** Description changed:
MIR report for source package: openssh
Target series: devel
#########################################################################
DELTA REPORT FOR src:openssh-gssapi WILL BE IN ITS OWN SECTION AT THE END
#########################################################################
[Availability]
- Current Launchpad builds pass on: amd64, amd64v3, arm64, armhf, i386,
ppc64el, riscv64, s390x.
- Source package: https://launchpad.net/ubuntu/+source/openssh
- The source package openssh is published in Ubuntu (main).
[Rationale]
- The package src:openssh is required in Ubuntu main because it's the
"thefacto" method to securely connect to remote systems, used by system
administrators, automation, Ubuntu infrastructure, clouds, home routers,
enterprise routers, the list goes on and on.
- The package src:openssh will generally be useful for a large part of our
user base.
- Additional reasons: the openssh package has been in main for the entirety
of Ubuntu's life so far.
- The package src:openssh is required in Ubuntu main no later than stonking
release due to the high expectation that it is in main already, and will be
kept in main.
- There are other SSH implementations in the archive, but OpenSSH is the
standard one, with all the features. The others usually implement a smaller
subset, are used in rescue systems, or are libraries or language modules used
by applications directly. For example, src:libssh2, or src:paramiko.
- The binary packages openssh-common, openssh-server, openssh-sftp-server,
and ssh need to be in main. These are the packages in main in stonking already,
being seeded or rdeps of other main packages. In any case, the packages I
listed are the essential part of Openssh: client and server.
[Security]
- No AppArmor profiles, desktop files, translations, or plugin candidates
were found.
- Security has been kept in mind and common isolation/risk-mitigation
patterns are in place.
OpenSSH upstream has several hardening features. They have separate
processes to handle authentication inside a sandbox (the "privilege
separation") approach
(http://www.citi.umich.edu/u/provos/papers/privsep.pdf).
There is no apparmor profile, as the remote shell would inherit this
profile and wouldn't work properly unless the profile is fully open.
Perhaps an apparmor profile, or other systemd security features could be
applied to the main listening process, and dropped later, but this has
not been done externally.
Other hardening techniques from the source code itself include:
- seccomp sandboxing:
https://github.com/openssh/openssh-portable/blob/master/sandbox-seccomp-filter.c
- protect private keys at rest in RAM:
https://www.openssh.org/txt/release-8.1?utm_source=gemini#:~:text=private%20keys%20at-,rest%20in%20RAM,-against%20speculation%20and
- really scrub sensitive data:
https://github.com/openssh/openssh-portable/blob/master/openbsd-compat/explicit_bzero.c?utm_source=gemini
AI: The evidence confirms the presence of compiler hardening
(`hardening=+all`) and seccomp sandboxing (`sandbox-seccomp-filter.c`).
However, it is insufficient to determine if mitigations are proportional
to the exposure because: (1) the evidence lists multiple SHA1
cryptographic pattern hits but does not indicate whether these
deprecated algorithms are disabled by default in the configuration; (2)
while systemd units are listed, their specific hardening directives are
not visible in the summary; and (3) the setuid binary `ssh-keysign`
lacks an AppArmor profile, and the evidence does not clarify if the
internal sandboxing is accepted as a sufficient substitute for this
component.
- It's a non-trivial task to completely erradicate deprecated
cryptographic algorithms in a tool like openssh. It still has to connect
to old systems, for example. Care is taken to over time deprecate these
algorithms, though.
