** Description changed: + MIR report for source package: openssh + Target series: devel + + [Availability] + - Current Launchpad builds pass on: amd64, amd64v3, arm64, armhf, i386, ppc64el, riscv64, s390x. + - Source package: https://launchpad.net/ubuntu/+source/openssh + - The source package openssh is published in Ubuntu (main). + + [Rationale] + - The package src:openssh is required in Ubuntu main because it's the "thefacto" method to securely connect to remote systems, used by system administrators, automation, Ubuntu infrastructure, clouds, home routers, enterprise routers, the list goes on and on. + - The package src:openssh will generally be useful for a large part of our user base. + - Additional reasons: the openssh package has been in main for the entirety of Ubuntu's life so far. + - The package src:openssh is required in Ubuntu main no later than stonking release due to the high expectation that it is in main already, and will be kept in main. + - There are other SSH implementations in the archive, but OpenSSH is the standard one, with all the features. The others usually implement a smaller subset, are used in rescue systems, or are libraries or language modules used by applications directly. For example, src:libssh2, or src:paramiko. + - The binary packages openssh-common, openssh-server, openssh-sftp-server, and ssh need to be in main. These are the packages in main in stonking already, being seeded or rdeps of other main packages. In any case, the packages I listed are the essential part of Openssh: client and server. + + + [Security] + - No AppArmor profiles, desktop files, translations, or plugin candidates were found. + - Security has been kept in mind and common isolation/risk-mitigation patterns are in place. + + OpenSSH upstream has several hardening features. They have separate + processes to handle authentication inside a sandbox (the "privilege + separation") approach + (http://www.citi.umich.edu/u/provos/papers/privsep.pdf). + + There is no apparmor profile, as the remote shell would inherit this + profile and wouldn't work properly unless the profile is fully open. + Perhaps an apparmor profile, or other systemd security features could be + applied to the main listening process, and dropped later, but this has + not been done externally. + + Other hardening techniques from the source code itself include: + - seccomp sandboxing: https://github.com/openssh/openssh-portable/blob/master/sandbox-seccomp-filter.c + - protect private keys at rest in RAM: https://www.openssh.org/txt/release-8.1?utm_source=gemini#:~:text=private%20keys%20at-,rest%20in%20RAM,-against%20speculation%20and + - really scrub sensitive data: https://github.com/openssh/openssh-portable/blob/master/openbsd-compat/explicit_bzero.c?utm_source=gemini + + AI: The evidence confirms the presence of compiler hardening + (`hardening=+all`) and seccomp sandboxing (`sandbox-seccomp-filter.c`). + However, it is insufficient to determine if mitigations are proportional + to the exposure because: (1) the evidence lists multiple SHA1 + cryptographic pattern hits but does not indicate whether these + deprecated algorithms are disabled by default in the configuration; (2) + while systemd units are listed, their specific hardening directives are + not visible in the summary; and (3) the setuid binary `ssh-keysign` + lacks an AppArmor profile, and the evidence does not clarify if the + internal sandboxing is accepted as a sufficient substitute for this + component. + + - It's a non-trivial task to completely erradicate deprecated + cryptographic algorithms in a tool like openssh. It still has to connect + to old systems, for example. Care is taken to over time deprecate these + algorithms, though. + + Some examples of deprecations include: + - DSA keys: completely removed in OpenSSH 10.0, April 2025: https://www.openssh.org/txt/release-10.0 + - Finite-Field Diffie-Hellman Key Exchange disabled in OpenSSH 9.0, April 2023: https://www.openssh.org/txt/release-10.0 + - RSA with SHA-1 disabled in OpenSSH 8.8, September 2021: https://www.openssh.org/txt/release-8.8 + - RC4, 3DES, Blowfish: disabled in OpenSSH 6.7, October 2014: https://www.openssh.org/txt/release-6.7 + - SSH1 protocol removed in