Your message dated Sat, 06 Nov 2021 12:34:26 +0000 with message-id <E1mjKtu-000Ilo-BM@fasolo.debian.org> and subject line Bug#933665: fixed in openssh 1:8.7p1-1 has caused the Debian Bug report #933665, regarding userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedKeyTypes to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 933665: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=933665 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
--- Begin Message ---
- To: Debian Bug Tracking System <submit@bugs.debian.org>
- Subject: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedKeyTypes
- From: Gerald Turner <gturner@unzane.com>
- Date: Thu, 01 Aug 2019 08:32:54 -0700
- Message-id: <878sscyk7t.fsf@zoth-ommog.unzane.com>
Package: openssh-server Version: 1:7.9p1-10 Severity: normal Dear Maintainer, I've been running several servers, upgraded across many Debian stable releases, with sshd_config that had been tightened down in various ways (example attached) including explicit PubkeyAcceptedKeyTypes (containing ssh-rsa). After upgrading to buster a user reported that he could no longer login with his RSA key. sshd[17025]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedKeyTypes [preauth] I tested and found that explicitly defining PubkeyAcceptedKeyTypes in sshd_config breaks RSA pubkey auth, even when the line merely states: PubkeyAcceptedKeyTypes ssh-rsa However when PubkeyAcceptedKeyTypes is removed from the config, the implicit defaults allow RSA to work. I've attached sshd debug logs for the two scenarios. My guess is there's some sort of config parsing glitch within ssh. -- System Information: Debian Release: 10.0 APT prefers stable APT policy: (601, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.19.0-5-cloud-amd64 (SMP w/4 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages openssh-server depends on: ii adduser 3.118 ii debconf [debconf-2.0] 1.5.71 ii dpkg 1.19.7 ii libaudit1 1:2.8.4-3 ii libc6 2.28-10 ii libcom-err2 1.44.5-1 ii libgssapi-krb5-2 1.17-3 ii libkrb5-3 1.17-3 ii libpam-modules 1.3.1-5 ii libpam-runtime 1.3.1-5 ii libpam0g 1.3.1-5 ii libselinux1 2.8-1+b1 ii libssl1.1 1.1.1c-1 ii libsystemd0 241-5 ii libwrap0 7.6.q-28 ii lsb-base 10.2019051400 ii openssh-client 1:7.9p1-10 ii openssh-sftp-server 1:7.9p1-10 ii procps 2:3.3.15-2 ii ucf 3.0038+nmu1 ii zlib1g 1:1.2.11.dfsg-1 Versions of packages openssh-server recommends: ii libpam-systemd 241-5 ii ncurses-term 6.1+20181013-2 ii xauth 1:1.0.10-1 Versions of packages openssh-server suggests: pn molly-guard <none> pn monkeysphere <none> pn rssh <none> pn ssh-askpass <none> pn ufw <none> -- debconf information: openssh-server/permit-root-login: true * ssh/use_old_init_script: true ssh/encrypted_host_key_but_no_keygen: ssh/disable_cr_auth: false ssh/vulnerable_host_keys: openssh-server/password-authentication: true -- Gerald Turner <gturner@unzane.com> Encrypted mail preferred! OpenPGP: 4096R / CA89 B27A 30FA 66C5 1B80 3858 EC94 2276 FDB8 716DAllowAgentForwarding no AllowStreamLocalForwarding no AllowTcpForwarding no AllowUsers REDACTED AuthenticationMethods publickey password ChallengeResponseAuthentication no Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com ClientAliveCountMax 2 ClientAliveInterval 30 Compression no DebianBanner no DisableForwarding yes HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub HostKey /etc/ssh/ssh_host_ed25519_key HostKey /etc/ssh/ssh_host_rsa_key HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,ssh-rsa KexAlgorithms diffie-hellman-group18-sha512,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org LoginGraceTime 10 LogLevel VERBOSE MACs hmac-sha2-512-etm@openssh.com MaxAuthTries 3 MaxStartups 2:50:10 PermitOpen none PermitRootLogin no PermitUserRC no Port 50022 PrintMotd no PubkeyAcceptedKeyTypes ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,ssh-rsa RekeyLimit 1280M 53m59s Subsystem sftp /usr/lib/openssh/sftp-server TCPKeepAlive no UseDNS yes UsePAM yes# Rejected RSA pubkey login. # ssh running with explicit "PubkeyAcceptedKeyTypes ssh-rsa" in sshd_config Aug 1 08:18:25 zoth-ommog sshd[20165]: debug1: Forked child 20167. Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: Set /proc/self/oom_score_adj to 0 Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8 Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: inetd sockets after dupping: 3, 3 Aug 1 08:18:25 zoth-ommog sshd[20167]: Connection from REDACTED port 35260 on REDACTED port 50022 Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: Client protocol version 2.0; client software version OpenSSH_7.9p1 Debian-10 Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: match: OpenSSH_7.9p1 Debian-10 pat OpenSSH* compat 0x04000000 Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: Local version string SSH-2.0-OpenSSH_7.9p1 Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: permanently_set_uid: 103/65534 [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: list_hostkey_types: ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,ssh-rsa [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: SSH2_MSG_KEXINIT sent [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: SSH2_MSG_KEXINIT received [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: kex: algorithm: diffie-hellman-group18-sha512 [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: kex: host key algorithm: ssh-ed25519-cert-v01@openssh.com [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: kex: client->server cipher: aes256-gcm@openssh.com MAC: <implicit> compression: none [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: kex: server->client cipher: aes256-gcm@openssh.com MAC: <implicit> compression: none [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: expecting SSH2_MSG_KEXDH_INIT [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: rekey after 83886080 blocks [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: SSH2_MSG_NEWKEYS sent [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: expecting SSH2_MSG_NEWKEYS [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: SSH2_MSG_NEWKEYS received [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: rekey after 83886080 blocks [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: KEX done [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: userauth-request for user gturner service ssh-connection method none [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: attempt 0 failures 0 [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: authentication methods list 0: publickey Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: authentication methods list 1: password Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: authentication methods list 0: publickey [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: authentication methods list 1: password [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: PAM: initializing for "gturner" Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: PAM: setting PAM_RHOST to "REDACTED" Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: PAM: setting PAM_TTY to "ssh" Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: userauth-request for user gturner service ssh-connection method publickey [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: debug1: attempt 1 failures 0 [preauth] Aug 1 08:18:25 zoth-ommog sshd[20167]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedKeyTypes [preauth] Aug 1 08:18:28 zoth-ommog sshd[20167]: debug1: userauth-request for user gturner service ssh-connection method password [preauth] Aug 1 08:18:28 zoth-ommog sshd[20167]: debug1: attempt 2 failures 1 [preauth] Aug 1 08:18:28 zoth-ommog sshd[20167]: pam_ecryptfs: pam_sm_authenticate: /home/gturner is already mounted Aug 1 08:18:28 zoth-ommog sshd[20167]: debug1: PAM: password authentication accepted for gturner Aug 1 08:18:28 zoth-ommog sshd[20167]: debug1: do_pam_account: called Aug 1 08:18:28 zoth-ommog sshd[20167]: Accepted password for gturner from REDACTED port 35260 ssh2 Aug 1 08:18:28 zoth-ommog sshd[20167]: debug1: monitor_child_preauth: gturner has been authenticated by privileged process Aug 1 08:18:28 zoth-ommog sshd[20167]: debug1: monitor_read_log: child log fd closed Aug 1 08:18:28 zoth-ommog sshd[20167]: debug1: PAM: establishing credentials Aug 1 08:18:28 zoth-ommog sshd[20167]: pam_unix(sshd:session): session opened for user gturner by (uid=0) Aug 1 08:18:28 zoth-ommog systemd-logind[391]: New session 243 of user gturner. Aug 1 08:18:28 zoth-ommog sshd[20167]: User child is on pid 20174 Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: SELinux support disabled Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: PAM: establishing credentials Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: permanently_set_uid: 1000/100 Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: rekey after 83886080 blocks Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: rekey after 83886080 blocks Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: ssh_packet_set_postauth: called Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: active: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: Entering interactive session for SSH2. Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: server_init_dispatch Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: server_input_channel_open: ctype session rchan 0 win 1048576 max 16384 Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: input_session_request Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: channel 0: new [server-session] Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: session_new: session 0 Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: session_open: channel 0 Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: session_open: session 0: link with channel 0 Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: server_input_channel_open: confirm session Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: server_input_channel_req: channel 0 request pty-req reply 1 Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: session_by_channel: session 0 channel 0 Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: session_input_channel_req: session 0 req pty-req Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: Allocating pty. Aug 1 08:18:28 zoth-ommog sshd[20167]: debug1: session_new: session 0 Aug 1 08:18:28 zoth-ommog sshd[20167]: debug1: SELinux support disabled Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: session_pty_req: session 0 alloc /dev/pts/20 Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: server_input_channel_req: channel 0 request env reply 0 Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: session_by_channel: session 0 channel 0 Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: session_input_channel_req: session 0 req env Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: server_input_channel_req: channel 0 request shell reply 1 Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: session_by_channel: session 0 channel 0 Aug 1 08:18:28 zoth-ommog sshd[20174]: debug1: session_input_channel_req: session 0 req shell Aug 1 08:18:28 zoth-ommog sshd[20174]: Starting session: shell on pts/20 for gturner from REDACTED port 35260 id 0 Aug 1 08:18:28 zoth-ommog sshd[20175]: debug1: Setting controlling tty using TIOCSCTTY. Aug 1 08:18:29 zoth-ommog sshd[20174]: debug1: Received SIGCHLD. Aug 1 08:18:29 zoth-ommog sshd[20174]: debug1: session_by_pid: pid 20175 Aug 1 08:18:29 zoth-ommog sshd[20174]: debug1: session_exit_message: session 0 channel 0 pid 20175 Aug 1 08:18:29 zoth-ommog sshd[20174]: debug1: session_exit_message: release channel 0 Aug 1 08:18:29 zoth-ommog sshd[20167]: debug1: session_by_tty: session 0 tty /dev/pts/20 Aug 1 08:18:29 zoth-ommog sshd[20167]: debug1: session_pty_cleanup2: session 0 release /dev/pts/20 Aug 1 08:18:29 zoth-ommog sshd[20174]: Received disconnect from REDACTED port 35260:11: disconnected by user Aug 1 08:18:29 zoth-ommog sshd[20174]: Disconnected from user gturner REDACTED port 35260 Aug 1 08:18:29 zoth-ommog sshd[20174]: debug1: do_cleanup Aug 1 08:18:29 zoth-ommog sshd[20167]: debug1: do_cleanup Aug 1 08:18:29 zoth-ommog sshd[20167]: debug1: PAM: cleanup Aug 1 08:18:29 zoth-ommog sshd[20167]: debug1: PAM: closing session Aug 1 08:18:29 zoth-ommog sshd[20167]: pam_unix(sshd:session): session closed for user gturner Aug 1 08:18:29 zoth-ommog sshd[20186]: pam_ecryptfs: Skipping automatic eCryptfs unmount Aug 1 08:18:29 zoth-ommog sshd[20167]: debug1: PAM: deleting credentials Aug 1 08:18:29 zoth-ommog sshd[20167]: debug1: audit_event: unhandled event 12 Aug 1 08:18:29 zoth-ommog systemd-logind[391]: Session 243 logged out. Waiting for processes to exit. Aug 1 08:18:29 zoth-ommog systemd-logind[391]: Removed session 243. Aug 1 08:18:37 zoth-ommog sshd[20165]: debug1: Forked child 20187. Aug 1 08:18:37 zoth-ommog sshd[20187]: debug1: Set /proc/self/oom_score_adj to 0 Aug 1 08:18:37 