Some examples of deprecations include:
- DSA keys: completely removed in OpenSSH 10.0, April 2025:
https://www.openssh.org/txt/release-10.0
- Finite-Field Diffie-Hellman Key Exchange disabled in OpenSSH 9.0, April
2023: https://www.openssh.org/txt/release-10.0
- RSA with SHA-1 disabled in OpenSSH 8.8, September 2021:
https://www.openssh.org/txt/release-8.8
- RC4, 3DES, Blowfish: disabled in OpenSSH 6.7, October 2014:
https://www.openssh.org/txt/release-6.7
- SSH1 protocol removed in OpenSSH 7.6, October 2017:
https://www.openssh.org/txt/release-7.6
- RC4, hmac-ripemd160, CAST, blowfish completely removed in OpenSSH 7.6,
October 2017: https://www.openssh.org/txt/release-7.6
- refuse RSA keys smaller than 1024 bits, log other keys that do not meet
the requirement in OpenSSH 7.6, October 2017:
https://www.openssh.org/txt/release-7.6
AI:
(The evidence includes a non-empty list of crypto_pattern_hits from the
source tree grep, with specific paths and line numbers matching deprecated
algorithm names (e.g., SHA1, MD5). The list is truncated but clearly shows
multiple occurrences across several files. This satisfies the policy condition
to list distinct files/lines and advise the reporter to confirm actual usage
before flagging Security review.)
Security history:
- The queried trackers found 28 associated CVE(s): CVE-2021-41617,
CVE-2023-38408, CVE-2023-48795, CVE-2023-51385, CVE-2025-26465, CVE-2025-32728,
CVE-2025-61984, CVE-2025-61985, CVE-2026-3497, CVE-2026-35385, CVE-2026-35386,
CVE-2026-35387, CVE-2026-35388, CVE-2026-35414, CVE-2026-55653, CVE-2026-55654,
CVE-2026-55655, CVE-2026-59995, CVE-2026-59996, CVE-2026-59997 (and 8 more).
(Verify their relevance and describe the handling history. Sourcing: the
Ubuntu CVE tracker plus the cross-vendor cvelistV5/NVD corpus, which also
covers Debian-relevant CVE identifiers - no separate Debian or NVD check is
needed. The OSS-security mailing list (pre-CVE-assignment chatter) is not
covered by these adapters; flag it yourself if you are aware of such a
discussion.)
- Installed privileged/service surface: setuid/setgid:
openssh-client_10.5p1-1ubuntu2_amd64/usr/lib/openssh/ssh-keysign; sbin
executables: openssh-server_10.5p1-1ubuntu2_amd64/usr/sbin/sshd; systemd units:
openssh-server_10.5p1-1ubuntu2_amd64/usr/lib/systemd/system/[email protected],
openssh-server_10.5p1-1ubuntu2_amd64/usr/lib/systemd/system/sshd-keygen.service,
openssh-server_10.5p1-1ubuntu2_amd64/usr/lib/systemd/system/ssh.socket,
openssh-server_10.5p1-1ubuntu2_amd64/usr/lib/systemd/system/ssh.service,
openssh-server_10.5p1-1ubuntu2_amd64/usr/lib/systemd/system/rescue-ssh.target.
OpenSSH is used to access remote systems, and therefore quite exposed.
It's part of its job to allow remote logins, even from privileged users.
It's expected it will atract a lot of attention, scrutiny, security
research, and interest. Security vulnerabilities are found, and
addressed in a coordinated and timely manner. This is the security
history from the project's own records:
https://www.openssh.org/security.html
[Quality assurance - function/usage]
- The package works well right after install. Host keys are generated, the
service is listening and ready to accept connections.
AI:
(The packaging-source.debconf_templates list is empty, indicating no
interactive configuration is required during installation. The
binary-package-inspection.systemd_units list includes ssh.socket and
ssh.service, which are standard units that allow the service to start and
listen for connections immediately upon installation using sane defaults.)
[Quality assurance - maintenance]
- The package does not depend on exotic hardware we cannot support.
- The package has 632 open Debian bugs and 165 open Launchpad bugs. Upstream
is very committed to maintaining the project, and both Ubuntu and Debian react
quickly to high severity issues, and security updates are prompt.
Upstream has recently
(https://www.openssh.org/releasenotes.html#:~:text=these%20bugs%20too.-,Given,-this%2C%20the%20OpenSSH)
committed to even more frequent releases to increase the rate of bug
fixes landing in the hands of users.
AI:
(The evidence provides explicit counts for Debian and Launchpad bugs,
specific dates and severities for High importance bugs, and detailed metrics
for release cadence, allowing for a precise summary of the maintenance history.)
