Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Bug#954965: /etc/ssh/ssh_config: ssh_config: Include custom config files at the end, so they can overwrite the default settings

742 views
Skip to first unread message

Jan

unread,
Mar 25, 2020, 5:40:03 PM3/25/20
to
Package: openssh-client
Version: 1:8.2p1-4
Severity: normal
File: /etc/ssh/ssh_config

Dear Maintainer,

/etc/ssh/ssh_config now includes /etc/ssh/ssh_config.d/*.conf but does so
at the beginning. Thus custom config files cannot overwrite the default
options, all of which are set afterwards.

Moving the include to the end of /etc/ssh/ssh_config solves this problem.


-- System Information:
Debian Release: bullseye/sid
APT prefers testing-proposed-updates
APT policy: (500, 'testing-proposed-updates'), (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.4.0-4-amd64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages openssh-client depends on:
ii adduser 3.118
ii dpkg 1.19.7
ii libc6 2.30-2
ii libedit2 3.1-20191231-1
ii libfido2-1 1.3.1-1
ii libgssapi-krb5-2 1.17-6
ii libselinux1 3.0-1+b1
ii libssl1.1 1.1.1d-2
ii passwd 1:4.8.1-1
ii zlib1g 1:1.2.11.dfsg-2

Versions of packages openssh-client recommends:
ii xauth 1:1.0.10-1

Versions of packages openssh-client suggests:
pn keychain <none>
ii ksshaskpass [ssh-askpass] 4:5.17.5-2
pn libpam-ssh <none>
pn monkeysphere <none>

-- Configuration Files:
/etc/ssh/ssh_config changed:
Host *
SendEnv LANG LC_*
HashKnownHosts yes
GSSAPIAuthentication yes
Include /etc/ssh/ssh_config.d/*.conf


-- no debconf information

Colin Watson

unread,
Mar 25, 2020, 6:10:03 PM3/25/20
to
On Wed, Mar 25, 2020 at 10:33:20PM +0100, Jan wrote:
> /etc/ssh/ssh_config now includes /etc/ssh/ssh_config.d/*.conf but does so
> at the beginning. Thus custom config files cannot overwrite the default
> options, all of which are set afterwards.

But, as ssh_config(5) says, "the first obtained value for each parameter
is used". I tested this and confirmed that it was possible to use files
in /etc/ssh/ssh_config.d/*.conf to override default options in
/etc/ssh/ssh_config.

What tests did you perform?

--
Colin Watson [cjwa...@debian.org]

Jan

unread,
Mar 26, 2020, 12:10:05 PM3/26/20
to
Mar 25, 2020, 23:07 by cjwa...@debian.org:

> On Wed, Mar 25, 2020 at 10:33:20PM +0100, Jan wrote:
>
>> /etc/ssh/ssh_config now includes /etc/ssh/ssh_config.d/*.conf but does so
>> at the beginning. Thus custom config files cannot overwrite the default
>> options, all of which are set afterwards.
>>
> But, as ssh_config(5) says, "the first obtained value for each parameter
> is used".
>
I have to admit that I missed that. Even more embarrassing as it's also state in the beginning of  /etc/ssh/ssh_config. It does not apply in my case though, see below.


> I tested this and confirmed that it was possible to use files
> in /etc/ssh/ssh_config.d/*.conf to override default options in
> /etc/ssh/ssh_config.
>
> What tests did you perform?
>
I want to avoid sending any environment, but /etc/ssh/ssh_config has

| SendEnv LANG LC_*

So I originally put

| Host *
|     SendEnv -LANG -LC_*
into /etc/ssh/ssh_config.d/no_env.conf. It works when I included that file at the very end of /etc/ssh/ssh_config. Just setting SendEnv at the beginning (via included files) does not help because this option has append semantics and the prepended dash only remove entries that already exist.


Regards, Jan

martin f krafft

unread,
Apr 16, 2020, 10:30:03 PM4/16/20
to

Package: openssh-server
Version: 1:8.2p1-4
Followup-For: Bug #954965

Just wanted to chime in to say that

  1. I can confirm that the config works as intended,

  2. The debug output is really quite confusing in this regard:

    debug3: /etc/ssh/sshd_config.d/no-xforwarding.conf:1 setting X11Forwarding no  
[…]  
debug3: /etc/ssh/sshd_config:91 setting X11Forwarding yes

    This clearly suggests that X11Forwarding is being turned on again.

-- System Information:
Debian Release: bullseye/sid

APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.5.0-rc5-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_NZ, LC_CTYPE=en_NZ.UTF-8 (charmap=UTF-8), LANGUAGE=en_NZ:en (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash


Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages openssh-server depends on:
ii adduser 3.118
ii debconf [debconf-2.0] 1.5.73
ii dpkg 1.19.7
ii libaudit1 1:2.8.5-3+b1
ii libc6 2.30-4
ii libcom-err2 1.45.6-1
ii libcrypt1 1:4.4.16-1
ii libgssapi-krb5-2 1.17-7
ii libkrb5-3 1.17-7
ii libpam-modules 1.3.1-5
ii libpam-runtime 1.3.1-5
ii libpam0g 1.3.1-5
ii libselinux1 3.0-1+b3
ii libssl1.1 1.1.1f-1
ii libsystemd0 245.4-4
ii libwrap0 7.6.q-30
ii lsb-base 11.1.0
ii openssh-client 1:8.2p1-4
ii openssh-sftp-server 1:8.2p1-4
ii procps 2:3.3.16-4
ii runit-helper 2.8.15
ii ucf 3.0038+nmu1
ii zlib1g 1:1.2.11.dfsg-2

Versions of packages openssh-server recommends:
ii libpam-systemd [logind] 245.4-4
pn ncurses-term <none>
ii xauth 1:1.0.10-1

Versions of packages openssh-server suggests:
pn molly-guard <none>
pn monkeysphere <none>
ii ssh-askpass 1:1.2.4.1-10+b1
pn ufw <none>

-- debconf information excluded

--
.''`. martin f. krafft @martinkrafft
: :' : proud Debian developer
`. `'` http://people.debian.org/~madduck
`- Debian - when you have better things to do than fixing systems
digital_signature_gpg.asc
0 new messages