rpms / openssh

Clone
Source Code
GIT

#37 Draft: Restore upstream default host key permissions (rhbz#2141272)
Closed a year ago by dbelyavs. Opened a year ago by dbelyavs.
sshkeysign_fix  into  rawhide

file removed
-31 
@@ -1,31 +0,0 @@ 
 

- diff -up openssh-8.2p1/authfile.c.keyperm openssh-8.2p1/authfile.c
 

- --- openssh-8.2p1/authfile.c.keyperm	2020-02-14 01:40:54.000000000 +0100
 

- +++ openssh-8.2p1/authfile.c	2020-02-17 11:55:12.841729758 +0100
 

- @@ -31,6 +31,7 @@
 

-  

-  #include <errno.h>
 

-  #include <fcntl.h>
 

- +#include <grp.h>
 

-  #include <stdio.h>
 

-  #include <stdarg.h>
 

-  #include <stdlib.h>
 

- @@ -101,7 +102,19 @@ sshkey_perm_ok(int fd, const char *filen
 

-  #ifdef HAVE_CYGWIN
 

-  	if (check_ntsec(filename))
 

-  #endif
 

- +
 

-  	if ((st.st_uid == getuid()) && (st.st_mode & 077) != 0) {
 

- +		if (st.st_mode & 040) {
 

- +			struct group *gr;
 

- +
 

- +			if ((gr = getgrnam("ssh_keys")) && (st.st_gid == gr->gr_gid)) {
 

- +				/* The only additional bit is read
 

- +				 * for ssh_keys group, which is fine */
 

- +				if ((st.st_mode & 077) == 040 ) {
 

- +					return 0;
 

- +				}
 

- +			}
 

- +		}
 

-  		error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
 

-  		error("@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @");
 

-  		error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");

file removed
-2 
@@ -1,2 +0,0 @@ 
 

- #Type Name     ID
 

- g     ssh_keys 101

file modified
+10 -11 
@@ -47,7 +47,7 @@ 
 

  

  # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
 

  %global openssh_ver 9.0p1
 

- %global openssh_rel 8
 

+ %global openssh_rel 9
 

  %global pam_ssh_agent_ver 0.10.4
 

  %global pam_ssh_agent_rel 7
 

  
@@ -73,7 +73,6 @@ 
 

  Source15: sshd-keygen.target
 

  Source16: ssh-agent.service
 

  Source17: ssh-agent.socket
 

- Source18: openssh-systemd-sysusers.conf
 

  Source19: openssh-server-systemd-sysusers.conf
 

  

  #https://bugzilla.mindrot.org/show_bug.cgi?id=2581
 
@@ -115,8 +114,6 @@ 
 

  

  #https://bugzilla.mindrot.org/show_bug.cgi?id=1644
 

  Patch601: openssh-6.6p1-allow-ip-opts.patch
 

- #https://bugzilla.mindrot.org/show_bug.cgi?id=1893 (WONTFIX)
 

- Patch604: openssh-6.6p1-keyperm.patch
 

  #(drop?) https://bugzilla.mindrot.org/show_bug.cgi?id=1925
 

  Patch606: openssh-5.9p1-ipv6man.patch
 

  #?
 
@@ -380,7 +377,6 @@ 
 

  %patch502 -p1 -b .keycat
 

  

  %patch601 -p1 -b .ip-opts
 

- %patch604 -p1 -b .keyperm
 

  %patch606 -p1 -b .ipv6man
 

  %patch607 -p1 -b .sigpipe
 

  %patch609 -p1 -b .x11
 
@@ -585,7 +581,6 @@ 
 

  install -m755 contrib/ssh-copy-id $RPM_BUILD_ROOT%{_bindir}/
 

  install contrib/ssh-copy-id.1 $RPM_BUILD_ROOT%{_mandir}/man1/
 

  install -d -m711 ${RPM_BUILD_ROOT}/%{_datadir}/empty.sshd
 

- install -p -D -m 0644 %{SOURCE18} %{buildroot}%{_sysusersdir}/openssh.conf
 

  install -p -D -m 0644 %{SOURCE19} %{buildroot}%{_sysusersdir}/openssh-server.conf
 

  

  %if ! %{no_gnome_askpass}
 
@@ -611,11 +606,13 @@ 
 

  popd
 

  %endif
 

  