Left to clarify:
- Important open bugs found:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1291696,
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1485487,
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2130448.
(Explain their maintenance impact.)
Let's see:
- LP: #1291696: filed in 2014, last comment from November of the same year.
Triaged as "high" by someone.
- LP: #1485487: filed in 2015, postinst issue, no comments whatsoever,
triaged as "high" by someone.
- LP: #2130448: filed in 2025, being triaged, also has a spinoff bug in LP:
#2157917. Seems to be lacking reproduceabiility.
[Quality assurance - testing]
- Build and Autopkgtest can cover all regular tests this package needs.
- the autopkgtest coverage could be better, as it only deals with password
authentication. The more complex gssapi authentication tests were moved to the
src:openssh-gssapi package. There is always room for improvement, like using
ssh for remote execution of commands, other types of PAM integration testing
(expired accounts, locked accounts).
- The package includes non-trivial build tests. Failures are not ignored.
AI:
(The `debian/rules` file overrides `dh_auto_test-arch` to execute `unit`
and `compat-tests` targets via make, along with a `keygen-test`. The
`debian/tests/control` file defines several non-trivial autopkgtests, including
`regress`, `socket-activation`, `xinetd`, `password-auth-no-pam`,
`systemd-socket-activation`, and `sshd-socket-generator`. These tests require
root privileges and complex dependencies such as `dropbear`, `putty-tools`, and
`systemd` to verify interoperability and integration.)
- Autopkgtests are present and pass on: amd64, amd64v3, arm64, armhf, i386,
ppc64el, s390x, riscv64
[Quality assurance - packaging]
- A debian/watch upstream-release mechanism is present.
- debian/control defines a correct Maintainer field
- Lintian reported 0 error(s) and 0 warning(s).
- No Python 2, GTK 2, or other catalogued obsolete runtime dependency was
found.
- Source format: 3.0 (quilt); debconf templates: 0; debian/rules overrides:
dh_auto_build-arch, dh_auto_build-indep, dh_auto_clean, dh_auto_configure-arch,
dh_auto_configure-indep, dh_auto_install-arch, dh_auto_install-indep,
dh_auto_test-arch, dh_auto_test-indep, dh_autoreconf-indep, dh_gencontrol,
dh_install-arch, dh_installdocs, dh_installinit, dh_installpam,
dh_installsystemd, dh_missing, dh_runit.
- The following lintian override(s) lack an explanatory comment:
elevated-privileges, superfluous-file-pattern,
systemd-service-file-refers-to-unusual-wantedby-target.
(See the following item for the reporter's explanation.)
- The packaging contains uncommented lintian overrides for
'elevated-privileges', 'superfluous-file-pattern', and
'systemd-service-file-refers-to-unusual-wantedby-target' tags that require
reporter justification.
In debian/openssh-client.lintian-overrides:
openssh-client: elevated-privileges 4755 root/root
[usr/lib/openssh/ssh-keysign]
This is used for Host-based authentication. The helper is called internally
by the ssh client (it's not meant to be called by end-users directly) and needs
to be suid root because it needs to be able to read the host private keys,
which are mode 0600 root:root. This feature is disabled by default and needs a
configuration change to be enabled.
In debian/openssh-server.lintian-overrides:
openssh-server: systemd-service-file-refers-to-unusual-wantedby-target
ssh.service [usr/lib/systemd/system/sshd-keygen.service]
openssh-server: systemd-service-file-refers-to-unusual-wantedby-target
ssh.socket [usr/lib/systemd/system/sshd-keygen.service]
openssh-server: systemd-service-file-refers-to-unusual-wantedby-target
sshd.service [usr/lib/systemd/system/sshd-keygen.service]
openssh-server: systemd-service-file-refers-to-unusual-wantedby-target
[email protected] [usr/lib/systemd/system/sshd-keygen.service]
That file has a comment, and it reads: # Deliberate special cases for
a helper service.
