Project

General

Profile

Actions

Bug #26499

open

Standard Rudder technique “SSH server (OpenSSH)” breaks SSH server if Match blocks exists in sshd_config

Added by Michel BOUISSOU 16 days ago. Updated 8 days ago.

Status:
Pending release
Priority:
1 (highest)
Category:
Techniques
Target version:
Severity:
Major - prevents use of part of Rudder | no simple workaround
UX impact:
User visibility:
Operational - other Techniques | Rudder settings | Plugins
Effort required:
Very Small
Priority:
0
Name check:
To do
Fix check:
To do
Regression:
No

Description

sshd_config can end with Match blocks such as :

# Additional Match Blocks
Match User john,susie,jane,tom
    AllowTcpForwarding no
    X11Forwarding no
    PermitTTY yes

Such blocks do not “end” unless another such block begins.

Rudder standard technique “SSH server (OpenSSH)” appends defined global parameters at the end of the sshd_config file.

This causes the sshd daemon to fail restarting, as it considers this global parameters to be part of the previous “Match” block, which make the configuration invalid.

Actions #1

Updated by Michel BOUISSOU 16 days ago

By the way this is contrary to “man sshd_config(5)” that states that global parameters after match blocks should make the server consider that the block ended.

But it doesn't work and practically speaking in such cases, th sshd daemon just fails starting.

Actions #2

Updated by Nicolas CHARLES 9 days ago

  • Assignee set to Elaad FURREEDAN

This ticket is tricky to fix as it would need a total rewrite of the technique to fix this problem

This might be fixable with Augeas module.
As a workaround we may document that we don't support Match User at the end of the file ?

Actions #3

Updated by Nicolas CHARLES 9 days ago

  • Priority changed from To review to 1 (highest)
  • Effort required set to Very Small
Actions #4

Updated by Elaad FURREEDAN 9 days ago

  • Status changed from New to In progress
Actions #5

Updated by Elaad FURREEDAN 9 days ago

  • Status changed from In progress to Pending technical review
  • Assignee changed from Elaad FURREEDAN to Nicolas CHARLES
  • Pull Request set to https://github.com/Normation/rudder-techniques/pull/1870
Actions #6

Updated by Anonymous 8 days ago

  • Status changed from Pending technical review to Pending release
Actions

Also available in: Atom PDF