Package: openssh-server
Version: 1:7.4p1-10+deb9u2
Severity: normal
Dear Maintainer,
DO NOT TRY TO REPRO THIS BUG ON A MACHINE UNLESS YOU HAVE PHYSICAL ACCESS
TO LOCAL CONSOLE
echo "Match Address 10.0.0.8/8
PasswordAuthentication yes
" >>/etc/ssh/sshd_config
or
echo "Match Address fdfd::1/64
PasswordAuthentication yes
" >>/etc/ssh/sshd_config
/etc/init.d/ssh restart
... it will restart service without any error
you can even do
sshd -t
which will confirm that everything is fine
but, try to initiate a new cession, you will get "Connection closed"
I have been explained why such lines are invalid. I am not arguing about
the fact those lines are invalid. I am complaining about the fact very
small typo can render a server completely unreachable, while service
restart and internal test both say the conf is fine.
Ideally, I would expect sshd to accept such arguments, and not care about
extra bits in the provided address.
At the very least, restart, and -t should both complain about invalid conf.
Change the line for 10.0.0.0/8 or fdfd::/64 ... restart daemon, you can
connect.
I have not tried, but, I expect similar bug may occur with many other
invalid arguments: 192.168.2.1.3 or 192.168.2 or fdfd::1::/64 ...
DO NOT TRY TO REPRO THIS BUG ON A MACHINE UNLESS YOU HAVE PHYSICAL ACCESS
TO LOCAL CONSOLE
-- System Information:
Debian Release: 9.0
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 4.9.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages openssh-server depends on:
ii adduser 3.115
ii debconf [debconf-2.0] 1.5.60
ii dpkg 1.18.23
ii init-system-helpers 1.47
ii libaudit1 1:2.6.7-1
ii libc6 2.24-9
ii libcomerr2 1.43.4-2
ii libgssapi-krb5-2 1.15-1
ii libkrb5-3 1.15-1
ii libpam-modules 1.1.8-3.5
ii libpam-runtime 1.1.8-3.5
ii libpam0g 1.1.8-3.5
ii libselinux1 2.6-3
ii libssl1.0.2 1.0.2k-1
ii libsystemd0 232-19
ii libwrap0 7.6.q-26
ii lsb-base 9.20161125
ii openssh-client 1:7.4p1-10+deb9u2
ii openssh-sftp-server 1:7.4p1-10+deb9u2
ii procps 2:3.3.12-3
ii ucf 3.0036
ii zlib1g 1:1.2.8.dfsg-5
Versions of packages openssh-server recommends:
ii libpam-systemd 232-19
ii ncurses-term 6.0+20161126-1
ii xauth 1:1.0.9-1+b2
Versions of packages openssh-server suggests:
pn molly-guard <none>
pn monkeysphere <none>
pn rssh <none>
pn ssh-askpass <none>
pn ufw <none>
-- debconf information excluded
--
>o_/ DEMAINE Benoît-Pierre (aka DoubleHP) http://benoit.demaine.info/
If computing were an exact science, IT engineers would'nt have work \_o<
"So all that's left, Is the proof that love's not only blind but deaf."
(FAKE TALES OF SAN FRANCISCO, Arctic Monkeys)