In debian/source/lintian-overrides:
openssh source: untranslatable-debconf-templates
[debian/openssh-server.templates:20]
That file has a comment and it is: # openssh-server/password-authentication
is preseeding-only, at least for now.
The same file has a comment for the entries below. It's:
# These entries in debian/copyright are helpful when running lrc in a git
# checkout or an unpacked source package, but lintian doesn't apply patches
# so it thinks they're superfluous.
openssh source: superfluous-file-pattern kexgss*.c [debian/copyright:*]
openssh source: superfluous-file-pattern ssh-null.c [debian/copyright:*]
(The evidence in 'packaging-source.lintian_override_entries' shows three
override entries without comments: 'elevated-privileges',
'superfluous-file-pattern', and
'systemd-service-file-refers-to-unusual-wantedby-target'. Per policy, I cannot
invent justifications for these uncommented overrides; only the reporter can
explain why they are needed.)
- Packaging is complex, and I agree debian/rules is complex. Not sure what
can be done about it today.
AI:
Reasoning: The debian/rules is well over 100 non-comment lines with 18+
overrides containing substantial hand-rolled logic. Key complexity factors: (1)
dual build directories (debian/build-deb and debian/build-udeb) with separate
configure/build/install steps; (2) fragile post-configure manipulation using
perl -pi to edit config.status and config.h (removing USE_BTMP, avoiding libnsl
linkage); (3) sed editing of installed conffiles to strip $OpenBSD tags; (4)
PAM template generation from .pam.in via conditional sed; (5) extensive
conditional logic for cross-compilation, Ubuntu vs Debian vendor, udeb build
profiles, and gnome askpass; (6) manual MAKE invocations for regress binaries
and gnome-ssh-askpass3. Hardening is enabled (+all) and tests are not disabled,
but the overall rules file is a genuine maintenance hazard due to its length
and fragile file manipulations.
[UI standards]
- This package is not end-user facing (server, CLI-only tool, daemon, or
library), so desktop-file and translation requirements do not apply.
(OpenSSH is fundamentally a server daemon (sshd with systemd units) and CLI
tool suite (ssh, scp, sftp, ssh-keygen, ssh-agent). The binary sections are
'net', 'gnome', and 'debian-installer' — 'net' is typical for networking/CLI
tools, not desktop apps. The main runtime dependencies lack GUI toolkits; only
the ssh-askpass-gnome subpackage depends on GTK, and it is a small helper
dialog invoked automatically for passphrase prompts, not a standalone desktop
application an end user launches. The presence of sbin executables (sshd) and
systemd service units confirms the daemon/server nature. CLI tools are not
'end-user facing graphical desktop programs' in the sense this check targets.)
- Not an end-user application (server, CLI-only tool, or library) - no
Desktop file is needed.
- Application is not end-user facing (does not need translation).
[Dependencies]
These binary packages are to be in main:
- openssh-common:
- Depends: libc6 (>= 2.38), libfido2-1 (>= 1.8.0), libselinux1 (>= 3.1~),
libssl4 (>= 4.0.0)
- openssh-server:
- Depends: libpam-modules, libpam-runtime, openssh-common (=
1:10.5p1-1ubuntu2), openssh-sftp-server, procps, ucf, debconf (>= 0.5) |
debconf-2.0, systemd | systemd-standalone-sysusers | systemd-sysusers, systemd
| systemd-standalone-tmpfiles | systemd-tmpfiles, libaudit1 (>= 1:2.2.1), libc6
(>= 2.42), libcrypt1 (>= 1:4.1.0), libpam0g (>= 0.99.7.1), libselinux1 (>=
3.1~), libssl4 (>= 4.0.0), libwrap0 (>= 7.6-4~), zlib1g (>= 1:1.1.4)
- Recommends: default-logind | logind | libpam-systemd, ncurses-term,
passwd, xauth, ssh-import-id
- openssh-sftp-server:
- Depends: openssh-common (= 1:10.5p1-1ubuntu2), libc6 (>= 2.38)
- Recommends: openssh-server | ssh-server
- ssh:
- Depends: openssh-client (>= 1:10.5p1-1ubuntu2), openssh-server (>=
1:10.5p1-1ubuntu2), openssh-common (= 1:10.5p1-1ubuntu2)
Build-depends:
debhelper (>= 13.1~),
debhelper-compat (= 13),
dh-exec,
dh-runit (>= 2.8.8),
dh-sequence-installsysusers,
libaudit-dev [linux-any],
libcrypt-dev,
libedit-dev,
libfido2-dev (>= 1.5.0) [linux-any],
libgtk-3-dev <!pkg.openssh.nognome>,
libpam0g-dev | libpam-dev,
libselinux-dev [linux-any],
libssl-dev (>= 1.1.1),
libwrap0-dev | libwrap-dev,
pkgconf,
zlib1g-dev,
systemd-dev,
Everything in main, or not needed at runtime.
