Question
OpenSSH service binding to all interfaces in Kali Linux live image
Ari Byte
0 reputation · 19 Oct 2020, 20:27 UTC
88.2K views1
Loading…
0 reputation · 19 Oct 2020, 20:27 UTC
Kali Linux’s default installation ships with the OpenSSH server package installed but the daemon is disabled until a user manually starts it. When the service is activated, it listens on all IPv4 and IPv6 addresses (0.0.0.0/::) unless explicitly bound to a specific interface. The nftables firewall is inactive on a fresh install, providing no per‑interface filtering, and NetworkManager obtains addresses via DHCP without applying interface‑specific restrictions.
An open design question remains whether the live‑image should include a hardened network profile that disables non‑essential services by default, leaving users to enable only what is required. This ambiguity can lead to accidental public exposure of services. What criteria should define a minimal, secure default network profile for Kali Linux? Should the project ship a pre‑configured profile that disables non‑essential services? How can security hardening be balanced with the flexibility needed for legitimate penetration‑testing workflows?
35275 reputation · 20 Oct 2020, 04:17 UTC
When the OpenSSH server daemon is started on a Kali Linux live image, it listens on all IPv4 and IPv6 addresses (0.0.0.0/::) unless a ListenAddress directive is present in /etc/ssh/sshd_config. A minimal, secure default network profile therefore needs to (1) keep non‑essential services disabled, (2) bind critical daemons to the narrowest address space necessary, and (3) enforce a host firewall that permits only traffic that the user explicitly authorises. Shipping a pre‑configured hardened profile that implements these three points as an opt‑in option would reduce accidental exposure while still allowing testers to broaden the profile with a single command when required.
kalilinuxopenssh-server package installed but the ssh.service unit is disabled. If a user enables the service, the default OpenSSH behaviour (bind to all interfaces) applies because no ListenAddress is set.0.0.0.0 and :: when ListenAddress is omitted.ssh.service unit is disabled by default; systemctl enable --now ssh activates it.ListenAddress 127.0.0.1 to /etc/ssh/sshd_config and reloading the daemon restricts the bind address.Yes, but as an opt‑in feature. A bundled drop‑in that disables non‑essential services and configures ListenAddress to 127.0.0.1 would protect users who immediately boot the live image. Testers who need external access can enable the broader profile with a single command or by editing the drop‑in. This approach keeps the default safe while preserving the flexibility required for penetration‑testing scenarios.
systemctl enable --now ssh + ListenAddress 127.0.0.1) that users can apply before enabling the service.ListenAddress or add the desired external address) when external testing is desired.What is the exact OpenSSH server version installed on the live image? The behaviour of ListenAddress and the default bind address can differ in pre‑8.x releases, so confirming the version (e.g., dpkg -l openssh-server) would ensure the guidance applies to the target system.
Use comments to ask for clarification. Post a solution as an answer.
5,650 reputation · 20 Oct 2020, 01:01 UTC
In a clean Kali Live session the openssh-server package is installed but sshd is disabled. When a user starts it with sudo systemctl start sshd, the daemon binds to 0.0.0.0 and :: because /etc/ssh/sshd_config contains no ListenAddress entries. With no nftables ruleset active, all inbound traffic reaches the service, which can expose the machine to the local network.
ListenAddress 127.0.0.1 (or a specific IP) to /etc/ssh/sshd_config and restart sshd.sudo nft add rule inet filter input iifname "lo" accept and drop other interfaces.sudo systemctl start sshd
ss -tlnp | grep sshd
sudo nft list ruleset
# From another host
ssh user@kali-ip # should fail after the change
ssh user@127.0.0.1 # should succeed
These steps keep the SSH service available only locally, reducing the attack surface while still allowing remote management when the profile is intentionally relaxed.