zoth-ommog sshd[20187]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8 Aug 1 08:18:37 zoth-ommog sshd[20187]: debug1: inetd sockets after dupping: 3, 3 Aug 1 08:18:37 zoth-ommog sshd[20187]: Connection from 2001:470:e861:3::2 port 60618 on REDACTED port 50022 Aug 1 08:18:37 zoth-ommog sshd[20187]: debug1: Client protocol version 2.0; client software version OpenSSH_7.9p1 Aug 1 08:18:37 zoth-ommog sshd[20187]: debug1: match: OpenSSH_7.9p1 pat OpenSSH* compat 0x04000000 Aug 1 08:18:37 zoth-ommog sshd[20187]: debug1: Local version string SSH-2.0-OpenSSH_7.9p1 Aug 1 08:18:37 zoth-ommog sshd[20187]: debug1: permanently_set_uid: 103/65534 [preauth] Aug 1 08:18:37 zoth-ommog sshd[20187]: debug1: list_hostkey_types: ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,ssh-rsa [preauth] Aug 1 08:18:37 zoth-ommog sshd[20187]: debug1: SSH2_MSG_KEXINIT sent [preauth] Aug 1 08:18:37 zoth-ommog sshd[20187]: Connection closed by 2001:470:e861:3::2 port 60618 [preauth] Aug 1 08:18:37 zoth-ommog sshd[20187]: debug1: do_cleanup [preauth] Aug 1 08:18:37 zoth-ommog sshd[20187]: debug1: monitor_read_log: child log fd closed Aug 1 08:18:37 zoth-ommog sshd[20187]: debug1: do_cleanup Aug 1 08:18:37 zoth-ommog sshd[20187]: debug1: Killing privsep child 20189 Aug 1 08:18:37 zoth-ommog sshd[20187]: debug1: audit_event: unhandled event 12 Aug 1 08:18:53 zoth-ommog sshd[20198]: debug1: Forked child 20199. Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: Set /proc/self/oom_score_adj to 0 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: inetd sockets after dupping: 3, 3 Aug 1 08:18:53 zoth-ommog sshd[20199]: Connection from REDACTED port 35262 on REDACTED port 50022 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: Client protocol version 2.0; client software version OpenSSH_7.9p1 Debian-10 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: match: OpenSSH_7.9p1 Debian-10 pat OpenSSH* compat 0x04000000 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: Local version string SSH-2.0-OpenSSH_7.9p1 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: permanently_set_uid: 103/65534 [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: list_hostkey_types: ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,ssh-rsa [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: SSH2_MSG_KEXINIT sent [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: SSH2_MSG_KEXINIT received [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: kex: algorithm: diffie-hellman-group18-sha512 [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: kex: host key algorithm: ssh-ed25519-cert-v01@openssh.com [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: kex: client->server cipher: aes256-gcm@openssh.com MAC: <implicit> compression: none [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: kex: server->client cipher: aes256-gcm@openssh.com MAC: <implicit> compression: none [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: expecting SSH2_MSG_KEXDH_INIT [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: rekey after 83886080 blocks [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: SSH2_MSG_NEWKEYS sent [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: expecting SSH2_MSG_NEWKEYS [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: SSH2_MSG_NEWKEYS received [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: rekey after 83886080 blocks [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: KEX done [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: userauth-request for user gturner service ssh-connection method none [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: attempt 0 failures 0 [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: authentication methods list 0: publickey Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: authentication methods list 1: password Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: PAM: initializing for "gturner" Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: PAM: setting PAM_RHOST to "REDACTED" Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: PAM: setting PAM_TTY to "ssh" Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: authentication methods list 0: publickey [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: authentication methods list 1: password [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: userauth-request for user gturner service ssh-connection method publickey [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: attempt 1 failures 0 [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: userauth_pubkey: test pkalg rsa-sha2-512 pkblob RSA SHA256:cN6+RJMBj25zximZ28B/CanFpjupWf/ABGrRGprS1LU [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: temporarily_use_uid: 1000/100 (e=0/0) Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: trying public key file /home/gturner/.ssh/authorized_keys Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: fd 4 clearing O_NONBLOCK Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: /home/gturner/.ssh/authorized_keys:2: matching key found: RSA SHA256:cN6+RJMBj25zximZ28B/CanFpjupWf/ABGrRGprS1LU Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: /home/gturner/.ssh/authorized_keys:2: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding Aug 1 08:18:53 zoth-ommog sshd[20199]: Accepted key RSA SHA256:cN6+RJMBj25zximZ28B/CanFpjupWf/ABGrRGprS1LU found at /home/gturner/.ssh/authorized_keys:2 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: restore_uid: 0/0 Aug 1 08:18:53 zoth-ommog sshd[20199]: Postponed publickey for gturner from REDACTED port 35262 ssh2 [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: userauth-request for user gturner service ssh-connection method publickey [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: attempt 2 failures 0 [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: temporarily_use_uid: 1000/100 (e=0/0) Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: trying public key file /home/gturner/.ssh/authorized_keys Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: fd 4 clearing O_NONBLOCK Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: /home/gturner/.ssh/authorized_keys:2: matching key found: RSA SHA256:cN6+RJMBj25zximZ28B/CanFpjupWf/ABGrRGprS1LU Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: /home/gturner/.ssh/authorized_keys:2: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding Aug 1 08:18:53 zoth-ommog sshd[20199]: Accepted key RSA