Bug#873019: shellinabox: ssh unsupported option after username input

[Leonardo Marino-Ramirez]

Package: shellinabox
Version: 2.20+b1
Severity: normal

Dear Maintainer,

After providing the username I am getting:

command-line line 0: Unsupported option "rhostsrsaauthentication"
command-line line 0: Unsupported option "rsaauthentication"

Then, I am prompted for a password (Password:)

I am able to login and the messages seem to be related to ssh parameters passed at some point.

This is what I see:

login: <USERNAME>
command-line line 0: Unsupported option "rhostsrsaauthentication"
command-line line 0: Unsupported option "rsaauthentication"
Password:

Then the login proceeds and things are fine.


-- System Information:
Debian Release: buster/sid
APT prefers testing
APT policy: (1001, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-3-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages shellinabox depends on:
ii adduser 3.116
ii libc6 2.24-14
ii libpam0g 1.1.8-3.6
ii libssl1.1 1.1.0f-4
ii lsb-base 9.20161125
ii zlib1g 1:1.2.8.dfsg-5

shellinabox recommends no packages.

Versions of packages shellinabox suggests:
ii openssl 1.1.0f-4

-- Configuration Files:
/etc/default/shellinabox changed:
SHELLINABOX_DAEMON_START=1
SHELLINABOX_PORT=4200
SHELLINABOX_ARGS="--no-beep -s /:SSH:marino-johnson.org --localhost-only -f favicon.ico:/var/www/favicon.ico"


-- no debconf information

[Leonardo Mariño-Ramírez]

The bug is located in shellinabox/service.c

Removing the flags:

-oRhostsRSAAuthentication=no
-oRhostsRSAAuthentication=no

and recompiling solves this issue.

[Leonardo Marino-Ramirez]

Dear maintainer,

Please remove these outdated ssh options from service.c:

-oRhostsRSAAuthentication=no
-oRSAAuthentication=no

Thanks, Leonardo

[Ángel]

Followup-For: Bug #873019
Package: shellinabox
Version: 2.21
Tags: patch

When using the built-in SSH service description, that produces

command-line line 0: Unsupported option "rhostsrsaauthentication"
command-line line 0: Unsupported option "rsaauthentication"

this is because SSH is mapped (initService function) to running ssh(1)
with a bunch of options which include
-oRhostsRSAAuthentication=no -oRSAAuthentication=no

However, these options were removed in OpenSSH 7.4 along SSH 1 support,
as documented by Colin in https://salsa.debian.org/ssh-team/openssh/-/commit/fb87db8aa47d3508be8e5bb1d21897fa1f2eca90
(debian bug #851573)

The attached patch solves it.

Upstream bug: https://github.com/shellinabox/shellinabox/issues/458