- %pre
 

- %sysusers_create_compat %{SOURCE18}
 

- 

  %pre server
 

  %sysusers_create_compat %{SOURCE19}
 

+ # Migration scriptlet for Fedora 38/39
 

+ # We want to remove group ownership for standard host keys if they exist
 

+ test -f /etc/ssh/ssh_host_rsa_key     && /usr/bin/chmod g-r /etc/ssh/ssh_host_rsa_key     || :
 

+ test -f /etc/ssh/ssh_host_ecdsa_key   && /usr/bin/chmod g-r /etc/ssh/ssh_host_ecdsa_key   || :
 

+ test -f /etc/ssh/ssh_host_ed25519_key && /usr/bin/chmod g-r /etc/ssh/ssh_host_ed25519_key || :
 

  

  %post server
 

  %systemd_post sshd.service sshd.socket
 
@@ -653,9 +650,8 @@ 
 

  %attr(0755,root,root) %{_bindir}/ssh-keygen
 

  %attr(0644,root,root) %{_mandir}/man1/ssh-keygen.1*
 

  %attr(0755,root,root) %dir %{_libexecdir}/openssh
 

- %attr(2555,root,ssh_keys) %{_libexecdir}/openssh/ssh-keysign
 

+ %attr(4555,root,root) %{_libexecdir}/openssh/ssh-keysign
 

  %attr(0644,root,root) %{_mandir}/man8/ssh-keysign.8*
 

- %attr(0644,root,root) %{_sysusersdir}/openssh.conf
 

  

  %files clients
 

  %attr(0755,root,root) %{_bindir}/ssh
 
@@ -724,6 +720,9 @@ 
 

  %endif
 

  

  %changelog
 

+ * Fri Dec 02 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.0p1-9
 

+ - Restore upstream behaviour and default host key permissions (rhbz#2141272)
 

+ 

  * Mon Oct 24 2022 Norbert Pocs <npocs@redhat.com> - 9.0p1-8
 

  - Add additional audit logging about ssh key used to login (rhbz#2049947)

file modified
+1 -2 
@@ -30,8 +30,7 @@ 
 

  fi
 

  

  # sanitize permissions
 

- /usr/bin/chgrp ssh_keys $KEY
 

- /usr/bin/chmod 640 $KEY
 

+ /usr/bin/chmod 600 $KEY
 

  /usr/bin/chmod 644 $KEY.pub
 

  if [[ -x /usr/sbin/restorecon ]]; then
 

  	/usr/sbin/restorecon $KEY{,.pub}

Restore upstream default host key permissions (0600 instead of 0640) and suid bit instead of sgid one for ssh-keysign

1 new commit added

  • Fix scriplet
a year ago

Build succeeded.

1 new commit added

  • Fix the scriptlet
a year ago

Build succeeded.

1 new commit added

  • Get rid of ssh_keys group for new installations
a year ago

2 new commits added

  • Domt use ssh_keys group
  • We dont install openssh.conf file
a year ago

Build succeeded.

One more thing to do after this will land in Fedora is to update ansible sshd role. We are now enforcing the hostkeys permissions to be like this in here:

https://github.com/willshersystems/ansible-sshd/blob/master/vars/Fedora.yml#L23

It should be enough to open an issue or talk to me to get the changes done, but I wanted to dump the thought somewhere before I will forget.

Rebased and pushed to rawhide, closing the MR. Thanks!

This change (https://src.fedoraproject.org/rpms/openssh/c/b615362fd0b4da657d624571441cb74983de6e3f?branch=rawhide) is breaking rpm-ostree based systems.

Instead of a %pre script, this should be a systemd service unit running before the openssh server startup.
Edited a year ago by siosm

@siosm would you mind to suggest a patch?

This one can be closed now

Closing, thanks

Pull-Request has been closed by dbelyavs
a year ago
Metadata
None
No Tags
Changes Summary 4
-31
file removed
openssh-6.6p1-keyperm.patch
-2
file removed
openssh-systemd-sysusers.conf
+10 -11
file changed
openssh.spec
+1 -2
file changed
sshd-keygen
Powered by Pagure 5.13.3
Documentation • File an Issue • About this Instance • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.