SHA256:cN6+RJMBj25zximZ28B/CanFpjupWf/ABGrRGprS1LU found at /home/gturner/.ssh/authorized_keys:2 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: restore_uid: 0/0 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: auth_activate_options: setting new authentication options Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: do_pam_account: called Aug 1 08:18:53 zoth-ommog sshd[20199]: Accepted publickey for gturner from REDACTED port 35262 ssh2: RSA SHA256:cN6+RJMBj25zximZ28B/CanFpjupWf/ABGrRGprS1LU Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: monitor_child_preauth: gturner has been authenticated by privileged process Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: auth_activate_options: setting new authentication options [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: monitor_read_log: child log fd closed Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: PAM: establishing credentials Aug 1 08:18:53 zoth-ommog sshd[20199]: pam_unix(sshd:session): session opened for user gturner by (uid=0) Aug 1 08:18:53 zoth-ommog systemd-logind[391]: New session 244 of user gturner. Aug 1 08:18:53 zoth-ommog sshd[20199]: User child is on pid 20206 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: SELinux support disabled Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: PAM: establishing credentials Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: permanently_set_uid: 1000/100 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: rekey after 83886080 blocks Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: rekey after 83886080 blocks Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: ssh_packet_set_postauth: called Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: active: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: Entering interactive session for SSH2. Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: server_init_dispatch Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: server_input_channel_open: ctype session rchan 0 win 1048576 max 16384 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: input_session_request Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: channel 0: new [server-session] Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_new: session 0 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_open: channel 0 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_open: session 0: link with channel 0 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: server_input_channel_open: confirm session Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: server_input_channel_req: channel 0 request pty-req reply 1 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_by_channel: session 0 channel 0 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_input_channel_req: session 0 req pty-req Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: Allocating pty. Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: session_new: session 0 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: SELinux support disabled Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_pty_req: session 0 alloc /dev/pts/20 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: server_input_channel_req: channel 0 request env reply 0 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_by_channel: session 0 channel 0 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_input_channel_req: session 0 req env Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: server_input_channel_req: channel 0 request shell reply 1 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_by_channel: session 0 channel 0 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_input_channel_req: session 0 req shell Aug 1 08:18:53 zoth-ommog sshd[20206]: Starting session: shell on pts/20 for gturner from REDACTED port 35262 id 0 Aug 1 08:18:53 zoth-ommog sshd[20207]: debug1: Setting controlling tty using TIOCSCTTY. Aug 1 08:18:55 zoth-ommog sshd[20206]: debug1: Received SIGCHLD. Aug 1 08:18:55 zoth-ommog sshd[20206]: debug1: session_by_pid: pid 20207 Aug 1 08:18:55 zoth-ommog sshd[20206]: debug1: session_exit_message: session 0 channel 0 pid 20207 Aug 1 08:18:55 zoth-ommog sshd[20206]: debug1: session_exit_message: release channel 0 Aug 1 08:18:55 zoth-ommog sshd[20199]: debug1: session_by_tty: session 0 tty /dev/pts/20 Aug 1 08:18:55 zoth-ommog sshd[20199]: debug1: session_pty_cleanup2: session 0 release /dev/pts/20 Aug 1 08:18:55 zoth-ommog sshd[20206]: Received disconnect from REDACTED port 35262:11: disconnected by user Aug 1 08:18:55 zoth-ommog sshd[20206]: Disconnected from user gturner REDACTED port 35262 Aug 1 08:18:55 zoth-ommog sshd[20206]: debug1: do_cleanup Aug 1 08:18:55 zoth-ommog sshd[20199]: debug1: do_cleanup Aug 1 08:18:55 zoth-ommog sshd[20199]: debug1: PAM: cleanup Aug 1 08:18:55 zoth-ommog sshd[20199]: debug1: PAM: closing session Aug 1 08:18:55 zoth-ommog sshd[20199]: pam_unix(sshd:session): session closed for user gturner Aug 1 08:18:55 zoth-ommog sshd[20199]: debug1: PAM: deleting credentials Aug 1 08:18:55 zoth-ommog sshd[20199]: debug1: audit_event: unhandled event 12 Aug 1 08:18:55 zoth-ommog systemd-logind[391]: Session 244 logged out. Waiting for processes to exit. Aug 1 08:18:55 zoth-ommog systemd-logind[391]: Removed session 244.# Successful RSA pubkey login. # ssh had been restarted with PubkeyAcceptedKeyTypes *removed* from sshd_config Aug 1 08:18:53 zoth-ommog sshd[20198]: debug1: Forked child 20199. Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: Set /proc/self/oom_score_adj to 0 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: inetd sockets after dupping: 3, 3 Aug 1 08:18:53 zoth-ommog sshd[20199]: Connection from REDACTED port 35262 on REDACTED port 50022 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: Client protocol version 2.0; client software version OpenSSH_7.9p1 Debian-10 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: match: OpenSSH_7.9p1 Debian-10 pat OpenSSH* compat 0x04000000 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: Local version string SSH-2.0-OpenSSH_7.9p1 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: permanently_set_uid: 103/65534 [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: list_hostkey_types: ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,ssh-rsa [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: SSH2_MSG_KEXINIT sent [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: SSH2_MSG_KEXINIT received [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: kex: algorithm: diffie-hellman-group18-sha512 [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: kex: host key algorithm: ssh-ed25519-cert-v01@openssh.com [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: kex: client->server cipher: aes256-gcm@openssh.com MAC: <implicit> compression: none [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: kex: server->client cipher: aes256-gcm@openssh.com MAC: <implicit> compression: none [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: expecting SSH2_MSG_KEXDH_INIT [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: rekey after 83886080 blocks [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: SSH2_MSG_NEWKEYS sent [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: expecting SSH2_MSG_NEWKEYS [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: SSH2_MSG_NEWKEYS received [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: rekey after 83886080 blocks [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: KEX done [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: userauth-request for user gturner service ssh-connection method none [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: attempt 0 failures 0 [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: authentication methods list 0: publickey Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: authentication methods list 1: password Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: PAM: initializing for "gturner" Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: PAM: setting PAM_RHOST to "REDACTED" Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: PAM: setting PAM_TTY to "ssh" Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: authentication methods list 0: publickey [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: authentication methods list 1: password [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: userauth-request for user gturner service ssh-connection method publickey [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: attempt 1 failures 0 [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: userauth_pubkey: test pkalg rsa-sha2-512 pkblob RSA SHA256:cN6+RJMBj25zximZ28B/CanFpjupWf/ABGrRGprS1LU [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: temporarily_use_uid: 1000/100 (e=0/0) Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: trying public key file /home/gturner/.ssh/authorized_keys Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: fd 4 clearing O_NONBLOCK Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: /home/gturner/.ssh/authorized_keys:2: matching key found: RSA SHA256:cN6+RJMBj25zximZ28B/CanFpjupWf/ABGrRGprS1LU Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: /home/gturner/.ssh/authorized_keys:2: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding Aug 1 08:18:53 zoth-ommog sshd[20199]: Accepted key RSA SHA256:cN6+RJMBj25zximZ28B/CanFpjupWf/ABGrRGprS1LU found at /home/gturner/.ssh/authorized_keys:2 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: restore_uid: 0/0 Aug 1 08:18:53 zoth-ommog sshd[20199]: Postponed publickey for gturner from REDACTED port 35262 ssh2 [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: userauth-request for user gturner service ssh-connection method publickey [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: attempt 2 failures 0 [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: temporarily_use_uid: 1000/100 (e=0/0) Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: trying public key file /home/gturner/.ssh/authorized_keys Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: fd 4 clearing O_NONBLOCK Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: /home/gturner/.ssh/authorized_keys:2: matching key found: RSA SHA256:cN6+RJMBj25zximZ28B/CanFpjupWf/ABGrRGprS1LU Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: /home/gturner/.ssh/authorized_keys:2: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding Aug 1 08:18:53 zoth-ommog sshd[20199]: Accepted key RSA SHA256:cN6+RJMBj25zximZ28B/CanFpjupWf/ABGrRGprS1LU found at /home/gturner/.ssh/authorized_keys:2 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: restore_uid: 0/0 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: auth_activate_options: setting new authentication options Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: do_pam_account: called Aug 1 08:18:53 zoth-ommog sshd[20199]: Accepted publickey for gturner from REDACTED port 35262 ssh2: RSA SHA256:cN6+RJMBj25zximZ28B/CanFpjupWf/ABGrRGprS1LU Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: monitor_child_preauth: gturner has been authenticated by privileged process Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: auth_activate_options: setting new authentication options [preauth] Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: monitor_read_log: child log fd closed Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: PAM: establishing credentials Aug 1 08:18:53 zoth-ommog sshd[20199]: pam_unix(sshd:session): session opened for user gturner by (uid=0) Aug 1 08:18:53 zoth-ommog systemd-logind[391]: New session 244 of user gturner. Aug 1 08:18:53 zoth-ommog sshd[20199]: User child is on pid 20206 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: SELinux support disabled Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: PAM: establishing credentials Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: permanently_set_uid: 1000/100 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: rekey after 83886080 blocks Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: rekey after 83886080 blocks Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: ssh_packet_set_postauth: called Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: active: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: Entering interactive session for SSH2. Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: server_init_dispatch Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: server_input_channel_open: ctype session rchan 0 win 1048576 max 16384 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: input_session_request Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: channel 0: new [server-session] Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_new: session 0 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_open: channel 0 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_open: session 0: link with channel 0 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: server_input_channel_open: confirm session Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: server_input_channel_req: channel 0 request pty-req reply 1 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_by_channel: session 0 channel 0 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_input_channel_req: session 0 req pty-req Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: Allocating pty. Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: session_new: session 0 Aug 1 08:18:53 zoth-ommog sshd[20199]: debug1: SELinux support disabled Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_pty_req: session 0 alloc /dev/pts/20 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: server_input_channel_req: channel 0 request env reply 0 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_by_channel: session 0 channel 0 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_input_channel_req: session 0 req env Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: server_input_channel_req: channel 0 request shell reply 1 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_by_channel: session 0 channel 0 Aug 1 08:18:53 zoth-ommog sshd[20206]: debug1: session_input_channel_req: session 0 req shell Aug 1 08:18:53 zoth-ommog sshd[20206]: Starting session: shell on pts/20 for gturner from REDACTED port 35262 id 0 Aug 1 08:18:53 zoth-ommog sshd[20207]: debug1: Setting controlling tty using TIOCSCTTY. Aug 1 08:18:55 zoth-ommog sshd[20206]: debug1: Received SIGCHLD. Aug 1 08:18:55 zoth-ommog sshd[20206]: debug1: session_by_pid: pid 20207 Aug 1 08:18:55 zoth-ommog sshd[20206]: debug1: session_exit_message: session 0 channel 0 pid 20207 Aug 1 08:18:55 zoth-ommog sshd[20206]: debug1: session_exit_message: release channel 0 Aug 1 08:18:55 zoth-ommog sshd[20199]: debug1: session_by_tty: session 0 tty /dev/pts/20 Aug 1 08:18:55 zoth-ommog sshd[20199]: debug1: session_pty_cleanup2: session 0 release /dev/pts/20 Aug 1 08:18:55 zoth-ommog sshd[20206]: Received disconnect from REDACTED port 35262:11: disconnected by user Aug 1 08:18:55 zoth-ommog sshd[20206]: Disconnected from user gturner REDACTED port 35262 Aug 1 08:18:55 zoth-ommog sshd[20206]: debug1: do_cleanup Aug 1 08:18:55 zoth-ommog sshd[20199]: debug1: do_cleanup Aug 1 08:18:55 zoth-ommog sshd[20199]: debug1: PAM: cleanup Aug 1 08:18:55 zoth-ommog sshd[20199]: debug1: PAM: closing session Aug 1 08:18:55 zoth-ommog sshd[20199]: pam_unix(sshd:session): session closed for user gturner Aug 1 08:18:55 zoth-ommog sshd[20199]: debug1: PAM: deleting credentials Aug 1 08:18:55 zoth-ommog sshd[20199]: debug1: audit_event: unhandled event 12 Aug 1 08:18:55 zoth-ommog systemd-logind[391]: Session 244 logged out. Waiting for processes to exit. Aug 1 08:18:55 zoth-ommog systemd-logind[391]: Removed session 244.Attachment: signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
- To: 933665-close@bugs.debian.org
- Subject: Bug#933665: fixed in openssh 1:8.7p1-1
- From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>
- Date: Sat, 06 Nov 2021 12:34:26 +0000
- Message-id: <E1mjKtu-000Ilo-BM@fasolo.debian.org>
- Reply-to: Colin Watson <cjwatson@debian.org>
Source: openssh Source-Version: 1:8.7p1-1 Done: Colin Watson <cjwatson@debian.org> We believe that the bug you reported is fixed in the latest version of openssh, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 933665@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Colin Watson <cjwatson@debian.org> (supplier of updated openssh package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 06 Nov 2021 12:23:47 +0000 Source: openssh Architecture: source Version: 1:8.7p1-1 Distribution: unstable Urgency: medium Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org> Changed-By: Colin Watson <cjwatson@debian.org> Closes: 343267 609122 734386 762633 764027 875532 933665 995130 997030 997035 998069 Changes: openssh (1:8.7p1-1) unstable; urgency=medium . * debian/upstream/signing-key.asc: Update from upstream. * New upstream release (https://www.openssh.com/releasenotes.html#8.7p1): - scp(1): this release changes the behaviour of remote to remote copies (e.g. "scp host-a:/path host-b:") to transfer through the local host by default (closes: #734386, LP: #1462758). This was previously available via the -3 flag. A -R flag has been added to select the old behaviour. - ssh(1)/sshd(8): both the client and server are now using a stricter configuration file parser. - ssh(1): when using SSHFP DNS records for host key verification, ssh(1) will verify all matching records instead of just those with the specific signature type requested. - ssh-keygen(1): when generating a FIDO key and specifying an explicit attestation challenge (using -Ochallenge), the challenge will now be hashed by the builtin security key middleware. - sshd(8): environment="..." directives in authorized_keys files are now first-match-wins and limited to 1024 discrete environment variable names. - scp(1): experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used. SFTP offers more predictable filename handling and does not require expansion of glob(3) patterns via the shell on the remote side. SFTP support may be enabled via a temporary scp -s flag. It is intended for SFTP to become the default transfer mode in the near future, at which time the -s flag will be removed. The -O flag exists to force use of the original SCP/RCP protocol for cases where SFTP may be unavailable or incompatible. - sftp-server(8): add a protocol extension to support expansion of ~/ and ~user/ prefixed paths. This was added to support these paths when used by scp(1) while in SFTP mode. - ssh(1): add a ForkAfterAuthentication ssh_config(5) counterpart to the ssh(1) -f flag. GHPR231 - ssh(1): add a StdinNull directive to ssh_config(5) that allows the config file to do the same thing as -n does on the ssh(1) command- line. GHPR231 - ssh(1): add a SessionType directive to ssh_config, allowing the configuration file to offer equivalent control to the -N (no session) and -s (subsystem) command-line flags (closes: #609122). - ssh-keygen(1): allowed signers files used by ssh-keygen(1) signatures now support listing key validity intervals alongside they key, and ssh-keygen(1) can optionally check during signature verification whether a specified time falls inside this interval. This feature is intended for use by git to support signing and verifying objects using ssh keys. - ssh-keygen(8): support printing of the full public key in