OpenSSH 7.6, October 2017: https://www.openssh.org/txt/release-7.6 + - RC4, hmac-ripemd160, CAST, blowfish completely removed in OpenSSH 7.6, October 2017: https://www.openssh.org/txt/release-7.6 + - refuse RSA keys smaller than 1024 bits, log other keys that do not meet the requirement in OpenSSH 7.6, October 2017: https://www.openssh.org/txt/release-7.6 + + AI: + (The evidence includes a non-empty list of crypto_pattern_hits from the source tree grep, with specific paths and line numbers matching deprecated algorithm names (e.g., SHA1, MD5). The list is truncated but clearly shows multiple occurrences across several files. This satisfies the policy condition to list distinct files/lines and advise the reporter to confirm actual usage before flagging Security review.) + + Security history: + - The queried trackers found 28 associated CVE(s): CVE-2021-41617, CVE-2023-38408, CVE-2023-48795, CVE-2023-51385, CVE-2025-26465, CVE-2025-32728, CVE-2025-61984, CVE-2025-61985, CVE-2026-3497, CVE-2026-35385, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388, CVE-2026-35414, CVE-2026-55653, CVE-2026-55654, CVE-2026-55655, CVE-2026-59995, CVE-2026-59996, CVE-2026-59997 (and 8 more). + (Verify their relevance and describe the handling history. Sourcing: the Ubuntu CVE tracker plus the cross-vendor cvelistV5/NVD corpus, which also covers Debian-relevant CVE identifiers - no separate Debian or NVD check is needed. The OSS-security mailing list (pre-CVE-assignment chatter) is not covered by these adapters; flag it yourself if you are aware of such a discussion.) + - Installed privileged/service surface: setuid/setgid: openssh-client_10.5p1-1ubuntu2_amd64/usr/lib/openssh/ssh-keysign; sbin executables: openssh-server_10.5p1-1ubuntu2_amd64/usr/sbin/sshd; systemd units: openssh-server_10.5p1-1ubuntu2_amd64/usr/lib/systemd/system/[email protected], openssh-server_10.5p1-1ubuntu2_amd64/usr/lib/systemd/system/sshd-keygen.service, openssh-server_10.5p1-1ubuntu2_amd64/usr/lib/systemd/system/ssh.socket, openssh-server_10.5p1-1ubuntu2_amd64/usr/lib/systemd/system/ssh.service, openssh-server_10.5p1-1ubuntu2_amd64/usr/lib/systemd/system/rescue-ssh.target. + + OpenSSH is used to access remote systems, and therefore quite exposed. + It's part of its job to allow remote logins, even from privileged users. + It's expected it will atract a lot of attention, scrutiny, security + research, and interest. Security vulnerabilities are found, and + addressed in a coordinated and timely manner. This is the security + history from the project's own records: + https://www.openssh.org/security.html + + + [Quality assurance - function/usage] + - The package works well right after install. Host keys are generated, the service is listening and ready to accept connections. + + AI: + (The packaging-source.debconf_templates list is empty, indicating no interactive configuration is required during installation. The binary-package-inspection.systemd_units list includes ssh.socket and ssh.service, which are standard units that allow the service to start and listen for connections immediately upon installation using sane defaults.) + + [Quality assurance - maintenance] + - The package does not depend on exotic hardware we cannot support. + - The package has 632 open Debian bugs and 165 open Launchpad bugs. Upstream is very committed to maintaining the project, and both Ubuntu and Debian react quickly to high severity issues, and security updates are prompt. + + Upstream has recently + (https://www.openssh.org/releasenotes.html#:~:text=these%20bugs%20too.-,Given,-this%2C%20the%20OpenSSH) + committed to even more frequent releases to increase the rate of bug + fixes landing in the hands of users. + + AI: + (The evidence provides explicit counts for Debian and Launchpad bugs, specific dates and severities for High importance bugs, and detailed metrics for release cadence, allowing for a precise summary of the maintenance history.) + + Left to clarify: + - Important open bugs found: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1291696, https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1485487, https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2130448. + (Explain their maintenance impact.) + + Let's