Monitoring and protecting SSH sessions with eBPF

SSTIC 2021

Guillaume Fournier github.com/gui774ume [email protected] 2 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

● Secured access to an infrastructure over an untrusted network ● Least privilege principle should be applied ● 4 security recommendations:

client server

1. Certificate based 2. Bastion host 3. MFA 4. Audit logs

SSTIC 2021 3 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

● But ... ○ MFA isn’t perfect ○ Access is rarely granular ○ SSH audit logs are limited

We’re still missing a solution to mitigate the impact of stolen credentials.

October 2019

SSTIC 2021 4 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

● Goals: ○ Provide real visibility into active sessions ○ Time, session and scope based access control

● Security profiles per SSH user (regardless of UNIX user / sudoer): ○ Allow (audit) ○ MFA ○ Block ○ session

SSTIC 2021 5 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

● Technical bits 1: eBPF hook points

OpenSSH

setlogin( ... )

User space

Kernel space

SSTIC 2021 6 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

● Technical bits 1: eBPF hook points

OpenSSH daemon

setlogin( ... )

Uprobe hook

Kernel space

PID - Sessions Uprobe eBPF hashmaps

SSTIC 2021 7 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

● Technical bits 1: eBPF hook points exec python OpenSSH daemon exec Bash

setlogin( ... ) exec

Uprobe hook User space

Kernel space

PID - Sessions Uprobe eBPF hashmaps

SSTIC 2021 8 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

● Technical bits 1: eBPF hook points exec python OpenSSH daemon exec Bash

setlogin( ... ) exec syscall Uprobe hook curl User space

Kernel space

Open( ... )

PID - Sessions Uprobe eBPF hashmaps 9 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

● Technical bits 1: eBPF hook points exec python OpenSSH daemon exec Bash

setlogin( ... ) exec syscall Uprobe hook curl User space

Kernel space

Open( ... ) LSM OK PID - Sessions Uprobe eBPF hashmaps 10 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

● Technical bits 1: eBPF hook points exec python OpenSSH daemon exec Bash

setlogin( ... ) exec syscall Uprobe hook curl User space

Kernel space

Open( ... ) LSM OK PID - Sessions Uprobe eBPF KO hashmaps Kprobe

SSTIC 2021 11 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

● Technical bits 1: eBPF hook points exec python OpenSSH daemon exec Bash

setlogin( ... ) exec syscall Uprobe hook curl User space

Kernel space

Open( ... ) LSM OK PID - Sessions Uprobe eBPF KO hashmaps 127 instrumented syscalls ! Kprobe

SSTIC 2021 12 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

● Technical bits 2: MFA with eBPF

Session 1

ssh-probe-auth

User space

Kernel space

SSTIC 2021 13 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

● Technical bits 2: MFA with eBPF

Session 1

ssh-probe-auth

syscall

User space

Kernel space

PID - Sessions stat(“otp://fim:10000@234123”) Kprobe eBPF hashmaps

SSTIC 2021 14 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

● Technical bits 2: MFA with eBPF

Session 1

ssh-probe ssh-probe-auth daemon

syscall

User space

Kernel space MFA request

PID - Sessions stat(“otp://fim:10000@234123”) Kprobe eBPF hashmaps

SSTIC 2021 15 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

● Technical bits 2: MFA with eBPF

Session 1

ssh-probe ssh-probe-auth daemon SIGUSR2 syscall

User space

Kernel space MFA request

PID - Sessions stat(“otp://fim:10000@234123”) Kprobe eBPF hashmaps

SSTIC 2021 16 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

● Technical bits 2: MFA with eBPF

Session 1 SIGUSR1 ssh-probe ssh-probe-auth daemon

syscall Temporary access granted User space

Kernel space MFA request

PID - Sessions stat(“otp://fim:10000@234123”) Kprobe eBPF hashmaps

SSTIC 2021 17 I. SSH: state of the art II. Limitations III. ssh-probe IV. Demo

Demo

SSTIC 2021 18

Thanks !

Source code: github.com/Gui774ume/ssh-probe

SSTIC 2021