Bugzilla – Bug 1006221
command to remove outdated hostkey from known_hosts file wrong
Last modified: 2020-05-12 17:55:32 UTC
When a host with a non-default port is in the ~/.ssh/known_hosts file then the suggested command to remove it does not work. For example, if known_hosts contains: [192.168.42.129]:2222 ssh-rsa .... then connecting with an outdated hostkey gives something like: Offending ECDSA key in /home/user/.ssh/known_hosts:440 You can use following command to remove all keys for this IP: ssh-keygen -R 192.168.42.129 -f /home/user/.ssh/known_hosts but that command doesn't do the right thing; it removes the entry for the hostkey on the default port 22, not on port 2222. The correct command to suggest would have been: ssh-keygen -R [192.168.42.129]:2222 -f /home/user/.ssh/known_hosts This is a resubmission of the upstream bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2169 which was rightly resolved as INVALID because the bug actually comes from a SUSE-specific patch: https://build.opensuse.org/package/view_file/openSUSE:Leap:42.2/openssh/openssh-7.2p2-host_ident.patch?expand=1 The original source can be viewed here: https://github.com/openssh/openssh-portable/blob/00df97ff68a49a756d4b977cd02283690f5dfa34/sshconnect.c#L1089
I'm wondering whether we shouldn't get rid of this at all...
It's a helpful UI enhancement, so why not fix it instead of get rid of it? But it would be better if it was merged upstream ...
It is, but producing a message depending on whether the port is standard 22 or something else will just inflate it. Mentioning the ssh-keygen(1) man page should be enough, imho.
(In reply to Petr Cerny from comment #3) > It is, but producing a message depending on whether the port is standard 22 > or something else will just inflate it. It will inflate what? It would hardly be a huge inflation to the source code. > Mentioning the ssh-keygen(1) man page should be enough, imho. Surely that's not as helpful as providing a command they can use directly via cut and paste?
(In reply to Adam Spiers from comment #4) > (In reply to Petr Cerny from comment #3) > > It is, but producing a message depending on whether the port is standard 22 > > or something else will just inflate it. > > It will inflate what? It would hardly be a huge inflation to the source > code. I was afraid it would inflate the patch by adding reverse logic to ssh-keygen argument parsing. Fortunately it didn't turn out to be the case, so it will be fixed in the next MU. > > Mentioning the ssh-keygen(1) man page should be enough, imho. > > Surely that's not as helpful as providing a command they can use directly > via cut and paste? Yes, yet it also makes one more thing to think of when ssh-keygen behaviour changes, thus making it prone to rotting.
(In reply to Petr Cerny from comment #5) > (In reply to Adam Spiers from comment #4) > > It will inflate what? It would hardly be a huge inflation to the source > > code. > > I was afraid it would inflate the patch by adding reverse logic to > ssh-keygen argument parsing. Ah, OK. > Fortunately it didn't turn out to be the case, > so it will be fixed in the next MU. Great, thanks! > > > Mentioning the ssh-keygen(1) man page should be enough, imho. > > > > Surely that's not as helpful as providing a command they can use directly > > via cut and paste? > > Yes, yet it also makes one more thing to think of when ssh-keygen behaviour > changes, thus making it prone to rotting. Yeah, that's true. Hopefully low risk though :)
An update workflow for this issue was started. This issue was rated as moderate. Please submit fixed packages until 2017-01-25. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/63339
SUSE-SU-2017:0264-1: An update that solves 5 vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 1005480,1005893,1006221,1016366,1016368,1016369,1016370 CVE References: CVE-2016-10009,CVE-2016-10010,CVE-2016-10011,CVE-2016-10012,CVE-2016-8858 Sources used: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): openssh-7.2p2-66.1, openssh-askpass-gnome-7.2p2-66.3 SUSE Linux Enterprise Server 12-SP2 (src): openssh-7.2p2-66.1, openssh-askpass-gnome-7.2p2-66.3 SUSE Linux Enterprise Desktop 12-SP2 (src): openssh-7.2p2-66.1, openssh-askpass-gnome-7.2p2-66.3
openSUSE-SU-2017:0344-1: An update that solves 5 vulnerabilities and has three fixes is now available. Category: security (moderate) Bug References: 1005480,1005893,1006221,1016366,1016368,1016369,1016370,1021626 CVE References: CVE-2016-10009,CVE-2016-10010,CVE-2016-10011,CVE-2016-10012,CVE-2016-8858 Sources used: openSUSE Leap 42.2 (src): openssh-7.2p2-9.1, openssh-askpass-gnome-7.2p2-9.1
SUSE-SU-2017:0603-1: An update that solves three vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 1005480,1005893,1006221,1016366,1016369 CVE References: CVE-2016-10009,CVE-2016-10011,CVE-2016-8858 Sources used: SUSE Linux Enterprise Server 11-SP4 (src): openssh-6.6p1-35.1, openssh-askpass-gnome-6.6p1-35.4 SUSE Linux Enterprise Debuginfo 11-SP4 (src): openssh-6.6p1-35.1, openssh-askpass-gnome-6.6p1-35.4
SUSE-SU-2017:0607-1: An update that solves three vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 1005480,1005893,1006221,1016366,1016369 CVE References: CVE-2016-10009,CVE-2016-10011,CVE-2016-8858 Sources used: SUSE Linux Enterprise Server 12-SP1 (src): openssh-6.6p1-54.7.1, openssh-askpass-gnome-6.6p1-54.7.1
SUSE-SU-2017:0607-2: An update that solves three vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 1005480,1005893,1006221,1016366,1016369 CVE References: CVE-2016-10009,CVE-2016-10011,CVE-2016-8858 Sources used: SUSE Linux Enterprise Server for SAP 12 (src): openssh-6.6p1-54.7.1, openssh-askpass-gnome-6.6p1-54.7.1 SUSE Linux Enterprise Server 12-SP1 (src): openssh-6.6p1-54.7.1, openssh-askpass-gnome-6.6p1-54.7.1 SUSE Linux Enterprise Desktop 12-SP1 (src): openssh-6.6p1-54.7.1, openssh-askpass-gnome-6.6p1-54.7.1
SUSE-SU-2017:0607-3: An update that solves three vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 1005480,1005893,1006221,1016366,1016369 CVE References: CVE-2016-10009,CVE-2016-10011,CVE-2016-8858 Sources used: SUSE Linux Enterprise Server 12-LTSS (src): openssh-6.6p1-54.7.1, openssh-askpass-gnome-6.6p1-54.7.1
openSUSE-SU-2017:0674-1: An update that solves three vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 1005480,1005893,1006221,1016366,1016369 CVE References: CVE-2016-10009,CVE-2016-10011,CVE-2016-8858 Sources used: openSUSE Leap 42.1 (src): openssh-6.6p1-17.1, openssh-askpass-gnome-6.6p1-17.1
SUSE-SU-2017:1661-1: An update that solves three vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 1005480,1005893,1006221,1016366,1016369 CVE References: CVE-2016-10009,CVE-2016-10011,CVE-2016-8858 Sources used: SUSE Linux Enterprise Server 11-SECURITY (src): openssh-openssl1-6.6p1-18.1
This is automated batch bugzilla cleanup. The openSUSE 42.2 changed to end-of-life (EOL [1]) status. As such it is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of openSUSE, or you can still observe it under openSUSE Leap 15.0, please feel free to reopen this bug against that version (see the "Version" component in the bug fields), or alternatively open a new ticket. Thank you for reporting this bug and we are sorry it could not be fixed during the lifetime of the release. [1] https://en.opensuse.org/Lifetime