[Standards compliance]
- This package correctly follows FHS and Debian Policy.
- No license expiry, time-bound terms, entity/contract coupling, withdrawable
branches, patents, or other encumbrances were identified; the license is
expected to remain compatible with Ubuntu main throughout the full support
lifetime.
[Maintenance/Owner]
- The owning team already subscribed to this package is confirmed and has
explicitly acknowledged the long-term maintenance commitment.
- Package bug subscriber team(s): ubuntu-security, ubuntu-server.
- No shipped vendored directories were detected.
- Launchpad records contain 8 build(s) from the last three months. Builds:
https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585850,
https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585851,
https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585852,
https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585853,
https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585854,
https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585855,
https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585856,
https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585857.
- This change is not expected to impact other Ubuntu teams.
- Built binaries declare no Built-Using or Static-Built-Using entries.
[Background information]
- The upstream project is OpenSSH, which is the same as the source package
name.
(The upstream-tracker lists the upstream name as 'OpenSSH', and the
debian_control Source field is 'openssh', confirming the source package name
matches the upstream project name.)
- Upstream project: https://www.openssh.com/portable.html
- The package description explains the package well.
+
+ ##############################
+ src:openssh-gssapi MIR section
+ ##############################
+
+ This is a MIR request for src:openssh-gssapi. It's a split from
+ src:openssh, which is already in main, triggered by debian
+ (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141274). The main
+ reasoning is to reduce the security exposure of src:openssh by removing
+ the kerberos/gssapi build-time feature from src:openssh and moving it to
+ src:openssh-gssapi. It's basically a different set of build options of
+ the same source.
+
+ The one thing Ubuntu is adding on top is the ccache patch
+ (https://bugs.launchpad.net/ubuntu/+source/openssh-gssapi/+bug/1889548),
+ from Fedora.
+
+ That patch has been requested for ubuntu since 2020, and has been
+ provided in a Server Team maintained PPA
+ (https://launchpad.net/~canonical-server/+archive/ubuntu/openssh-server-
+ default-ccache) for jammy, noble, and more recently resolute. The PPA
+ work is detailed in a Canonical-internal SPEC
+ (https://docs.google.com/document/d/1UJDtDNCbDxfaq10inp5nVlisbMh-
+ zwxzpPR0Hp_UrnI/edit). The security team was made aware
+
(https://docs.google.com/document/d/1-qadf8qTJyOF5CKVR5iFFYlKF5-XLB_qShDw5Ykp5pw/edit?tab=t.0)
+ (Canonical-only internal link) of this PPA back then and agreed to help
+ support it if needed, but that was never necessary as the patch always
+ applied cleanly and introduced no regressions in all these years. Still,
+ it's of course feasible that a security vulnerability could only affect
+ src:openssh-gssapi due to this patch.
+
+ The other consequence of this new source package is that a non-
+ kerberos/gssapi vulnerability on openssh will likely need to be fixed in
+ both source packages. Likewise for regular bugs.
+
+ Differently from the PPA, the approach here is a plain patch-and-build
+ one. The PPA for jammy, noble, resolute, still uses the alternatives
+ mechanism and two builds from the same source.
