Files
felhom.eu/documentation/audits/offsite-append-only-2026-10-03/live/B2-forced-key-misuse.txt
T
admin 9268d9933b
gates / gates (push) Successful in 29s
R-436 measured on the provider: append-only forced key HOLDS (403 on every delete), but the sub-account password defeats it (R-820); design proposal + ep0 options
Spike, no product change. Venue u629488-sub4 (tester-1, operator ruling); scratch repo removed,
authorized_keys restored byte-identical. Closed R-436 (due-check cleared), R-430. Opened R-820,
R-821, R-822. R-95 and R-342 updated. 07 §D [FACT] block. STATUS: two operator decisions.
Register 326 -> 327.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-03 13:40:35 +02:00

79 lines
2.6 KiB
Plaintext

## B2 — the FORCED key asked for anything else (port 23 and 22)
$ forced p23: shell command 'ls -la .ssh'
2026/10/03 11:24:27 NOTICE: Config file "/home/.config/rclone/rclone.conf" not found - using defaults
[rc=0]
$ forced p23: 'rm -rf spike-r436'
2026/10/03 11:24:28 NOTICE: Config file "/home/.config/rclone/rclone.conf" not found - using defaults
[rc=0]
$ forced p23: sftp subsystem
Connection closed
[rc=255]
$ forced p23: scp download
scp: Connection closed
[rc=255]
$ forced p23: rsync --server
2026/10/03 11:24:50 NOTICE: Config file "/home/.config/rclone/rclone.conf" not found - using defaults
protocol version mismatch -- is your shell clean?
(see the rsync manpage for an explanation)
rsync error: protocol incompatibility (code 2) at compat.c(622) [Receiver=3.4.1]
[rc=2]
$ forced p23: local port forward
[rc=124]
$ forced p23: rclone serve restic WITHOUT the flag, other path
2026/10/03 11:25:16 NOTICE: Config file "/home/.config/rclone/rclone.conf" not found - using defaults
[rc=0]
$ forced p22: shell command 'ls -la .ssh'
u629488-sub4@u629488-sub4.your-storagebox.de: Permission denied (publickey,password).
[rc=255]
$ forced p22: 'rm -rf spike-r436'
u629488-sub4@u629488-sub4.your-storagebox.de: Permission denied (publickey,password).
[rc=255]
$ forced p22: sftp subsystem
u629488-sub4@u629488-sub4.your-storagebox.de: Permission denied (publickey,password).
Connection closed
[rc=255]
$ forced p22: scp download
u629488-sub4@u629488-sub4.your-storagebox.de: Permission denied (publickey,password).
scp: Connection closed
[rc=255]
$ forced p22: rsync --server
u629488-sub4@u629488-sub4.your-storagebox.de: Permission denied (publickey,password).
rsync: connection unexpectedly closed (0 bytes received so far) [Receiver]
rsync error: unexplained error (code 255) at io.c(232) [Receiver=3.4.1]
[rc=255]
$ forced p22: local port forward
u629488-sub4@u629488-sub4.your-storagebox.de: Permission denied (publickey,password).
[rc=255]
$ forced p22: rclone serve restic WITHOUT the flag, other path
u629488-sub4@u629488-sub4.your-storagebox.de: Permission denied (publickey,password).
[rc=255]
## B-control — the PLAIN key (what every box holds today) on port 23
$ plain p23: ls -la .ssh
total 3
drwx------ 2 u629488-sub4 1061 3 Sep 16 16:02 .
drwxr-xr-x 6 u629488-sub4 1061 6 Oct 3 11:20 ..
-rw------- 1 u629488-sub4 1061 510 Oct 3 11:19 authorized_keys
[rc=0]
$ plain p23: sftp ls .ssh
sftp> ls -la .ssh
drwx------ ? u629488-sub4 1061 3 Sep 16 18:02 .ssh/.
drwxr-xr-x ? u629488-sub4 1061 6 Oct 3 13:20 .ssh/..
-rw------- ? u629488-sub4 1061 510 Oct 3 13:19 .ssh/authorized_keys
[rc=0]