Remote

papryk

@patryk@social.hackerspace.pl

mastodon 4.7.2

Doing sysadmin-adjacent stuff

*** opinions are my own ***

Mostly lurking and boosting/faving toots. I'm bad at socializing.

42 Followers

99 Following

7 Posts

Joined November 17, 2022

papryk @patryk@social.hackerspace.pl

· 13mo ago

Replying to

What's going on here? Some Juniper boxes are basically vSRX/vMX shipped in physical appliances. They run Wind River Linux on bare metal which in turn launches Junos OS in a VM managed by libvirt and there is a separate process which does packet forwarding stuff. I think it's even DPDK-based? If you have such box, you can jump out of Junos VM into Linux hypervisor by doing this: ssh routing-instance __juniper_private4__ root@192.168.1.1 It just drops you into root shell, no questions asked.

papryk @patryk@social.hackerspace.pl

· 13mo ago

Replying to

Funny thing is that "ssh into hypervisor root shell" does not seem to care about user permission level. One would think that "all" permission attribute should be the only one to allow this.

papryk @patryk@social.hackerspace.pl

· 13mo ago

Replying to

Now, normally it isn't a problem, you have admin privileges in Junos anyway. Well, Junos has this thing where you can create accounts that have reduced privileges. For example, helpdesk team can have a separate account which cannot modify box configuration, but can run traceroute or ping. This is controlled by "network" permission attribute, which gives you "access to network by using the ping, ssh, telnet, and traceroute commands."

papryk @patryk@social.hackerspace.pl

· 13mo ago

Oh, btw, I discovered this on a NFX250-turned-into-MX150 box running Junos 23.2R2.21.

I'm not actually sure if it works everywhere because currently I don't have access to any "legit" x86 Juniper box, like SRX1500 which is also vSRX in a trenchcoat.

papryk @patryk@social.hackerspace.pl

· 6mo ago

RE: @legoktm@wikis.world

Hey, wake up, a new batch of bullshit lingo has dropped! By courtesy of Red Hat:

- find, fix, track, target, engage, assess (F2T2EA)
- Agile Combat Employment (ACE)
- denied, disrupted, intermittent, and limited impact (DDIL) environments
- Combined Joint All-Domain Command and
Control (CJADC2) architecture
- Tactical Intelligence Targeting Access
Node (TITAN)
- Autonomic Logistics Information System (ALIS)
- Operational Data Integrated Network (ODIN)

wikis.world

Kunal Mehta: "Incredible, someone at Red Hat is apparently read…" - Wikis World

papryk @patryk@social.hackerspace.pl

· 12mo ago

Replying to

@nico@ublog.byme.at There's no key authentication involved, they just set the empty root password on Linux side and set both PermitRootLogin and PermitEmptyPasswords to "yes" in sshd_config