+
+ The package includes a new autopkgtest
+ (https://git.launchpad.net/ubuntu/+source/openssh-
+ gssapi/tree/debian/tests/ssh-gssapi-default-ccache) which covers the
+ patch behavior, and runs the normal upstream regression test at both
+ build-time and as an autopkgtest. And still has the normal openssh
+ autopkgtests, like socket-activation, xinetd, and general
+ gssapi/kerberos login.
+
+ The canonical-server team will subscribe to this package.
+
+ Since this is based on the src:openssh MIR, the same security and
+ maintenance history applies. I will detail the differences where
+ applicable in the sections below.
+
+ [Availability]
+ - Builds for ONE LESS architecture than src:openssh: i386. Conscious
decision, can be reverted.
+ - Source package: https://launchpad.net/ubuntu/+source/openssh-gssapi
+ - The source package is published in Ubuntu (universe).
+
+ [Rationale]
+ OpenSSH with Kerberos/GSSAPI support is a very much desired feature for many
users, specially those in enterprise environments based on Windows Active
Directory, where Kerberos/GSSAPI is the authentication protocol. Since
src:openssh-gssapi is just a rebuild of src:openssh with the Kerberos/GSSAPI
build option enabled, and src:openssh is in main in Resolute, users who upgrade
from Resolute will expect the same level of support for this package. The
ubuntu-release-upgrader package has been updated in stonking
(https://launchpad.net/ubuntu/+source/ubuntu-release-upgrader/1:26.10.10) to
handle this migration path.
+
+ [Security]
+ The security aspect and handling of src:openssh-gssapi is the same as it is
for src:openssh in Resolute and before, with one change: the ccache patch. As
explained in more detail in the introduction of this MIR, this patch is not
incorporated by upstream, but has been requested by Ubuntu users, and the
Canonical Ubuntu Server team has been providing it in a PPA since Jammy. Fedora
developers authored this patch, and it's part of Fedora for many years, and
that's where we take it from.
+
+ The security exposure of src:openssh-gssapi is HIGHER than src:openssh,
+ because it has the Kerberos/GSSAPI feature enabled. This is a known
+ fact, and the reason for the split. It of course means that bugs
+ affecting openssh could affect only src:openssh, or only src:openssh-
+ gssapi, or both. There is a certain amount of duplicated work involved
+ in maintaining two source packages.
+
+ [Quality assurance - function/usage]
+ - The package works well right after install. Host keys are generated, the
service is listening and ready to accept connections.
+ - Upgrades from src:openssh in resolute with ubuntu-release-upgrader will
detect if Kerberos/GSSAPI is in use or not, and install the
bin:openssh-{server,client}-gssapi packages if needed.
+ - Ubuntu release notes were updated to mention these changes
(https://github.com/ubuntu/ubuntu-release-notes/pull/257).
+
+ [Quality assurance - maintenance]
+ The src:openssh-gssapi package will share many bugs with src:openssh. Only
bugs specific to Kerberos/GSSAPI will be specific to src:openssh-gssapi. Bugs
involving transitioning from one package to the other (like
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148624) might need fixes on
both sides.
+
+ [Quality assurance - testing]
+ The src:openssh-gssapi package has the same autopkgtests as src:openssh, plus
tests specific to Kerberos/GSSAPI
(https://git.launchpad.net/ubuntu/+source/openssh-gssapi/tree/debian/tests/ssh-gssapi)
and the ccache patch
(https://git.launchpad.net/ubuntu/+source/openssh-gssapi/tree/debian/tests/ssh-gssapi-default-ccache).
These tests run on all architectures except i386, for which we chose to not
build src:openssh-gssapi.
+ The build-time tests are the same as in src:openssh, plus tests enabled by
the Kerberos/GSSAPI build option in this package.
+ No test coverage is lost compared to src:openssh in Resolute and earlier, and
one extra test is gained (for the ccache patch).
+
+ [Quality assurance - packaging]
+ The src:openssh-gssapi packaging is a bit simpler than src:openssh, because
it shares bin:openssh-common, and doesn't have to ship all the other binary
packages. In fact, it ships only the client and server binary packages. That
made debian/rules a little bit simpler.
