Bug#954965: /etc/ssh/ssh_config: ssh_config: Include custom config files at the end, so they can overwrite the default settings
Package: openssh-server Version: 1:8.2p1-4 Followup-For: Bug #954965 Just wanted to chime in to say that 1. I can confirm that the config works as intended, 2. The debug output is really quite confusing in this regard: ``` debug3: /etc/ssh/sshd_config.d/no-xforwarding.conf:1 setting X11Forwarding no […] debug3: /etc/ssh/sshd_config:91 setting X11Forwarding yes ``` This clearly suggests that X11Forwarding is being turned on again. -- System Information: Debian Release: bullseye/sid APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 5.5.0-rc5-amd64 (SMP w/8 CPU cores) Locale: LANG=en_NZ, LC_CTYPE=en_NZ.UTF-8 (charmap=UTF-8), LANGUAGE=en_NZ:en (charmap=UTF-8) Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages openssh-server depends on: ii adduser3.118 ii debconf [debconf-2.0] 1.5.73 ii dpkg 1.19.7 ii libaudit1 1:2.8.5-3+b1 ii libc6 2.30-4 ii libcom-err21.45.6-1 ii libcrypt1 1:4.4.16-1 ii libgssapi-krb5-2 1.17-7 ii libkrb5-3 1.17-7 ii libpam-modules 1.3.1-5 ii libpam-runtime 1.3.1-5 ii libpam0g 1.3.1-5 ii libselinux13.0-1+b3 ii libssl1.1 1.1.1f-1 ii libsystemd0245.4-4 ii libwrap0 7.6.q-30 ii lsb-base 11.1.0 ii openssh-client 1:8.2p1-4 ii openssh-sftp-server1:8.2p1-4 ii procps 2:3.3.16-4 ii runit-helper 2.8.15 ii ucf3.0038+nmu1 ii zlib1g 1:1.2.11.dfsg-2 Versions of packages openssh-server recommends: ii libpam-systemd [logind] 245.4-4 pn ncurses-term ii xauth1:1.0.10-1 Versions of packages openssh-server suggests: pn molly-guard pn monkeysphere ii ssh-askpass 1:1.2.4.1-10+b1 pn ufw -- debconf information excluded -- .''`. martin f. krafft @martinkrafft : :' : proud Debian developer `. `'` http://people.debian.org/~madduck `- Debian - when you have better things to do than fixing systems digital_signature_gpg.asc Description: Digital GPG signature (see http://martin-krafft.net/gpg/sig-policy/999bbcc4/current)
Bug#954965: /etc/ssh/ssh_config: ssh_config: Include custom config files at the end, so they can overwrite the default settings
Mar 25, 2020, 23:07 by cjwat...@debian.org: > On Wed, Mar 25, 2020 at 10:33:20PM +0100, Jan wrote: > >> /etc/ssh/ssh_config now includes /etc/ssh/ssh_config.d/*.conf but does so >> at the beginning. Thus custom config files cannot overwrite the default >> options, all of which are set afterwards. >> > But, as ssh_config(5) says, "the first obtained value for each parameter > is used". > I have to admit that I missed that. Even more embarrassing as it's also state in the beginning of /etc/ssh/ssh_config. It does not apply in my case though, see below. > I tested this and confirmed that it was possible to use files > in /etc/ssh/ssh_config.d/*.conf to override default options in > /etc/ssh/ssh_config. > > What tests did you perform? > I want to avoid sending any environment, but /etc/ssh/ssh_config has | SendEnv LANG LC_* So I originally put | Host * | SendEnv -LANG -LC_* into /etc/ssh/ssh_config.d/no_env.conf. It works when I included that file at the very end of /etc/ssh/ssh_config. Just setting SendEnv at the beginning (via included files) does not help because this option has append semantics and the prepended dash only remove entries that already exist. Regards, Jan
Bug#954965: /etc/ssh/ssh_config: ssh_config: Include custom config files at the end, so they can overwrite the default settings
On Wed, Mar 25, 2020 at 10:33:20PM +0100, Jan wrote: > /etc/ssh/ssh_config now includes /etc/ssh/ssh_config.d/*.conf but does so > at the beginning. Thus custom config files cannot overwrite the default > options, all of which are set afterwards. But, as ssh_config(5) says, "the first obtained value for each parameter is used". I tested this and confirmed that it was possible to use files in /etc/ssh/ssh_config.d/*.conf to override default options in /etc/ssh/ssh_config. What tests did you perform? -- Colin Watson [cjwat...@debian.org]
Bug#954965: /etc/ssh/ssh_config: ssh_config: Include custom config files at the end, so they can overwrite the default settings
Package: openssh-client Version: 1:8.2p1-4 Severity: normal File: /etc/ssh/ssh_config Dear Maintainer, /etc/ssh/ssh_config now includes /etc/ssh/ssh_config.d/*.conf but does so at the beginning. Thus custom config files cannot overwrite the default options, all of which are set afterwards. Moving the include to the end of /etc/ssh/ssh_config solves this problem. -- System Information: Debian Release: bullseye/sid APT prefers testing-proposed-updates APT policy: (500, 'testing-proposed-updates'), (500, 'testing') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 5.4.0-4-amd64 (SMP w/4 CPU cores) Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages openssh-client depends on: ii adduser 3.118 ii dpkg 1.19.7 ii libc6 2.30-2 ii libedit2 3.1-20191231-1 ii libfido2-11.3.1-1 ii libgssapi-krb5-2 1.17-6 ii libselinux1 3.0-1+b1 ii libssl1.1 1.1.1d-2 ii passwd1:4.8.1-1 ii zlib1g1:1.2.11.dfsg-2 Versions of packages openssh-client recommends: ii xauth 1:1.0.10-1 Versions of packages openssh-client suggests: pn keychain ii ksshaskpass [ssh-askpass] 4:5.17.5-2 pn libpam-ssh pn monkeysphere -- Configuration Files: /etc/ssh/ssh_config changed: Host * SendEnv LANG LC_* HashKnownHosts yes GSSAPIAuthentication yes Include /etc/ssh/ssh_config.d/*.conf -- no debconf information