Debian Bug report logs - #152545
problems with X11 forwarding when using IPv6

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Andre Grueneberg <andre@grueneberg.de>

To: submit@bugs.debian.org

Subject: problems with X11 forwarding when using IPv6

Date: Wed, 10 Jul 2002 21:32:17 +0200

Package: ssh
Version: 3.4p1-1
Severity: minor

When using IPv6 by starting sshd with -6 parameter, it binds to
ip6-localhost:601x and advertises DISPLAY=localhost:1x.0

Using 'X11UseLocalhost no' "helps", but this is really a bug.
sshd should bind to ipv4 localhost:601x for X11 forwarding.

Andre
-- 
Hypochondria is the only disease I haven't got.

Message #16 received at 152545@bugs.debian.org (full text, mbox, reply):

From: Elliott Mitchell <ehem@m5p.com>

To: 152545@bugs.debian.org

Subject: Looks like libc6

Date: Sat, 17 Aug 2002 18:34:28 -0700 (PDT)

I believe this is a (Debian?) libc6 problem, not an OpenSSH problem. In
channels.c:x11_create_display_inet(), there is a call to getaddrinfo().
Debian's libc is returning only a single record for ::1 when AI_PASSIVE
is cleared, rather than returning a record for ::1, and a record for
127.0.0.1. As a natural result sshd only binds to the port on
ip6-localhost, missing localhost (Debian's default /etc/hosts also
incorrectly has localhost only pointing at the IPv4 record).

I feel setting DISPLAY to ip6-localhost:<dispnum> is the correct
workaround; however, due to xlibs bug #153075 this fails.

Obtaining USAGI(http://www.linux-ipv6.org)'s libinet6.so and using
LD_PRELOAD /should/ also work around this, but I've been unable to locate
the appropriate .so/package on their FTP server.

Also see OpenSSH bug #164.


The already suggested patch /should/ work, however I *strongly* recommend
against using it! /Perhaps/ it is not as bad a hack as the one mentioned
in #130303, however its nasty.

Also note that this is in fact a minor security hole. A person could bind
to 127.0.0.1 ports 6010-6063, and do a MitM attack against all X clients.
Or a DoS, or...


--
|\__/|\__/|\______          --=> 8-) EHM <=--          ______/|\__/|\__/|
\    |    |       | EHeM@gremlin.m5p.com PGP 8881EF59 |       |    |    /
  \   \   | ______| -O #include <stddisclaimer.h> O-  |______ |   /   /
    \___\_|/82 04 A1 3C C7 B1 37 2A   E3 6E 84 DA 97 4C 40 E6\|_/___/

Message #23 received at 152545@bugs.debian.org (full text, mbox, reply):

From: Lionel Elie Mamane <lionel@mamane.lu>

To: Debian Bug Tracking System <152545@bugs.debian.org>

Subject: ssh: Works for me now...

Date: Mon, 7 Apr 2003 09:17:04 +0200

Followup-For: Bug #152545
Package: ssh
Version: 1:3.6.1p1-1

With the new 3.6.1p1-1, you can now not use -6, and still connect over
and use IPv6. In this case, ssh will listen on both localhost and
ip6-localhost for the X forwarding. At least that's what happens for
me.

-- System Information
Debian Release: 3.0
Architecture: i386
Kernel: Linux tofu 2.4.20-usagi #1 lun mar 31 17:18:21 CEST 2003 i686
Locale: LANG=fr_LU@euro, LC_CTYPE=fr_LU@euro

Versions of packages ssh depends on:
ii  adduser                       3.47       Add and remove users and groups
ii  debconf                       1.0.32     Debian configuration management sy
ii  libc6                         2.3.1-16   GNU C Library: Shared libraries an
ii  libpam-modules                0.72-35    Pluggable Authentication Modules f
ii  libpam0g                      0.76-9     Pluggable Authentication Modules l
ii  libssl0.9.7                   0.9.7a-1   SSL shared libraries
ii  libwrap0                      7.6-9      Wietse Venema's TCP wrappers libra
ii  zlib1g                        1:1.1.4-1  compression library - runtime

Message #28 received at 153154-done@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: Darren Tucker <dtucker@zip.com.au>, 153154-done@bugs.debian.org

Subject: Re: Bug#153154: Debian bug #153154: ssh: X11 display forwarding is broken when ipV6 is enabled

Date: Thu, 20 May 2004 14:16:55 +0100

On Mon, May 10, 2004 at 04:40:16PM +1000, Darren Tucker wrote:
> 	This bug is believed fixed (some time ago) and the upstream bug is 
> 	now closed.

Yes, that's my belief too from my own systems. Closing, thanks.

-- 
Colin Watson                                  [cjwatson@flatline.org.uk]

Send a report that this bug log contains spam.