Skip to content
This repository has been archived by the owner on May 30, 2023. It is now read-only.

net-misc/openssh: Sync with Gentoo upstream; updates to openssh 8.8_p1 #1344

Merged
merged 5 commits into from
Dec 9, 2021
Merged

net-misc/openssh: Sync with Gentoo upstream; updates to openssh 8.8_p1 #1344

merged 5 commits into from
Dec 9, 2021

Conversation

sayanchowdhury
Copy link
Contributor

@sayanchowdhury sayanchowdhury commented Oct 12, 2021 •
edited by dongsupark
Loading

net-misc/openssh: Sync with Gentoo upstream; updates to openssh 8.8_p1

Fixes CVE-2021-41617

Pulls in flatcar/init#54.

How to use

emerge-amd64-usr net-misc/openssh

Testing done

CI passed: http://jenkins.infra.kinvolk.io:8080/job/os/job/manifest/4343/cldsv

@sayanchowdhury sayanchowdhury requested a review from a team October 12, 2021 07:15
@dongsupark
Copy link
Contributor

Thanks for working on that.
We should be a little more careful when testing openssh 8.8, as ssh-rsa/sha1 is disabled by default.
See also https://www.gentoo.org/support/news-items/2021-10-08-openssh-rsa-sha1.html .

@dongsupark
Copy link
Contributor

FYI, Gentoo's openssh was updated to 8.8_p1-r1 to enable X509 USE flag.
https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e63d106c6300869b5926856c1e50097ffdb8c7b9

@sayanchowdhury sayanchowdhury force-pushed the sayan/update-openssh-8.8 branch from ec6a97b to 37c2074 Compare October 27, 2021 09:59
@dongsupark
Copy link
Contributor

FYI, a rebase is needed

@sayanchowdhury sayanchowdhury force-pushed the sayan/update-openssh-8.8 branch 2 times, most recently from 43fcc6a to 0c90995 Compare November 5, 2021 11:06
@dongsupark dongsupark force-pushed the sayan/update-openssh-8.8 branch from 0c90995 to 5b02ff8 Compare December 6, 2021 17:00
@dongsupark dongsupark changed the title net-misc/openssh: Sync with Gentoo upstream; updates to openssh 8.8_p1 net-misc/openssh: Sync with Gentoo upstream; updates to openssh 8.8_p3 Dec 6, 2021
@dongsupark
Copy link
Contributor

Rebased, and updated the version to 8.8_p3.

@dongsupark
Copy link
Contributor

dongsupark commented Dec 7, 2021 •
edited
Loading

CI fails always like:

not ok - cl.update.payload
  ---
  Error: "harness.go:535: Cluster failed starting machines: machine \"928c35d4-aaae-4be3-ad10-c751709537da\" failed to start: ssh journalctl failed: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain"

@tormath1
Copy link
Contributor

tormath1 commented Dec 7, 2021

@dongsupark after looking a bit into the Mantle code, I think the issue is related to: golang/go#49952 as we can SSH into the instance with a regular OpenSSH client (tried locally with net-misc/openssh-8.6_p1-r2)

@dongsupark
Copy link
Contributor

@tormath1 Thanks for finding the tracking issue.
It looks like we should wait for Go 1.18.
Set the status to Long Term / Blocked.

@tormath1
Copy link
Contributor

tormath1 commented Dec 8, 2021

@dongsupark in the meantime, what do you think about adding the following1 to the sshd_config:

HostkeyAlgorithms +ssh-rsa
PubkeyAcceptedAlgorithms +ssh-rsa

I tried locally, it seems to work.

It would allow us to ship openssh 8.8_p3 and to prevent breakage for user having the same kind of issue we're having with the CI ? In the next release or after, we could start to deprecate ssh-rsa algorithm.

Footnotes

  1. https://www.gentoo.org/support/news-items/2021-10-08-openssh-rsa-sha1.html ↩

@dongsupark
Copy link
Contributor

Yeah, that makes sense.
Will soon add the configs to sshd_config, and start another CI build.

