 at 19:40
  • 3
    I remember seeing that same ASCII star wars movie years ago over telnet on towel.blinkenlights.nl - good to see that it's still floating around. Commented Oct 18, 2024 at 10:40
  • 3
    @security_paranoid You can try it without sending any keys so it can't find you: ssh -o IdentitiesOnly=yes -o IdentityFile=/dev/null whoami.filippo.io. The source code is in the GitHub repo I linked, though you have to take it on faith that Valsorda's server is running just that code. Commented Oct 18, 2024 at 14:03
7

Another reason to allow null authentication is for an ssh honeypot. Any login triggers an alert that can help you know that someone's poking around your network looking for trouble.

One such honeypot is here sshesame.

Improve this answer
10
  • 1
    @security_paranoid I see it as a simple backup to the IDS. Maybe the IDS is down/broken/misconfigured and didn't detect someone mapping the network and trying to ssh into every box they can see. The SSH honeypot is one more thing to let me know there's hanky panky on my network. There is also some value in the honeypot's logs to show me what the intruder tried to do after they were granted the fake access. Commented Oct 17, 2024 at 2:55
  • 1
    Seems like people ought to get wise to that one fast; better to have the honeypot say password auth enabled and just don't actually check what the password was. Commented Oct 17, 2024 at 4:45
  • 3
    One honeypot I used blocked the first X attempts, whatever they were, then let in the X+Yth, whatever that was. Gave the illusion of there being valid passwords. Commented Oct 17, 2024 at 8:08
  • 3
    @security_paranoid Wayne is explaining a high-level concept that has multiple implementations. The link he provides is for a basic SSH honeypot that can capture ssh logins and record what credentials were tried. But that's not the only kind or reason to run a honeypot. Commented Oct 17, 2024 at 8:22
  • 3
    @security_paranoid honeypots, like all software, can have vulnerabilities, yes. That's why you run them in restricted zones and not in production. Commented Oct 17, 2024 at 20:48
4

A perfectly legitimate (and somewhat of a bad security practice) is to have no password on a brand new (or reset to factory defaults) networked device.

You power it up, you login with no password, you set password first and all other settings next.

Improve this answer
5
  • 1
    Do you have an example where this happens? Commented Oct 17, 2024 at 20:49
  • 2
    @schroeder Openwrt works that way. Commented Oct 18, 2024 at 2:07
  • 1
    Older RouterOS (Mikrotik) did the same. Commented Oct 18, 2024 at 6:17
  • 1
    @user4867444 I looked up the OpenWRT manual and that's not true right now. You need to login via HTTP and assign the password before you can SSH in. So, I'm curious that the claim that it is "legitimate" if the practice was dropped. Commented Oct 18, 2024 at 8:38
  • 1
    @schroeder my bad, you're right. That's how it used to work, but apparently not any more. Commented Oct 19, 2024 at 17:18
3

Yes, you can use NULL auth if you have a public service which doesn't require any form of strong authentication. Not a regular SSH login to UNIX shell, but some uncommon form of service which still uses SSH protocol and its features.

See my public SSH jump host: https://ssh-j.com. You don't need a password or a key to use it.

Or, for example, SSH chat: https://shazow.net/posts/ssh-how-does-it-even/

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.