Your message dated Wed, 12 Feb 2025 11:06:02 +0000 with message-id <[email protected]> and subject line Re: Bug#1095800: openssh-server: /etc/pam.d/sshd has deprecated reading of user environment enabled has caused the Debian Bug report #1095800, regarding openssh-server: /etc/pam.d/sshd has deprecated reading of user environment enabled to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 1095800: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1095800 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: openssh-server Version: 1:9.2p1-2+deb12u4 Severity: normal Dear Maintainer, Debian's openssh-server and it's PAM configuration in /etc/pam.d/sshd has deprecated reading of user environment enabled. PAM_ENV(8) man page tells that "user supplied environment variables in the PAM environment could affect behavior of subsequent modules in the stack without the consent of the system administrator.", which sounds like this could even be a security issue. Please remove reading of the user environment (user_readenv=1 parameter) from /etc/pam.d/sshd -- System Information: Debian Release: 12.9 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: arm64 (aarch64) Foreign Architectures: armhf Kernel: Linux 6.6.51+rpt-rpi-2712 (SMP w/4 CPU threads; PREEMPT) Kernel taint flags: TAINT_CRAP Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8), LANGUAGE=en_US.UTF-8 Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages openssh-server depends on: ii adduser 3.134 ii debconf [debconf-2.0] 1.5.82 ii init-system-helpers 1.65.2 ii libaudit1 1:3.0.9-1 ii libc6 2.36-9+rpt2+deb12u9 ii libcom-err2 1.47.0-2 ii libcrypt1 1:4.4.33-2 ii libgssapi-krb5-2 1.20.1-2+deb12u2 ii libkrb5-3 1.20.1-2+deb12u2 ii libpam-modules 1.5.2-6+rpt2+deb12u1 ii libpam-runtime 1.5.2-6+rpt2+deb12u1 ii libpam0g 1.5.2-6+rpt2+deb12u1 ii libselinux1 3.4-1+b6 ii libssl3 3.0.15-1~deb12u1+rpt1 ii libsystemd0 252.33-1~deb12u1 ii libwrap0 7.6.q-32 ii openssh-client 1:9.2p1-2+deb12u4 ii openssh-sftp-server 1:9.2p1-2+deb12u4 ii procps 2:4.0.2-3 ii runit-helper 2.15.2 ii sysvinit-utils [lsb-base] 3.06-4 ii ucf 3.0043+nmu1+deb12u1 ii zlib1g 1:1.2.13.dfsg-1+rpt1 Versions of packages openssh-server recommends: ii libpam-systemd [logind] 252.33-1~deb12u1 ii ncurses-term 6.4-4 ii xauth 1:1.1.2-1 Versions of packages openssh-server suggests: pn molly-guard <none> pn monkeysphere <none> pn ssh-askpass <none> pn ufw <none> -- Configuration Files: /etc/pam.d/sshd changed [not included] /etc/ssh/moduli changed [not included] -- debconf-show failed
--- End Message ---
--- Begin Message ---Source: openssh Source-Version: 1:9.7p1-6 On Wed, Feb 12, 2025 at 10:15:51AM +0200, pyllyukko wrote: > Debian's openssh-server and it's PAM configuration in /etc/pam.d/sshd > has deprecated reading of user environment enabled. > > PAM_ENV(8) man page tells that "user supplied environment variables in > the PAM environment could affect behavior of subsequent modules in the > stack without the consent of the system administrator.", which sounds > like this could even be a security issue. > > Please remove reading of the user environment (user_readenv=1 parameter) > from /etc/pam.d/sshd This is all true, but I already fixed it for the next Debian release a while ago: openssh (1:9.7p1-6) unstable; urgency=medium * Stop reading ~/.pam_environment, which has a history of security problems and is deprecated by PAM upstream (closes: #1018260). -- Colin Watson <[email protected]> Tue, 25 Jun 2024 14:20:44 +0100 I'm not going to backport this particular change to the current stable release because it potentially requires users to make changes to prepare for it first. There's an entry for it in the draft release notes for the next Debian release here: https://www.debian.org/releases/trixie/release-notes/issues.en.html#openssh-server-no-longer-reads-pam-environment Thanks, -- Colin Watson (he/him) [[email protected]]
--- End Message ---
