OpenSSH broken after updating to 8.9p1-2.ph4
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 692
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
OS: Photon OS 4.0
Latest know working OpenSSH Version:
openssh-clients-8.8p1-3.ph4.x86_64
openssh-server-8.8p1-3.ph4.x86_64
openssh-8.8p1-3.ph4.x86_64
Latest avaiable OpenSSH package:
openssh-server x86_64 8.9p1-2.ph4 photon-updates 1.14M 1196581
openssh-clients x86_64 8.9p1-2.ph4 photon-updates 4.83M 5061405
openssh x86_64 8.9p1-2.ph4 photon-updates 0.00b 0
Tested kernel:
5.10.142-1.ph4-esx
5.10.190-3.ph4-esx
After the upgrade:
1 - systemctl daemon-reload is not triggered
2 - the SSHd daemon is down
3 - If you manually start the daemon you will not be able to log in and the following error will be logged:
2023-09-14T06:26:26.681618+00:00 SRVNAME sshd[4675]: Server listening on 0.0.0.0 port 22.
2023-09-14T06:26:26.681856+00:00 SRVNAME sshd[4675]: Server listening on :: port 22.
2023-09-14T06:26:34.935768+00:00 SRVNAME sshd[4685]: Connection closed by 127.0.0.1 port 38882 [preauth]
2023-09-14T06:26:49.518524+00:00 SRVNAME sshd[4693]: [module:pam_lsass]pam_sm_authenticate: failed [error code:40017]
2023-09-14T06:26:49.524349+00:00 SRVNAME sshd[4693]: [module:pam_lsass]pam_sm_authenticate: failed [error code:40017]
2023-09-14T06:26:49.531977+00:00 SRVNAME sshd[4691]: Accepted keyboard-interactive/pam for support from 127.0.0.1 port 59004 ssh2
2023-09-14T06:26:49.532557+00:00 SRVNAME audit[4692]: SECCOMP auid=4294967295 uid=50 gid=50 ses=4294967295 subj=unconfined pid=4692 comm="sshd" exe="/usr/sbin/sshd" sig=31 arch=c000003e syscall=13 compat=0 ip=0x7f0d09dc8192 code=0x0
2023-09-14T06:26:49.532698+00:00 SRVNAME audit[4692]: ANOM_ABEND auid=4294967295 uid=50 gid=50 ses=4294967295 subj=unconfined pid=4692 comm="sshd" exe="/usr/sbin/sshd" sig=31 res=1
2023-09-14T06:26:49.532996+00:00 SRVNAME sshd[4691]: fatal: privsep_preauth: preauth child terminated by signal 31
Reproduction steps
- Upgrade openssh package from 8.8p1-3.ph4 to 8.9p1-2.ph
- systemctl-daemon reload
- systemct start ssh
...
Expected behavior
Would be possibile to log-in.
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the upgrade from openssh 8.8p1-3.ph4 to 8.9p1-2.ph4 on Photon OS 4.0, then inspect the systemd service behavior and the audit, PAM, and sshd logs shown in the report. Done means the SSH daemon starts after the upgrade and users can log in successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- networking, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100