PowerShell / PowerShell/Win32-OpenSSH
CIDR notation in AllowUsers is not recongnized in sshd_config
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
"OpenSSH for Windows" version
((Get-Item (Get-Command sshd).Source).VersionInfo.FileVersion)
7.7.2.3
Server OperatingSystem
((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows nt\CurrentVersion\" -Name ProductName).ProductName)
Windows 10 Pro
Client OperatingSystem
Debian 10
cat /etc/debian_release
10.9
ssh -V
OpenSSH_7.9p1 Debian-10+deb10u2, OpenSSL 1.1.1d 10 Sep 2019
What is failing
If I set the hostname as CIDR in AllowUsers in sshd_config, I get a Permission denied message when I try to connect via ssh.
IP
- client: 192.168.10.99
- server: 192.168.10.55
Server's C:\ProgramData\sshd\ssh_config
AllowUsers kihara@192.168.10.0/24
AllowUsers Kihara@192.168.10.0/24
Expected output
@client $ ssh -v -i ~/.ssh/id_ed25519 Kihara@server
...
debug1: Authentication succeeded (publickey).
...
@server $
Actual output
- client's ssh output
@client $ ssh -i ~/.ssh/id_ed25519 Kihara@server
Kihara@192.168.10.55: Permission denied (publickey).
- server's log
EventViewer > アプリケーションとサービスログ (Applications and Services Logs) > OpenSSH > Operational
sshd: User kihara from 192.168.10.99 not allowed because not listed in AllowUsers
sshd: Connection closed by invalid user Kihara 192.168.10.99 port 57178 [preauth]
Workaround
After changing CIDR notation to wildcard, it works.
- AllowUsers kihara@192.168.10.0/24
- AllowUsers Kihara@192.168.10.0/24
+ AllowUsers kihara@192.168.10.*
+ AllowUsers Kihara@192.168.10.*
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how the sshd_config AllowUsers directive is parsed and how the connecting client address is matched. Reproduce the reported 192.168.10.0/24 case against 192.168.10.99, compare it with the working wildcard form, and add or run a regression test showing that CIDR access succeeds without changing wildcard behavior.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100