@dongsupark
Copy link
Contributor

CI passed with an additional fix flatcar/init#54. 🎉

@dongsupark dongsupark force-pushed the sayan/update-openssh-8.8 branch from 8bc144e to 98d4912 Compare December 9, 2021 09:11
@dongsupark
Copy link
Contributor

As flatcar/init#54 was merged, update CROS_WORKON_COMMIT of coreos-init.
Also added changelog for openssh 8.8.

@tormath1
Copy link
Contributor

tormath1 commented Dec 9, 2021

It looks good to me, just one thing in the Flatcar changes commit, I don't understand the following mention:

Instead of dropping bindist, enable it with the profiles now so it
doesn't need to be modified on future updates.

@dongsupark
Copy link
Contributor

Instead of dropping bindist, enable it with the profiles now so it
doesn't need to be modified on future updates.

I am not the person who wrote the commit message.
I suppose we can remove the message, because we do not touch bindist in that commit.
Will soon update the commit.

@dongsupark dongsupark force-pushed the sayan/update-openssh-8.8 branch from 98d4912 to ac595f6 Compare December 9, 2021 09:31
@sayanchowdhury
Copy link
Contributor Author

before leaving on the break; I was tracking this upstream issue but things were a bit scattered then, good they created a tracking issue now. I was looking into migrating to mantle ed25519 keys, until I realized that Azure does have support for them.

@dongsupark dongsupark force-pushed the sayan/update-openssh-8.8 branch from ac595f6 to dd95912 Compare December 9, 2021 11:34
tormath1
tormath1 approved these changes Dec 9, 2021
View reviewed changes
Copy link
Contributor

@tormath1 tormath1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit-pick in the commit title:

profiles: accept ~arm64, ~amd64 for openssh 8.8_p3

We could update "openssh 8.8_p3" to "openssh 8.8_p1" - otherwise it looks good to me, let's ship this 🚀

@dongsupark dongsupark changed the title net-misc/openssh: Sync with Gentoo upstream; updates to openssh 8.8_p3 net-misc/openssh: Sync with Gentoo upstream; updates to openssh 8.8_p1 Dec 9, 2021
dongsupark and others added 5 commits December 9, 2021 14:09
@dongsupark
net-misc/openssh: Sync with Gentoo upstream; updates to 8.8_p1
f4dbc37 
gentoo ref: gentoo/gentoo@91c1a70

Signed-off-by: Sayan Chowdhury <schowdhury@microsoft.com>
Signed-off-by: Dongsu Park <dpark@linux.microsoft.com>
@sayanchowdhury @dongsupark
profiles: accept ~arm64, ~amd64 for openssh 8.8_p1
392c3af 
Signed-off-by: Sayan Chowdhury <schowdhury@microsoft.com>
@sayanchowdhury @dongsupark
net-misc/openssh: Apply Flatcar patches
452af42 
- Drop the init.d files.
- Remove the socket unit's rate limiting.

Signed-off-by: Sayan Chowdhury <schowdhury@microsoft.com>
Signed-off-by: Dongsu Park <dpark@linux.microsoft.com>
@dongsupark
coreos-base/coreos-init: allow ssh-rsa in sshd_config
3094126 
Temporarily accept ssh-rsa algorithm in sshd_config for openssh >= 8.8,
until most ssh clients could deprecate ssh-rsa.

Pulls in flatcar/init#54 .
@dongsupark
changelog: add changelog for openssh 8.8
a372589
@dongsupark dongsupark force-pushed the sayan/update-openssh-8.8 branch from dd95912 to a372589 Compare December 9, 2021 13:10
@dongsupark
Copy link
Contributor

Fixed the title and commits. Thanks!

@dongsupark dongsupark merged commit e6dad8f into main Dec 9, 2021
@dongsupark dongsupark deleted the sayan/update-openssh-8.8 branch December 9, 2021 13:11
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@dongsupark dongsupark dongsupark left review comments

@tormath1 tormath1 tormath1 approved these changes

Assignees
No one assigned
Labels
main
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@sayanchowdhury @dongsupark @tormath1