see: + - LP: #1291696: filed in 2014, last comment from November of the same year. Triaged as "high" by someone. + - LP: #1485487: filed in 2015, postinst issue, no comments whatsoever, triaged as "high" by someone. + - LP: #2130448: filed in 2025, being triaged, also has a spinoff bug in LP: #2157917. Seems to be lacking reproduceabiility. + + + [Quality assurance - testing] + - Build and Autopkgtest can cover all regular tests this package needs. + - the autopkgtest coverage could be better, as it only deals with password authentication. The more complex gssapi authentication tests were moved to the src:openssh-gssapi package. There is always room for improvement, like using ssh for remote execution of commands, other types of PAM integration testing (expired accounts, locked accounts). + - The package includes non-trivial build tests. Failures are not ignored. + + AI: + (The `debian/rules` file overrides `dh_auto_test-arch` to execute `unit` and `compat-tests` targets via make, along with a `keygen-test`. The `debian/tests/control` file defines several non-trivial autopkgtests, including `regress`, `socket-activation`, `xinetd`, `password-auth-no-pam`, `systemd-socket-activation`, and `sshd-socket-generator`. These tests require root privileges and complex dependencies such as `dropbear`, `putty-tools`, and `systemd` to verify interoperability and integration.) + - Autopkgtests are present and pass on: amd64, amd64v3, arm64, armhf, i386, ppc64el, s390x, riscv64 + + + [Quality assurance - packaging] + - A debian/watch upstream-release mechanism is present. + - debian/control defines a correct Maintainer field + - Lintian reported 0 error(s) and 0 warning(s). + - No Python 2, GTK 2, or other catalogued obsolete runtime dependency was found. + - Source format: 3.0 (quilt); debconf templates: 0; debian/rules overrides: dh_auto_build-arch, dh_auto_build-indep, dh_auto_clean, dh_auto_configure-arch, dh_auto_configure-indep, dh_auto_install-arch, dh_auto_install-indep, dh_auto_test-arch, dh_auto_test-indep, dh_autoreconf-indep, dh_gencontrol, dh_install-arch, dh_installdocs, dh_installinit, dh_installpam, dh_installsystemd, dh_missing, dh_runit. + - The following lintian override(s) lack an explanatory comment: elevated-privileges, superfluous-file-pattern, systemd-service-file-refers-to-unusual-wantedby-target. + (See the following item for the reporter's explanation.) + - The packaging contains uncommented lintian overrides for 'elevated-privileges', 'superfluous-file-pattern', and 'systemd-service-file-refers-to-unusual-wantedby-target' tags that require reporter justification. + + In debian/openssh-client.lintian-overrides: + openssh-client: elevated-privileges 4755 root/root [usr/lib/openssh/ssh-keysign] + This is used for Host-based authentication. The helper is called internally by the ssh client (it's not meant to be called by end-users directly) and needs to be suid root because it needs to be able to read the host private keys, which are mode 0600 root:root. This feature is disabled by default and needs a configuration change to be enabled. + + In debian/openssh-server.lintian-overrides: + openssh-server: systemd-service-file-refers-to-unusual-wantedby-target ssh.service [usr/lib/systemd/system/sshd-keygen.service] + openssh-server: systemd-service-file-refers-to-unusual-wantedby-target ssh.socket [usr/lib/systemd/system/sshd-keygen.service] + openssh-server: systemd-service-file-refers-to-unusual-wantedby-target sshd.service [usr/lib/systemd/system/sshd-keygen.service] + openssh-server: systemd-service-file-refers-to-unusual-wantedby-target [email protected] [usr/lib/systemd/system/sshd-keygen.service] + + That file has a comment, and it reads: # Deliberate special cases for + a helper service. + + In debian/source/lintian-overrides: + openssh source: untranslatable-debconf-templates [debian/openssh-server.templates:20] + That file has a comment and it is: # openssh-server/password-authentication is preseeding-only, at least for now. + + The same file has a comment for the entries below. It's: + # These entries in debian/copyright are helpful when running lrc in a git + # checkout or an unpacked source package, but lintian doesn't apply patches + # so it thinks they're superfluous. + openssh source: superfluous-file-pattern kexgss*.c [debian/copyright:*] + openssh source: superfluous-file-pattern ssh-null.c [debian/copyright:*] + (The evidence in 'packaging-source.lintian_override_entries' shows three override entries without comments: 'elevated-privileges', 'superfluous-file-pattern', and 'systemd-service-file-refers-to-unusual-wantedby-target'. Per policy, I cannot invent justifications for these uncommented overrides; only the reporter can explain why they are needed.) + + - Packaging is complex, and I agree debian/rules is complex. Not sure what can be done about it today. + AI: + Reasoning: The debian/rules is well over 100 non-comment lines with 18+ overrides containing substantial hand-rolled logic. Key complexity factors: (1) dual build directories (debian/build-deb and debian/build-udeb) with separate configure/build/install steps; (2) fragile post-configure manipulation using perl -pi to edit config.status and config.h (removing USE_BTMP, avoiding libnsl linkage); (3) sed editing of installed conffiles to strip $OpenBSD tags; (4) PAM template generation from .pam.in via conditional sed; (5) extensive conditional logic for cross-compilation, Ubuntu vs Debian vendor, udeb build profiles, and gnome askpass; (6) manual MAKE invocations for regress binaries and gnome-ssh-askpass3. Hardening is enabled (+all) and tests are not disabled, but the overall rules file is a genuine maintenance hazard due to its length and fragile file manipulations. + + + [UI standards] + - This package is not end-user facing (server, CLI-only tool, daemon, or library), so desktop-file and translation requirements do not apply. + (OpenSSH is fundamentally a server daemon (sshd with systemd units) and CLI tool suite (ssh, scp, sftp, ssh-keygen, ssh-agent). The binary sections are 'net', 'gnome', and 'debian-installer' — 'net' is typical for networking/CLI tools, not desktop apps. The main runtime dependencies lack GUI toolkits; only the ssh-askpass-gnome subpackage depends on GTK, and it is a small helper dialog invoked automatically for passphrase prompts, not a standalone desktop application an end user launches. The presence of sbin executables (sshd) and systemd service units confirms the daemon/server nature. CLI tools are not 'end-user facing graphical desktop programs' in the sense this check targets.) + - Not an end-user application (server, CLI-only tool, or library) - no Desktop file is needed. + - Application is not end-user facing (does not need translation). + + [Dependencies] + These binary packages are to be in main: + + - openssh-common: + - Depends: libc6 (>= 2.38), libfido2-1 (>= 1.8.0), libselinux1 (>= 3.1~), libssl4 (>= 4.0.0) + + - openssh-server: + - Depends: libpam-modules, libpam-runtime, openssh-common (= 1:10.5p1-1ubuntu2), openssh-sftp-server, procps, ucf, debconf (>= 0.5) | debconf-2.0, systemd | systemd-standalone-sysusers | systemd-sysusers, systemd | systemd-standalone-tmpfiles | systemd-tmpfiles, libaudit1 (>= 1:2.2.1), libc6 (>= 2.42), libcrypt1 (>= 1:4.1.0), libpam0g (>= 0.99.7.1), libselinux1 (>= 3.1~), libssl4 (>= 4.0.0), libwrap0 (>= 7.6-4~), zlib1g (>= 1:1.1.4) + - Recommends: default-logind | logind | libpam-systemd, ncurses-term, passwd, xauth, ssh-import-id + + - openssh-sftp-server: + - Depends: openssh-common (= 1:10.5p1-1ubuntu2), libc6 (>= 2.38) + - Recommends: openssh-server | ssh-server + + - ssh: + - Depends: openssh-client (>= 1:10.5p1-1ubuntu2), openssh-server (>= 1:10.5p1-1ubuntu2), openssh-common (= 1:10.5p1-1ubuntu2) + + Build-depends: + debhelper (>= 13.1~), + debhelper-compat (= 13), + dh-exec, + dh-runit (>= 2.8.8), + dh-sequence-installsysusers, + libaudit-dev [linux-any], + libcrypt-dev, + libedit-dev, + libfido2-dev (>= 1.5.0) [linux-any], + libgtk-3-dev <!pkg.openssh.nognome>, + libpam0g-dev | libpam-dev, + libselinux-dev [linux-any], + libssl-dev (>= 1.1.1), + libwrap0-dev | libwrap-dev, + pkgconf, + zlib1g-dev, + systemd-dev, + + Everything in main, or not needed at runtime. + + + [Standards compliance] + - This package correctly follows FHS and Debian Policy. + - No license expiry, time-bound terms, entity/contract coupling, withdrawable branches, patents, or other