Bug#954965: /etc/ssh/ssh_config: ssh_config: Include custom config files at the end, so they can overwrite the default settings

2020-04-16 Thread martin f krafft
Package: openssh-server
Version: 1:8.2p1-4
Followup-For: Bug #954965

Just wanted to chime in to say that

1. I can confirm that the config works as intended,

2. The debug output is really quite confusing in this regard:

   ```
   debug3: /etc/ssh/sshd_config.d/no-xforwarding.conf:1 setting X11Forwarding no
   […]
   debug3: /etc/ssh/sshd_config:91 setting X11Forwarding yes
   ```

   This clearly suggests that X11Forwarding is being turned on 
   again.

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.5.0-rc5-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_NZ, LC_CTYPE=en_NZ.UTF-8 (charmap=UTF-8), LANGUAGE=en_NZ:en 
(charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages openssh-server depends on:
ii  adduser3.118
ii  debconf [debconf-2.0]  1.5.73
ii  dpkg   1.19.7
ii  libaudit1  1:2.8.5-3+b1
ii  libc6  2.30-4
ii  libcom-err21.45.6-1
ii  libcrypt1  1:4.4.16-1
ii  libgssapi-krb5-2   1.17-7
ii  libkrb5-3  1.17-7
ii  libpam-modules 1.3.1-5
ii  libpam-runtime 1.3.1-5
ii  libpam0g   1.3.1-5
ii  libselinux13.0-1+b3
ii  libssl1.1  1.1.1f-1
ii  libsystemd0245.4-4
ii  libwrap0   7.6.q-30
ii  lsb-base   11.1.0
ii  openssh-client 1:8.2p1-4
ii  openssh-sftp-server1:8.2p1-4
ii  procps 2:3.3.16-4
ii  runit-helper   2.8.15
ii  ucf3.0038+nmu1
ii  zlib1g 1:1.2.11.dfsg-2

Versions of packages openssh-server recommends:
ii  libpam-systemd [logind]  245.4-4
pn  ncurses-term 
ii  xauth1:1.0.10-1

Versions of packages openssh-server suggests:
pn  molly-guard   
pn  monkeysphere  
ii  ssh-askpass   1:1.2.4.1-10+b1
pn  ufw   

-- debconf information excluded


-- 
 .''`.   martin f. krafft  @martinkrafft
: :'  :  proud Debian developer
`. `'`   http://people.debian.org/~madduck
  `-  Debian - when you have better things to do than fixing systems


digital_signature_gpg.asc
Description: Digital GPG signature (see http://martin-krafft.net/gpg/sig-policy/999bbcc4/current)


Bug#954965: /etc/ssh/ssh_config: ssh_config: Include custom config files at the end, so they can overwrite the default settings

2020-03-26 Thread Jan
Mar 25, 2020, 23:07 by cjwat...@debian.org:

> On Wed, Mar 25, 2020 at 10:33:20PM +0100, Jan wrote:
>
>> /etc/ssh/ssh_config now includes /etc/ssh/ssh_config.d/*.conf but does so
>> at the beginning. Thus custom config files cannot overwrite the default
>> options, all of which are set afterwards.
>>
> But, as ssh_config(5) says, "the first obtained value for each parameter
> is used".
>
I have to admit that I missed that. Even more embarrassing as it's also state 
in the beginning of  /etc/ssh/ssh_config. It does not apply in my case though, 
see below.


> I tested this and confirmed that it was possible to use files
> in /etc/ssh/ssh_config.d/*.conf to override default options in
> /etc/ssh/ssh_config.
>
> What tests did you perform?
>
I want to avoid sending any environment, but /etc/ssh/ssh_config has

| SendEnv LANG LC_*

So I originally put

| Host *
| SendEnv -LANG -LC_*
into /etc/ssh/ssh_config.d/no_env.conf. It works when I included that file at 
the very end of /etc/ssh/ssh_config. Just setting SendEnv at the beginning (via 
included files) does not help because this option has append semantics and the 
prepended dash only remove entries that already exist.


Regards, Jan



Bug#954965: /etc/ssh/ssh_config: ssh_config: Include custom config files at the end, so they can overwrite the default settings

2020-03-25 Thread Colin Watson
On Wed, Mar 25, 2020 at 10:33:20PM +0100, Jan wrote:
> /etc/ssh/ssh_config now includes /etc/ssh/ssh_config.d/*.conf but does so
> at the beginning. Thus custom config files cannot overwrite the default
> options, all of which are set afterwards.

But, as ssh_config(5) says, "the first obtained value for each parameter
is used".  I tested this and confirmed that it was possible to use files
in /etc/ssh/ssh_config.d/*.conf to override default options in
/etc/ssh/ssh_config.

What tests did you perform?

-- 
Colin Watson   [cjwat...@debian.org]



Bug#954965: /etc/ssh/ssh_config: ssh_config: Include custom config files at the end, so they can overwrite the default settings

2020-03-25 Thread Jan
Package: openssh-client
Version: 1:8.2p1-4
Severity: normal
File: /etc/ssh/ssh_config

Dear Maintainer,

/etc/ssh/ssh_config now includes /etc/ssh/ssh_config.d/*.conf but does so
at the beginning. Thus custom config files cannot overwrite the default
options, all of which are set afterwards.

Moving the include to the end of /etc/ssh/ssh_config solves this problem.


-- System Information:
Debian Release: bullseye/sid
  APT prefers testing-proposed-updates
  APT policy: (500, 'testing-proposed-updates'), (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.4.0-4-amd64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB 
(charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages openssh-client depends on:
ii  adduser   3.118
ii  dpkg  1.19.7
ii  libc6 2.30-2
ii  libedit2  3.1-20191231-1
ii  libfido2-11.3.1-1
ii  libgssapi-krb5-2  1.17-6
ii  libselinux1   3.0-1+b1
ii  libssl1.1 1.1.1d-2
ii  passwd1:4.8.1-1
ii  zlib1g1:1.2.11.dfsg-2

Versions of packages openssh-client recommends:
ii  xauth  1:1.0.10-1

Versions of packages openssh-client suggests:
pn  keychain   
ii  ksshaskpass [ssh-askpass]  4:5.17.5-2
pn  libpam-ssh 
pn  monkeysphere   

-- Configuration Files:
/etc/ssh/ssh_config changed:
Host *
SendEnv LANG LC_*
HashKnownHosts yes
GSSAPIAuthentication yes
Include /etc/ssh/ssh_config.d/*.conf


-- no debconf information