vmware / vmware/photon

OpenSSH broken after updating to 8.9p1-2.ph4

Open
#1,505 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C
Stars
3.2k
Forks
692
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

OS: Photon OS 4.0
Latest know working OpenSSH Version:
openssh-clients-8.8p1-3.ph4.x86_64
openssh-server-8.8p1-3.ph4.x86_64
openssh-8.8p1-3.ph4.x86_64

Latest avaiable OpenSSH package:
openssh-server x86_64 8.9p1-2.ph4 photon-updates 1.14M 1196581
openssh-clients x86_64 8.9p1-2.ph4 photon-updates 4.83M 5061405
openssh x86_64 8.9p1-2.ph4 photon-updates 0.00b 0

Tested kernel:
5.10.142-1.ph4-esx
5.10.190-3.ph4-esx

After the upgrade:
1 - systemctl daemon-reload is not triggered
2 - the SSHd daemon is down
3 - If you manually start the daemon you will not be able to log in and the following error will be logged:
2023-09-14T06:26:26.681618+00:00 SRVNAME sshd[4675]: Server listening on 0.0.0.0 port 22.
2023-09-14T06:26:26.681856+00:00 SRVNAME sshd[4675]: Server listening on :: port 22.
2023-09-14T06:26:34.935768+00:00 SRVNAME sshd[4685]: Connection closed by 127.0.0.1 port 38882 [preauth]
2023-09-14T06:26:49.518524+00:00 SRVNAME sshd[4693]: [module:pam_lsass]pam_sm_authenticate: failed [error code:40017]
2023-09-14T06:26:49.524349+00:00 SRVNAME sshd[4693]: [module:pam_lsass]pam_sm_authenticate: failed [error code:40017]
2023-09-14T06:26:49.531977+00:00 SRVNAME sshd[4691]: Accepted keyboard-interactive/pam for support from 127.0.0.1 port 59004 ssh2
2023-09-14T06:26:49.532557+00:00 SRVNAME audit[4692]: SECCOMP auid=4294967295 uid=50 gid=50 ses=4294967295 subj=unconfined pid=4692 comm="sshd" exe="/usr/sbin/sshd" sig=31 arch=c000003e syscall=13 compat=0 ip=0x7f0d09dc8192 code=0x0
2023-09-14T06:26:49.532698+00:00 SRVNAME audit[4692]: ANOM_ABEND auid=4294967295 uid=50 gid=50 ses=4294967295 subj=unconfined pid=4692 comm="sshd" exe="/usr/sbin/sshd" sig=31 res=1
2023-09-14T06:26:49.532996+00:00 SRVNAME sshd[4691]: fatal: privsep_preauth: preauth child terminated by signal 31

Reproduction steps
  1. Upgrade openssh package from 8.8p1-3.ph4 to 8.9p1-2.ph
  2. systemctl-daemon reload
  3. systemct start ssh
    ...
Expected behavior

Would be possibile to log-in.

Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the upgrade from openssh 8.8p1-3.ph4 to 8.9p1-2.ph4 on Photon OS 4.0, then inspect the systemd service behavior and the audit, PAM, and sshd logs shown in the report. Done means the SSH daemon starts after the upgrade and users can log in successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
networking, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.