encumbrances were identified; the license is expected to remain compatible with Ubuntu main throughout the full support lifetime. + + [Maintenance/Owner] + - The owning team already subscribed to this package is confirmed and has explicitly acknowledged the long-term maintenance commitment. + - Package bug subscriber team(s): ubuntu-security, ubuntu-server. + - No shipped vendored directories were detected. + - Launchpad records contain 8 build(s) from the last three months. Builds: https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585850, https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585851, https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585852, https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585853, https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585854, https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585855, https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585856, https://launchpad.net/ubuntu/+source/openssh/1:10.5p1-1ubuntu2/+build/33585857. + - This change is not expected to impact other Ubuntu teams. + - Built binaries declare no Built-Using or Static-Built-Using entries. + + [Background information] + - The upstream project is OpenSSH, which is the same as the source package name. + (The upstream-tracker lists the upstream name as 'OpenSSH', and the debian_control Source field is 'openssh', confirming the source package name matches the upstream project name.) + - Upstream project: https://www.openssh.com/portable.html + - The package description explains the package well. + [ Original Description ] This is a MIR request for src:openssh-gssapi. It's a split from src:openssh, which is already in main, triggered by debian[1]. The main reasoning is to reduce the security exposure of src:openssh by removing the kerberos/gssapi feature in src:openssh and moving it to src:openssh- gssapi. It's basically a different set of build options of the same source. I'm invoking the Renamed or reorganized sources[6] part of the MIR process. The one thing Ubuntu is adding on top is the ccache patch[2], from Fedora. That patch has been requested for ubuntu since 2020[2], and has been provided in a Server Team maintained PPA[3] for jammy, noble, and more recently resolute. The PPA work is detailed in a Canonical-internal SPEC[4]. The security team was made aware[7] (Canonical-only internal link) of this PPA back then and agreed to help support it if needed, but that was never necessary as the patch always applied cleanly and introduced no regressions in all these years. Still, it's of course feasible that a security vulnerability could only affect src:openssh- gssapi due to this patch. The other consequence of this new source package is that a non- kerberos/gssapi vulnerability on openssh will likely need to be fixed in both source packages. Likewise for regular bugs. Differently from the PPA, the approach here is a plain patch-and-build one. The PPA for jammy, noble, resolute, still uses the alternatives mechanism and two builds from the same source. The package includes a new autopkgtest[5] which covers the patch behavior, and runs the normal upstream regression test at both build- time and as an autopkgtest. And still has the normal openssh autopkgtests, like socket-activation, xinetd, and general gssapi/kerberos login. The canonical-server team will subscribe to this package. 1. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141274 2. https://bugs.launchpad.net/ubuntu/+source/openssh-gssapi/+bug/1889548 3. https://launchpad.net/~canonical-server/+archive/ubuntu/openssh-server-default-ccache 4. https://docs.google.com/document/d/1UJDtDNCbDxfaq10inp5nVlisbMh-zwxzpPR0Hp_UrnI/edit 5. https://git.launchpad.net/ubuntu/+source/openssh-gssapi/tree/debian/tests/ssh-gssapi-default-ccache 6. https://ubuntu.com/project/docs/MIR/mir-rereview/#renamed-or-reorganized-sources 7. https://docs.google.com/document/d/1-qadf8qTJyOF5CKVR5iFFYlKF5-XLB_qShDw5Ykp5pw/edit?tab=t.0
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2167624 Title: MIR (source fork): openssh-gssapi + ccache patch (the new thing) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2167624/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