a sshsig signature via a -Oprint-pubkey flag. - ssh(1)/sshd(8): start time-based re-keying exactly on schedule in the client and server mainloops. Previously the re-key timeout could expire but re-keying would not start until a packet was sent or received, causing a spin in select() if the connection was quiescent. - ssh-keygen(1): avoid Y2038 problem in printing certificate validity lifetimes. Dates past 2^31-1 seconds since epoch were displayed incorrectly on some platforms. - scp(1): allow spaces to appear in usernames for local to remote and scp -3 remote to remote copies. - ssh(1)/sshd(8): remove references to ChallengeResponseAuthentication in favour of KbdInteractiveAuthentication. The former is what was in SSHv1, the latter is what is in SSHv2 (RFC4256) and they were treated as somewhat but not entirely equivalent. We retain the old name as a deprecated alias so configuration files continue to work as well as a reference in the man page for people looking for it. - ssh(1)/ssh-add(1)/ssh-keygen(1): fix decoding of X.509 subject name when extracting a key from a PKCS#11 certificate. - ssh(1): restore blocking status on stdio fds before close. ssh(1) needs file descriptors in non-blocking mode to operate but it was not restoring the original state on exit. This could cause problems with fds shared with other programs via the shell. - ssh(1)/sshd(8): switch both client and server mainloops from select(3) to pselect(3). Avoids race conditions where a signal may arrive immediately before select(3) and not be processed until an event fires. - ssh(1): sessions started with ControlPersist were incorrectly executing a shell when the -N (no shell) option was specified (closes: #762633). - ssh(1): check if IPQoS or TunnelDevice are already set before overriding. Prevents values in config files from overriding values supplied on the command line. - ssh(1): fix debug message when finding a private key to match a certificate being attempted for user authentication. Previously it would print the certificate's path, whereas it was supposed to be showing the private key's path. - sshd(8): match host certificates against host public keys, not private keys. Allows use of certificates with private keys held in a ssh-agent. - ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8), which allows RSA/SHA2 signatures for public key authentication but fails to advertise this correctly via SSH2_MSG_EXT_INFO. This causes clients of these server to incorrectly match PubkeyAcceptedAlgorithms and potentially refuse to offer valid keys. - sftp(1)/scp(1): degrade gracefully if a sftp-server offers the limits@openssh.com extension but fails when the client tries to invoke it. - ssh(1): allow ssh_config SetEnv to override $TERM, which is otherwise handled specially by the protocol. Useful in ~/.ssh/config to set TERM to something generic (e.g. "xterm" instead of "xterm-256color") for destinations that lack terminfo entries. - sftp-server(8): the limits@openssh.com extension was incorrectly marked as an operation that writes to the filesystem, which made it unavailable in sftp-server read-only mode. - ssh(1): fix SEGV in UpdateHostkeys debug() message, triggered when the update removed more host keys than remain present. - Many manual page fixes. - sshd(8): handle GIDs > 2^31 in getgrouplist. When compiled in 32bit mode, the getgrouplist implementation may fail for GIDs greater than LONG_MAX. - ssh(1): xstrdup environment variable used by ForwardAgent. - sshd(8): don't sigdie() in signal handler in privsep child process; this can end up causing sandbox violations. * New upstream release (https://www.openssh.com/releasenotes.html#8.6p1): - sftp-server(8): add a new limits@openssh.com protocol extension that allows a client to discover various server limits, including maximum packet size and maximum read/write length. - sftp(1): use the new limits@openssh.com extension (when available) to select better transfer lengths in the client. - sshd(8): Add ModuliFile keyword to sshd_config to specify the location of the "moduli" file containing the groups for DH-GEX. - ssh_config(5), sshd_config(5): sync CASignatureAlgorithms lists in manual pages with the current default. - ssh(1): ensure that pkcs11_del_provider() is called before exit. - ssh(1), sshd(8): fix problems in string->argv conversion. Multiple backslashes were not being dequoted correctly and quoted space in the middle of a string was being incorrectly split. - ssh(1): return non-zero exit status when killed by signal. - sftp-server(8): increase maximum SSH2_FXP_READ to match the maximum packet size. Also handle zero-length reads that are not explicitly banned by the spec. - sshd(8): don't mistakenly exit on transient read errors on the network socket (e.g. EINTR, EAGAIN). - Create a dedicated contrib/gnome-ssk-askpass3.c source instead of building it from the same file as used for GNOME2. Use the GNOME3 gdk_seat_grab() to manage keyboard/mouse/server grabs for better compatibility with Wayland. - sshd(8): soft-disallow the fstatat64 syscall in the Linux seccomp-bpf sandbox. * New upstream release (https://www.openssh.com/releasenotes.html#8.5p1): - ssh(1), sshd(8): change the first-preference signature algorithm from ECDSA to ED25519. - ssh(1), sshd(8): set the TOS/DSCP specified in the configuration for interactive use prior to TCP connect. - ssh(1), sshd(8): remove the pre-standardization cipher rijndael-cbc@lysator.liu.se. - ssh(1), sshd(8): update/replace the experimental post-quantum hybrid key exchange method based on Streamlined NTRU Prime coupled with X25519. - ssh(1): disable CheckHostIP by default. It provides insignificant benefits while making key rotation significantly more difficult, especially for hosts behind IP-based load-balancers (closes: #764027). - ssh(1): enable UpdateHostkeys by default subject to some conservative preconditions (closes: #875532): + The key was matched in the UserKnownHostsFile (and not in the GlobalKnownHostsFile). + The same key does not exist under another name. + A certificate host key is not in use. + known_hosts contains no matching wildcard hostname pattern. + VerifyHostKeyDNS is not enabled. + The default UserKnownHostsFile is in use. We expect some of these conditions will be modified or relaxed in future. - ssh(1), sshd(8): add a new LogVerbose configuration directive that allows forcing maximum debug logging by file/function/line pattern-lists. - ssh(1): when prompting the user to accept a new