Hi Hector,
Thanks for the PPA build! I tested openssh-server
1:9.6p1-3ubuntu13.20~ppa1789715641+d0b2f46 on a clean Ubuntu 24.04 Noble
container.
Test setup:
- sshd config:
PermitRootLogin forced-commands-only
UsePAM yes
- /root/.ssh/authorized_keys:
Key 1: command="/bin/echo FORCED_COMMAND_SUCCESS" ssh-ed25519 AAAAC3...
Key 2: ssh-ed25519 AAAAC3... (no command option)
--------------------------------------------------
1. Before fix: 1:9.6p1-3ubuntu13.19 (noble-updates)
--------------------------------------------------
Testing Key 2 (without forced command):
$ ssh -i /tmp/key_unforced root@localhost
client_loop: send disconnect: Broken pipe
sshd journal log:
sshd[3191]: Accepted key ED25519 SHA256:rc1T... found at
/root/.ssh/authorized_keys:2
sshd[3191]: ROOT LOGIN REFUSED FROM 127.0.0.1 port 48170
sshd[3191]: Failed publickey for root from 127.0.0.1 port 48170 ssh2: ED25519
SHA256:rc1T...
sshd[3191]: Root login accepted for forced command. [preauth]
sshd[3191]: fatal: monitor_child_preauth: unexpected authentication from 102
The unprivileged child mistakenly serialized "true" for force_command,
sending message 102 to the monitor and causing the fatal abort.
--------------------------------------------------
2. After fix: 1:9.6p1-3ubuntu13.20~ppa1789715641+d0b2f46 (PPA)
--------------------------------------------------
Test with Key 1 (with forced command):
$ ssh -i /tmp/key_forced root@localhost
FORCED_COMMAND_SUCCESS
sshd journal log:
sshd[3622]: Accepted key ED25519 SHA256:z8p9... found at
/root/.ssh/authorized_keys:1
sshd[3622]: Root login accepted for forced command.
sshd[3622]: Accepted publickey for root from 127.0.0.1 port 38696 ssh2:
ED25519 SHA256:z8p9...
sshd[3622]: Starting session: forced-command (key-option) '/bin/echo
FORCED_COMMAND_SUCCESS' for root from 127.0.0.1 port 38696 id 0
Test with Key 2 (without forced command):
$ ssh -i /tmp/key_unforced root@localhost
root@localhost: Permission denied (publickey).
sshd journal log:
sshd[3702]: Accepted key ED25519 SHA256:rc1T... found at
/root/.ssh/authorized_keys:2
sshd[3702]: ROOT LOGIN REFUSED FROM 127.0.0.1 port 44242
sshd[3702]: Failed publickey for root from 127.0.0.1 port 44242 ssh2: ED25519
SHA256:rc1T...
sshd[3702]: ROOT LOGIN REFUSED FROM 127.0.0.1 port 44242 [preauth]
sshd[3702]: Connection closed by authenticating user root 127.0.0.1 port
44242 [preauth]
The fatal monitor_child_preauth crash is completely gone. Both allowed
forced-commands and refused unforced logins behave cleanly as expected.
Verified working. :)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166842
Title:
sshd: fatal "monitor_child_preauth: unexpected authentication from
102" breaks root public-key login with PermitRootLogin=forced-
commands-only + UsePAM=yes (regression in 1:9.6p1-3ubuntu13.18)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2166842/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
