search

CESNET / netopeer2

NETCONF toolset
BSD 3-Clause "New" or "Revised" License
296 stars 187 forks source link

Run netopeer2-server as an openssh subsystem #1425

Closed troglobit closed 1 year ago

troglobit commented 1 year ago

With the recent scary libssh vulnerability, CVE-2023-2283 (authentication bypass), a question came up in our project:

Seeing as most systems that run sysrepo with NETCONF frontend using netopeer2-server also have SSH for shell access, using OpenSSH or Dropbear, would it be possible to run netopeer2-server as an OpenSSH subsystem, similar to how Clixon does it?

michalvasko commented 1 year ago

No, netopeer2 always handles its transport protocol on its own. But libnetconf2 does support this use-case, if you wanted to provide a patch.

troglobit commented 1 year ago

No, netopeer2 always handles its transport protocol on its own. But libnetconf2 does support this use-case, if you wanted to provide a patch.

Aha, of course, thank you! We'll probably have a look at it later this year when we'll also look at RESTCONF (maybe using Rousette) for our web interface.