hostkey, display any other host names/addresses already associated with the key. - ssh(1): allow UserKnownHostsFile=none to indicate that no known_hosts file should be used to identify host keys. - ssh(1): add a ssh_config KnownHostsCommand option that allows the client to obtain known_hosts data from a command in addition to the usual files. - ssh(1): add a ssh_config PermitRemoteOpen option that allows the client to restrict the destination when RemoteForward is used with SOCKS. - ssh(1): for FIDO keys, if a signature operation fails with a "incorrect PIN" reason and no PIN was initially requested from the user, then request a PIN and retry the operation. This supports some biometric devices that fall back to requiring PIN when reading of the biometric failed, and devices that require PINs for all hosted credentials. - sshd(8): implement client address-based rate-limiting via new sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize directives that provide more fine-grained control on a per-origin address basis than the global MaxStartups limit. - ssh(1): Prefix keyboard interactive prompts with "(user@host)" to make it easier to determine which connection they are associated with in cases like scp -3, ProxyJump, etc. (closes: #343267). - sshd(8): fix sshd_config SetEnv directives located inside Match blocks. - ssh(1): when requesting a FIDO token touch on stderr, inform the user once the touch has been recorded. - ssh(1): prevent integer overflow when ridiculously large ConnectTimeout values are specified, capping the effective value (for most platforms) at 24 days. - ssh(1): consider the ECDSA key subtype when ordering host key algorithms in the client. - ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to PubkeyAcceptedAlgorithms. The previous name incorrectly suggested that it control allowed key algorithms, when this option actually specifies the signature algorithms that are accepted. The previous name remains available as an alias (closes: #933665). - ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms. - sftp-server(8): add missing lsetstat@openssh.com documentation and advertisement in the server's SSH2_FXP_VERSION hello packet. - ssh(1), sshd(8): more strictly enforce KEX state-machine by banning packet types once they are received. Fixes memleak caused by duplicate SSH2_MSG_KEX_DH_GEX_REQUEST. - sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit platforms instead of being limited by LONG_MAX. - Minor man page fixes (capitalization, commas, etc.) - sftp(1): when doing an sftp recursive upload or download of a read-only directory, ensure that the directory is created with write and execute permissions in the interim so that the transfer can actually complete, then set the directory permission as the final step. - ssh-keygen(1): document the -Z, check the validity of its argument earlier and provide a better error message if it's not correct. - ssh(1): ignore comments at the end of config lines in ssh_config, similar to what we already do for sshd_config. - sshd_config(5): mention that DisableForwarding is valid in a sshd_config Match block. - sftp(1): fix incorrect sorting of "ls -ltr" under some circumstances. - ssh(1), sshd(8): fix potential integer truncation of (unlikely) timeout values. - ssh(1): make hostbased authentication send the signature algorithm in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type. This make HostbasedAcceptedAlgorithms do what it is supposed to - filter on signature algorithm and not key type. - sshd(8): add a number of platform-specific syscalls to the Linux seccomp-bpf sandbox. - sshd(8): remove debug message from sigchld handler that could cause deadlock on some platforms. - Sync contrib/ssh-copy-id with upstream. * Remove OpenBSD-specific rdomain references from sshd_config(5) (closes: #998069). * Define MAXHOSTNAMELEN on GNU/Hurd (thanks, Svante Signell; closes: #997030). * Build-depend on libelogind-dev as an alternative to libsystemd-dev on Linux (thanks, Svante Signell; closes: #997035). * Backport from upstream: - CVE-2021-41617 (closes: #995130): sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise supplemental groups when executing an AuthorizedKeysCommand or AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or AuthorizedPrincipalsCommandUser directive has been set to run the command as a different user. Instead these commands would inherit the groups that sshd(8) was started with. * Configure with ac_cv_func_closefrom=no to avoid an incompatibility with glibc 2.34's fallback_closefrom function (thanks, William 'jawn-smith' Wilson; LP: #1944621). Checksums-Sha1: 35a6ed3a7daa358f857bdb1588c77e55c957241d 3382 openssh_8.7p1-1.dsc 8719032c1e47732c8fdb14adfb24b5e9e71de802 1814595 openssh_8.7p1.orig.tar.gz d0d0d2442bed150073213a0ce46f21944da22664 833 openssh_8.7p1.orig.tar.gz.asc 262d4cca9c9ef007bff54b25b9aab3b4dcc81ae1 186008 openssh_8.7p1-1.debian.tar.xz Checksums-Sha256: d3b668e42f2af28f75557587ec34c3c4345ed397564cc8215dafaad8b45ab789 3382 openssh_8.7p1-1.dsc 7ca34b8bb24ae9e50f33792b7091b3841d7e1b440ff57bc9fabddf01e2ed1e24 1814595 openssh_8.7p1.orig.tar.gz bb18c454a3e5d3738cb26a1c89e17c467d7a59529ec92251b26461ae04771eba 833 openssh_8.7p1.orig.tar.gz.asc 7c6ad0691cceffca8a0f91dd3145f783b9f889bae6d1dae8c7c3dce7e2070c31 186008 openssh_8.7p1-1.debian.tar.xz Files: 087f6aaacc0b1bd683a8615374e4bd50 3382 net standard openssh_8.7p1-1.dsc f545230799f131aecca04da56e61990a 1814595 net standard openssh_8.7p1.orig.tar.gz a0da35bba461f8f5dda6cd257b74a59a 833 net standard openssh_8.7p1.orig.tar.gz.asc f0f194cdc390456e450cfc25023e16df 186008 net standard openssh_8.7p1-1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEErApP8SYRtvzPAcEROTWH2X2GUAsFAmGGdBMACgkQOTWH2X2G UAvzhA/9H30X4u+taLc1CMpLmED4h0ZD1y2c+qpwHVIDKTg6G3Mf6KpV5qpl01yy 5knb5GD/VHtEkFRpJIWRB7a2ac4/tHB3iUOdNbm+Am9fuwdMm/K30Gz/VExO/Ced mIiopIPukqsIF5IuyfGHNKToBPTpYvj3p8/gjFjqqaSIMFbv3FM8zlrfXTqV4kuT c0pE/9C5f6vq8WxEDrPBLZHJVetbp9/L4yboznxeBRccW9ukJSj/evZx9kRprYJf uMDkVlF1vsYr1lruXAjc3zoHczFVu1RKERXIemtefnhca8fkRomtRgCoSvQjHbot nc+KsEtV1D4pkdCI1kisnHDmpSdP72Ui4dxHFd1RTEd0SGBb8cYOc0A6JGdo4Y6m WFNXRJj1szO3IDlka5SQGUrmkH1R0YxYmCa2XAv5ynIUVeE4LIzVb7CStEuo1ThS wpA40EFGWTllSgo/10KOvtObJJmZF8ZRKqUtQsZ3LNUAusk9ZVYkpEgPxQQJHp/n lE3fKgdc57Rk61EtB2RYkicy6SkfY+6leZ0kkLCIcc8Zqkbe6n7oYSsGZ8dES5xc 5jSxHQlC9HfhtkODgc/BYR7mSHWYFu0xz63uIMNRUXPxQ42YiAd5URwGvSfoO2Ml sFHzR7hFO1gAJKdDy0fs4/h+c6iDYZzMYsBzwJD5DRGJJbKq3hs= =bxQ3 -----END PGP SIGNATURE-----
--- End Message ---