Debian Bug report logs - #954965
/etc/ssh/ssh_config: ssh_config: Include custom config files at the end, so they can overwrite the default settings

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jan <bug-reporter@tuta.io>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: /etc/ssh/ssh_config: ssh_config: Include custom config files at the end, so they can overwrite the default settings

Date: Wed, 25 Mar 2020 22:33:20 +0100

Package: openssh-client
Version: 1:8.2p1-4
Severity: normal
File: /etc/ssh/ssh_config

Dear Maintainer,

/etc/ssh/ssh_config now includes /etc/ssh/ssh_config.d/*.conf but does so
at the beginning. Thus custom config files cannot overwrite the default
options, all of which are set afterwards.

Moving the include to the end of /etc/ssh/ssh_config solves this problem.


-- System Information:
Debian Release: bullseye/sid
  APT prefers testing-proposed-updates
  APT policy: (500, 'testing-proposed-updates'), (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.4.0-4-amd64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages openssh-client depends on:
ii  adduser           3.118
ii  dpkg              1.19.7
ii  libc6             2.30-2
ii  libedit2          3.1-20191231-1
ii  libfido2-1        1.3.1-1
ii  libgssapi-krb5-2  1.17-6
ii  libselinux1       3.0-1+b1
ii  libssl1.1         1.1.1d-2
ii  passwd            1:4.8.1-1
ii  zlib1g            1:1.2.11.dfsg-2

Versions of packages openssh-client recommends:
ii  xauth  1:1.0.10-1

Versions of packages openssh-client suggests:
pn  keychain                   <none>
ii  ksshaskpass [ssh-askpass]  4:5.17.5-2
pn  libpam-ssh                 <none>
pn  monkeysphere               <none>

-- Configuration Files:
/etc/ssh/ssh_config changed:
Host *
    SendEnv LANG LC_*
    HashKnownHosts yes
    GSSAPIAuthentication yes
Include /etc/ssh/ssh_config.d/*.conf


-- no debconf information

Message #10 received at 954965@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: Jan <bug-reporter@tuta.io>, 954965@bugs.debian.org

Subject: Re: Bug#954965: /etc/ssh/ssh_config: ssh_config: Include custom config files at the end, so they can overwrite the default settings

Date: Wed, 25 Mar 2020 22:07:30 +0000

On Wed, Mar 25, 2020 at 10:33:20PM +0100, Jan wrote:
> /etc/ssh/ssh_config now includes /etc/ssh/ssh_config.d/*.conf but does so
> at the beginning. Thus custom config files cannot overwrite the default
> options, all of which are set afterwards.

But, as ssh_config(5) says, "the first obtained value for each parameter
is used".  I tested this and confirmed that it was possible to use files
in /etc/ssh/ssh_config.d/*.conf to override default options in
/etc/ssh/ssh_config.

What tests did you perform?

-- 
Colin Watson                                       [cjwatson@debian.org]

Message #15 received at 954965@bugs.debian.org (full text, mbox, reply):

From: Jan <bug-reporter@tuta.io>

To: Colin Watson <cjwatson@debian.org>

Cc: 954965@bugs.debian.org

Subject: Re: Bug#954965: /etc/ssh/ssh_config: ssh_config: Include custom config files at the end, so they can overwrite the default settings

Date: Thu, 26 Mar 2020 16:54:05 +0100 (CET)

Mar 25, 2020, 23:07 by cjwatson@debian.org:

> On Wed, Mar 25, 2020 at 10:33:20PM +0100, Jan wrote:
>
>> /etc/ssh/ssh_config now includes /etc/ssh/ssh_config.d/*.conf but does so
>> at the beginning. Thus custom config files cannot overwrite the default
>> options, all of which are set afterwards.
>>
> But, as ssh_config(5) says, "the first obtained value for each parameter
> is used".
>
I have to admit that I missed that. Even more embarrassing as it's also state in the beginning of  /etc/ssh/ssh_config. It does not apply in my case though, see below.


> I tested this and confirmed that it was possible to use files
> in /etc/ssh/ssh_config.d/*.conf to override default options in
> /etc/ssh/ssh_config.
>
> What tests did you perform?
>
I want to avoid sending any environment, but /etc/ssh/ssh_config has

| SendEnv LANG LC_*

So I originally put

| Host *
|     SendEnv -LANG -LC_*
into /etc/ssh/ssh_config.d/no_env.conf. It works when I included that file at the very end of /etc/ssh/ssh_config. Just setting SendEnv at the beginning (via included files) does not help because this option has append semantics and the prepended dash only remove entries that already exist.


Regards, Jan

Message #18 received at 954965@bugs.debian.org (full text, mbox, reply):

From: martin f krafft <madduck@debian.org>

To: Debian Bug Tracking System <954965@bugs.debian.org>

Subject: Re: /etc/ssh/ssh_config: ssh_config: Include custom config files at the end, so they can overwrite the default settings

Date: Fri, 17 Apr 2020 14:13:49 +1200

[Message part 1 (text/plain, inline)]

Package: openssh-server
Version: 1:8.2p1-4
Followup-For: Bug #954965

Just wanted to chime in to say that

1. I can confirm that the config works as intended,

2. The debug output is really quite confusing in this regard:

   ```
   debug3: /etc/ssh/sshd_config.d/no-xforwarding.conf:1 setting X11Forwarding no
   […]
   debug3: /etc/ssh/sshd_config:91 setting X11Forwarding yes
   ```

   This clearly suggests that X11Forwarding is being turned on 
   again.

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.5.0-rc5-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_NZ, LC_CTYPE=en_NZ.UTF-8 (charmap=UTF-8), LANGUAGE=en_NZ:en (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages openssh-server depends on:
ii  adduser                3.118
ii  debconf [debconf-2.0]  1.5.73
ii  dpkg                   1.19.7
ii  libaudit1              1:2.8.5-3+b1
ii  libc6                  2.30-4
ii  libcom-err2            1.45.6-1
ii  libcrypt1              1:4.4.16-1
ii  libgssapi-krb5-2       1.17-7
ii  libkrb5-3              1.17-7
ii  libpam-modules         1.3.1-5
ii  libpam-runtime         1.3.1-5
ii  libpam0g               1.3.1-5
ii  libselinux1            3.0-1+b3
ii  libssl1.1              1.1.1f-1
ii  libsystemd0            245.4-4
ii  libwrap0               7.6.q-30
ii  lsb-base               11.1.0
ii  openssh-client         1:8.2p1-4
ii  openssh-sftp-server    1:8.2p1-4
ii  procps                 2:3.3.16-4
ii  runit-helper           2.8.15
ii  ucf                    3.0038+nmu1
ii  zlib1g                 1:1.2.11.dfsg-2

Versions of packages openssh-server recommends:
ii  libpam-systemd [logind]  245.4-4
pn  ncurses-term             <none>
ii  xauth                    1:1.0.10-1

Versions of packages openssh-server suggests:
pn  molly-guard   <none>
pn  monkeysphere  <none>
ii  ssh-askpass   1:1.2.4.1-10+b1
pn  ufw           <none>

-- debconf information excluded


-- 
 .''`.   martin f. krafft <madduck@d.o> @martinkrafft
: :'  :  proud Debian developer
`. `'`   http://people.debian.org/~madduck
  `-  Debian - when you have better things to do than fixing systems

[Message part 2 (text/html, inline)]

[digital_signature_gpg.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.