+
+ Some lintian overrides are shared, and new ones added. All have
+ explanations.
+
+ These are new in src:openssh-gssapi:
+ # These two source packages need to be maintained in sync.
+ openssh-gssapi source: version-substvar-for-external-package Depends
${source:Upstream-Version} openssh-client-gssapi -> openssh-common
[debian/control:*]
+ openssh-gssapi source: version-substvar-for-external-package Depends
${source:Upstream-Version} openssh-server-gssapi -> openssh-common
[debian/control:*]
+
+ [UI standards]
+ No change.
+
+ [Dependencies]
+ These are the binary packages produced by src:openssh-gssapi, and their
dependencies:
+
+ - openssh-client-gssapi:
+ Depends: openssh-common (<< 1:10.5p1.1), openssh-common (>= 1:10.5p1),
systemd | systemd-standalone-sysusers | systemd-sysusers, systemd |
systemd-standalone-tmpfiles | systemd-tmpfiles, libc6 (>= 2.42), libedit2 (>=
2.11-20080614-0), libgssapi-krb5-2 (>= 1.17), libselinux1 (>= 3.1~), libssl4
(>= 4.0.0), zlib1g (>= 1:1.1.4)
+
+ - openssh-server-gssapi:
+ Depends: libpam-modules, libpam-runtime, openssh-common (<< 1:10.5p1.1),
openssh-common (>= 1:10.5p1), openssh-sftp-server, procps, ucf, debconf (>=
0.5) | debconf-2.0, systemd | systemd-standalone-sysusers | systemd-sysusers,
systemd | systemd-standalone-tmpfiles | systemd-tmpfiles, libaudit1 (>=
1:2.2.1), libc6 (>= 2.42), libcom-err2 (>= 1.43.9), libcrypt1 (>= 1:4.1.0),
libgssapi-krb5-2 (>= 1.17), libkrb5-3 (>= 1.13~alpha1+dfsg), libpam0g (>=
0.99.7.1), libselinux1 (>= 3.1~), libssl4 (>= 4.0.0), libwrap0 (>= 7.6-4~),
zlib1g (>= 1:1.1.4)
+
+ Compared to src:openssh's binaries, we see that libgssapi-krb5-2,
libcomm-err2, and libkrb5-3 are new, as expected, and both are in main:
+ $ diff -u <(apt show openssh-server|grep Depends) <(apt show
openssh-server-gssapi | grep Depends)|wdiff -d
+ Depends: libpam-modules, libpam-runtime, openssh-common [-(=
1:10.5p1-1ubuntu2),-] {+(<< 1:10.5p1.1), openssh-common (>= 1:10.5p1),+}
openssh-sftp-server, procps, ucf, debconf (>= 0.5) | debconf-2.0, systemd |
systemd-standalone-sysusers | systemd-sysusers, systemd |
systemd-standalone-tmpfiles | systemd-tmpfiles, libaudit1 (>= 1:2.2.1), libc6
(>= 2.42), {+libcom-err2 (>= 1.43.9),+} libcrypt1 (>= 1:4.1.0),
{+libgssapi-krb5-2 (>= 1.17), libkrb5-3 (>= 1.13~alpha1+dfsg),+} libpam0g (>=
0.99.7.1), libselinux1 (>= 3.1~), libssl4 (>= 4.0.0), libwrap0 (>= 7.6-4~),
zlib1g (>= 1:1.1.4)
+
+ $ diff -u <(apt show openssh-client|grep Depends) <(apt show
openssh-client-gssapi | grep Depends)|wdiff -d
+ [--- /dev/fd/63-]{+++ /dev/fd/62+} 2026-09-24 [-18:42:32.913113641-]
{+18:42:32.914113630+} +0000
+ @@ -1 +1 @@
+ Depends: openssh-common [-(= 1:10.5p1-1ubuntu2),-] {+(<< 1:10.5p1.1),
openssh-common (>= 1:10.5p1),+} systemd | systemd-standalone-sysusers |
systemd-sysusers, systemd | systemd-standalone-tmpfiles | systemd-tmpfiles,
libc6 (>= 2.42), libedit2 (>= 2.11-20080614-0), {+libgssapi-krb5-2 (>= 1.17),+}
libselinux1 (>= 3.1~), libssl4 (>= 4.0.0), zlib1g (>= 1:1.1.4)
+
+ There is no difference in Recommends.
