[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#579570: marked as done (openssh-server: asks for (empty) "old passphrase" on upgrade)

Your message dated Wed, 28 Apr 2010 22:06:24 +0000
with message-id <E1O7FOi-0000Zv-2O@ries.debian.org>
and subject line Bug#579570: fixed in openssh 1:5.5p1-3
has caused the Debian Bug report #579570,
regarding openssh-server: asks for (empty) "old passphrase" on upgrade
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org

579570: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=579570
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message ---
Subject: openssh-server: asks for (empty) "old passphrase" on upgrade
Package: openssh-server
Version: 1:5.5p1-2
Severity: normal

When upgrading one of my Squeeze boxes, openssh-server 1:5.3p1-3 got
replaced by 1:5.5p1-2. The postinst script then asked me for an old

Setting up openssh-server (1:5.5p1-2) ...
Installing new version of config file /etc/init.d/ssh ...
Installing new version of config file /etc/default/ssh ...
Enter old passphrase: 
dpkg: error processing openssh-server (--configure):
 subprocess installed post-installation script killed by signal (Interrupt)
Errors were encountered while processing:
E: Sub-process /usr/bin/dpkg returned an error code (1)
A package failed to install.  Trying to recover:
Setting up openssh-server (1:5.5p1-2) ...
Enter old passphrase: 
dpkg: error processing openssh-server (--configure):
 subprocess installed post-installation script killed by signal (Interrupt)
Errors were encountered while processing:

In the above case I just pressed Ctrl-C since it was not obvious what
kind of passphrase would have been needed.

Adding set -x to the postinst script revealed that it 

+ check_idea_key
+ [ -f /etc/ssh/ssh_host_key ]
+ cp -a /etc/ssh/ssh_host_key /etc/ssh/ssh_host_key.check_idea
+ grep -q unknown cipher
+ ssh-keygen -p -N  -f /etc/ssh/ssh_host_key.check_idea
Enter old passphrase: 
+ rm -f /etc/ssh/ssh_host_key.check_idea
+ create_keys
+ host_keys_required
+ get_config_option HostKey
+ option=HostKey

The corresponding line in the postinst script is line 30:

30                if ssh-keygen -p -N '' -f /etc/ssh/ssh_host_key.check_idea 2>&1 | \
31                                grep -q 'unknown cipher' 2>/dev/null; then

I currently have no idea why the -p option is needed here. Wouldn't it
prompt for a passphrase anyway if one would be necessary? Especially
since the hostkeys usually don't have a passphrase, prompting should
only happen if the key does have a passphrase. Explicitly prompting
for one breaks all unattended upgrades.

After I knew that the questioned passphrase is the one of a host key,
I just pressed Enter and the upgrade continued and successfully

It is indeed possible that this box had ancient host keys as they were
always transferred to the new hardware when  the hostname moved to
other hardware.

-- System Information:
Debian Release: squeeze/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: i386 (i586)

Kernel: Linux 2.6.32-3-486
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages openssh-server depends on:
ii  adduser                 3.112            add and remove users and groups
ii  debconf [debconf-2.0]   1.5.32           Debian configuration management sy
ii  dpkg                   Debian package management system
ii  libc6                   2.10.2-6         Embedded GNU C Library: Shared lib
ii  libcomerr2              1.41.11-1        common error description library
ii  libgssapi-krb5-2        1.8.1+dfsg-2     MIT Kerberos runtime libraries - k
ii  libkrb5-3               1.8.1+dfsg-2     MIT Kerberos runtime libraries
ii  libpam-modules          1.1.1-2          Pluggable Authentication Modules f
ii  libpam-runtime          1.1.1-2          Runtime support for the PAM librar
ii  libpam0g                1.1.1-2          Pluggable Authentication Modules l
ii  libselinux1             2.0.94-1         SELinux runtime shared libraries
ii  libssl0.9.8             0.9.8n-1         SSL shared libraries
ii  libwrap0                7.6.q-18         Wietse Venema's TCP wrappers libra
ii  lsb-base                3.2-23           Linux Standard Base 3.2 init scrip
ii  openssh-blacklist       0.4.1            list of default blacklisted OpenSS
ii  openssh-client          1:5.5p1-2        secure shell (SSH) client, for sec
ii  procps                  1:3.2.8-8        /proc file system utilities
ii  zlib1g                  1: compression library - runtime

Versions of packages openssh-server recommends:
ii  openssh-blacklist-extra       0.4.1      list of non-default blacklisted Op
ii  xauth                         1:1.0.4-1  X authentication utility

Versions of packages openssh-server suggests:
pn  molly-guard                   <none>     (no description available)
pn  rssh                          <none>     (no description available)
pn  ssh-askpass                   <none>     (no description available)
pn  ufw                           <none>     (no description available)

-- debconf information:
* ssh/use_old_init_script: true
  ssh/disable_cr_auth: false

--- End Message ---
--- Begin Message ---
Source: openssh
Source-Version: 1:5.5p1-3

We believe that the bug you reported is fixed in the latest version of
openssh, which is due to be installed in the Debian FTP archive:

  to main/o/openssh/openssh-client-udeb_5.5p1-3_i386.udeb
  to main/o/openssh/openssh-client_5.5p1-3_i386.deb
  to main/o/openssh/openssh-server-udeb_5.5p1-3_i386.udeb
  to main/o/openssh/openssh-server_5.5p1-3_i386.deb
  to main/o/openssh/openssh_5.5p1-3.debian.tar.gz
  to main/o/openssh/openssh_5.5p1-3.dsc
  to main/o/openssh/ssh-askpass-gnome_5.5p1-3_i386.deb
  to main/o/openssh/ssh-krb5_5.5p1-3_all.deb
  to main/o/openssh/ssh_5.5p1-3_all.deb

