add vuln-coreos-pam-permit check for CoreOS Alpha 104x PAM bypass - #54

Summary

Adds vuln-coreos-pam-permit, a default-enabled check for CVE-2016-4455. CoreOS Linux Alpha 1045.0.0 and 1047.0.0 enabled pam_sss by marking it and pam_unix as sufficient while keeping Gentoo's trailing auth optional pam_permit.so. When both modules failed, PAM fell through to pam_permit, so any password opened a session for any account, including the password-less core and operator users.

References:

• https://web.archive.org/web/20160602013344/https://coreos.com/blog/security-brief-coreos-linux-alpha-remote-ssh-issue.html
• https://lwn.net/Articles/688235/

How the check works

• Runs only when the banner is exactly SSH-2.0-OpenSSH_7.2. CoreOS 1032 through 1053 shipped openssh-7.2_p2 from coreos-overlay, upstream sshd omits the portable suffix, and CoreOS set no addendum. Debian/Ubuntu (OpenSSH_7.2p2 ...), FreeBSD, and every other release are skipped without a connection.
• Requires keyboard-interactive or password auth. CoreOS used Gentoo defaults (UsePAM yes, PasswordAuthentication no, ChallengeResponseAuthentication yes), so the bypass was reached over keyboard-interactive.
• Tries the scanned user, then core and operator, with a random password over keyboard-interactive and then password. Each attempt opens a session and runs id. A finding is recorded only when the command completes.
• Caches the credential and the account that worked so -I first/-I all and the session-stage checks reconnect as that account.

Plumbing

AuthResult gains SessionUser (sessionUser in JSON). StartInteract and TestSession switch to that username when it differs from the scanned one.

Tests and targets

• In-process SSH server tests cover the fallback from root to core, the scanned user being tried first, password-only servers, no finding when every password is rejected, no connection for other banners, and reuse of the cached credential for interaction.
• docs/targets/coreos-pam-permit/ has a vulnerable image (OpenSSH 7.2p2 built from the upstream tarball with PAM on Ubuntu 16.04, CoreOS 104x PAM stack) and a patched control (pam_deny, as in 1053.0.0), plus a README with setup and verification steps.

Verified live: the default-user scan reports core via keyboard-interactive and the session checks and interactive mode reuse that session; -u operator reports on the first attempt; the patched control runs the check on the 7.2 banner and reports nothing.

Deviation noted in the docs

CoreOS listed pam_sss in the account stack as [default=bad success=ok user_unknown=ignore]. With no sssd running, pam_sss returns PAM_AUTHINFO_UNAVAIL there, which default=bad turns into a denial. The overlay sources do not explain how CoreOS logins got past that line, so both test images add authinfo_unavail=ignore to it. The two images then differ only in pam_permit versus pam_deny.

Merge note

This branch and vuln-musl-crypt-star both add docs/targets/README.md and the same README checks line, so whichever merges second needs a small conflict resolution.