+
+ The difference in build-depends is for the kerberos/gssapi dependency:
+ @@ -14,6 +14,7 @@
+ libedit-dev,
+ libfido2-dev (>= 1.5.0) [linux-any],
+ libgtk-3-dev <!pkg.openssh.nognome>,
+ + libkrb5-dev | heimdal-dev,
+ libpam0g-dev | libpam-dev,
+ libselinux-dev [linux-any],
+ libssl-dev (>= 1.1.1),
+
+
+ [Standards compliance]
+ No change from src:openssh.
+
+
+ [Maintenance/Owner]
+ The change from src:openssh is that only the canonical server team will be/is
subscribed.
+
+ [Background information]
+ The upstream project is the same as src:openssh, and it's the same orig
tarball.
+ The package description was updated to convey the information that this build
has Kerberos/GSSAPI enabled.
+
+
+
[ Original Description ]
This is a MIR request for src:openssh-gssapi. It's a split from
src:openssh, which is already in main, triggered by debian[1]. The main
reasoning is to reduce the security exposure of src:openssh by removing
the kerberos/gssapi feature in src:openssh and moving it to src:openssh-
gssapi. It's basically a different set of build options of the same
source.
I'm invoking the Renamed or reorganized sources[6] part of the MIR
process.
The one thing Ubuntu is adding on top is the ccache patch[2], from
Fedora.
That patch has been requested for ubuntu since 2020[2], and has been
provided in a Server Team maintained PPA[3] for jammy, noble, and more
recently resolute. The PPA work is detailed in a Canonical-internal
SPEC[4]. The security team was made aware[7] (Canonical-only internal
link) of this PPA back then and agreed to help support it if needed, but
that was never necessary as the patch always applied cleanly and
introduced no regressions in all these years. Still, it's of course
feasible that a security vulnerability could only affect src:openssh-
gssapi due to this patch.
The other consequence of this new source package is that a non-
kerberos/gssapi vulnerability on openssh will likely need to be fixed in
both source packages. Likewise for regular bugs.
Differently from the PPA, the approach here is a plain patch-and-build
one. The PPA for jammy, noble, resolute, still uses the alternatives
mechanism and two builds from the same source.
The package includes a new autopkgtest[5] which covers the patch
behavior, and runs the normal upstream regression test at both build-
time and as an autopkgtest. And still has the normal openssh
autopkgtests, like socket-activation, xinetd, and general
gssapi/kerberos login.
The canonical-server team will subscribe to this package.
1. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141274
2. https://bugs.launchpad.net/ubuntu/+source/openssh-gssapi/+bug/1889548
3.
https://launchpad.net/~canonical-server/+archive/ubuntu/openssh-server-default-ccache
4.
https://docs.google.com/document/d/1UJDtDNCbDxfaq10inp5nVlisbMh-zwxzpPR0Hp_UrnI/edit
5.
https://git.launchpad.net/ubuntu/+source/openssh-gssapi/tree/debian/tests/ssh-gssapi-default-ccache
6.
https://ubuntu.com/project/docs/MIR/mir-rereview/#renamed-or-reorganized-sources
7.
https://docs.google.com/document/d/1-qadf8qTJyOF5CKVR5iFFYlKF5-XLB_qShDw5Ykp5pw/edit?tab=t.0
** Changed in: openssh-gssapi (Ubuntu)
Status: In Progress => New
** Changed in: openssh (Ubuntu)
Assignee: Andreas Hasenack (ahasenack) => (unassigned)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167624
Title:
MIR (source fork): openssh-gssapi + ccache patch (the new thing)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2167624/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