A summary of the changes between this version and the previous one is

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 579570@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
Colin Watson <cjwatson@debian.org> (supplier of updated openssh package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

Hash: SHA1

Format: 1.8
Date: Wed, 28 Apr 2010 22:12:47 +0100
Source: openssh
Binary: openssh-client openssh-server ssh ssh-krb5 ssh-askpass-gnome openssh-client-udeb openssh-server-udeb
Architecture: source i386 all
Version: 1:5.5p1-3
Distribution: unstable
Urgency: low
Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
 openssh-client - secure shell (SSH) client, for secure access to remote machines
 openssh-client-udeb - secure shell client for the Debian installer (udeb)
 openssh-server - secure shell (SSH) server, for secure access from remote machines
 openssh-server-udeb - secure shell server for the Debian installer (udeb)
 ssh        - secure shell client and server (metapackage)
 ssh-askpass-gnome - interactive X program to prompt users for a passphrase for ssh-ad
 ssh-krb5   - secure shell client and server (transitional package)
Closes: 579285 579570
 openssh (1:5.5p1-3) unstable; urgency=low
   * Discard error messages while checking whether rsh, rlogin, and rcp
     alternatives exist (closes: #579285).
   * Drop IDEA key check; I don't think it works properly any more due to
     textual changes in error output, it's only relevant for direct upgrades
     from truly ancient versions, and it breaks upgrades if
     /etc/ssh/ssh_host_key can't be loaded (closes: #579570).
 9483c9e18247f709ee9f23bde7142b5b909ba749 1690 openssh_5.5p1-3.dsc
 c489f846c8455a4a65d2fa08c47b572bc7e57872 233257 openssh_5.5p1-3.debian.tar.gz
 583a5a70f1a0f98e71dd37320d02b9536e999f8b 877882 openssh-client_5.5p1-3_i386.deb
 3cdc928f499170c242d6a1e40de2e4abe438ee8d 297146 openssh-server_5.5p1-3_i386.deb
 892fdcd2477e255b783fcf213da5c22ff1dbb7e2 1246 ssh_5.5p1-3_all.deb
 71d17bc92055f1292b4b70f53a51a43a982cf545 95214 ssh-krb5_5.5p1-3_all.deb
 5b1455a34ad5c4f00e587198717738d001667d90 102802 ssh-askpass-gnome_5.5p1-3_i386.deb
 3aa748edfa97a545478163ef45427249ab40864b 193248 openssh-client-udeb_5.5p1-3_i386.udeb
 c20c02e4f37b31e5463a3fd638c6ec08e71329c4 218154 openssh-server-udeb_5.5p1-3_i386.udeb
 e009d638279e4ba046c8ab67ae91049082eaa0c6cce675774df1f1c5649705b2 1690 openssh_5.5p1-3.dsc
 37120b484a33a8644ac6c7c232ed936943a2faedf22f7f103f3be89c0e69aad3 233257 openssh_5.5p1-3.debian.tar.gz
 708dbec96290e425057bc996b15f463c5fbb5a92c602d487527e93c1c1c34d67 877882 openssh-client_5.5p1-3_i386.deb
 94bfd92ebf70e580a091e0e13f5cb7b93a2653a877dc3926981b1a2ef698f7c4 297146 openssh-server_5.5p1-3_i386.deb
 2f6502a816393ccd96a0f798ae17b8026678ec274c7cfacc2159730958972571 1246 ssh_5.5p1-3_all.deb
 0f35a541be0508d15c1f64f817bede6d0c2b50e8daf6fe092d2935ae8252ffa3 95214 ssh-krb5_5.5p1-3_all.deb
 97dde99bf148e085c3ffe17e6e678476c6ecc1811317b4a2d47d1cb0f62666db 102802 ssh-askpass-gnome_5.5p1-3_i386.deb
 0dadd2b8f1631c129bad4408dba19aab9f4fbc1736d823b8704d73eb3b5b92fd 193248 openssh-client-udeb_5.5p1-3_i386.udeb
 a2b8299f88bb517d804e388c664303013428772726b957b66c2358e63697a0e7 218154 openssh-server-udeb_5.5p1-3_i386.udeb
 a6fafd4a415a66b2f69fc99dac374a9e 1690 net standard openssh_5.5p1-3.dsc
 6b2955362dd8616e08a225666b754581 233257 net standard openssh_5.5p1-3.debian.tar.gz
 4acd4461f9c6ff83b2ca118f9dda9c2a 877882 net standard openssh-client_5.5p1-3_i386.deb
 8f7e39a47029d782e2270d4309490ba3 297146 net optional openssh-server_5.5p1-3_i386.deb
 c812bc528ab8acb0b0a457d4f934e223 1246 net extra ssh_5.5p1-3_all.deb
 e609bbd9e1f032277bad9282911ecea4 95214 net extra ssh-krb5_5.5p1-3_all.deb
 39573ac89160618c0ebcb2b6182e9211 102802 gnome optional ssh-askpass-gnome_5.5p1-3_i386.deb
 346e1a30503b36e5103a4760bec070d1 193248 debian-installer optional openssh-client-udeb_5.5p1-3_i386.udeb
 e3e19ee6eec52bad36b1be94960b6539 218154 debian-installer optional openssh-server-udeb_5.5p1-3_i386.udeb
Package-Type: udeb

Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Colin Watson <cjwatson@debian.org> -- Debian developer


--- End Message ---

Reply to: