Bug 1224392 - zypper dup installs openssh-server-config-rootlogin which allows ssh login with password
Summary: zypper dup installs openssh-server-config-rootlogin which allows ssh login wi...
Status: IN_PROGRESS
: 1224397 (view as bug list)
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Security (show other bugs)
Version: Current
Hardware: Other Other
: P1 - Urgent : Normal (vote)
Target Milestone: ---
Assignee: Security Team bot
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-05-16 22:33 UTC by Christian Boltz
Modified: 2024-07-17 12:41 UTC (History)
6 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Christian Boltz 2024-05-16 22:33:38 UTC
Today's zypper dup installs the additional package openssh-server-config-rootlogin which allows ssh login with password:

# rpm -ql openssh-server-config-rootlogin
/usr/etc/ssh/sshd_config.d/50-permit-root-login.conf
# cat /usr/etc/ssh/sshd_config.d/50-permit-root-login.conf
PermitRootLogin yes

Installation of this package is probably triggered by a Recommends:

# rpm -q --recommends openssh-server
audit
openssh-server-config-rootlogin

# rpm -q --changelog openssh-server
* Mo Mai 13 2024 Antonio Larrosa <alarrosa@suse.com>
- Only for SLE15, restore the patch file removed in
  Thu Feb 18 13:54:44 UTC 2021 to restore the previous behaviour
  from SP5 of having root password login allowed by default
  (fixes bsc#1223486, related to bsc#1173067):
  * openssh-7.7p1-allow_root_password_login.patch
- Since the default value for this config option is now set to
  permit root to use password logins in SLE15, the
  openssh-server-config-rootlogin subpackage isn't useful there so
  we now create an openssh-server-config-disallow-rootlogin
  subpackage that sets the configuration the other way around
  than openssh-server-config-rootlogin.

The changelog and both mentioned bugreports say that this change should be only applied to SLES/Leap 15.x - but nevertheless, it also was applied on Tumbleweed (which should prefer more secure defaults over historical settings).

Please make sure that Tumbleweed restricts ssh root logins - either completely forbid them by default, or at least restrict them to key-only.
Comment 1 pragma- 2024-05-17 01:59:13 UTC
Indeed. Today I was extremely startled to see openssh-server-config-rootlogin being recommended by openssh-server. Upon investigation I discovered this patch: https://build.opensuse.org/request/show/1173885

This seems like a mistake. I don't think anybody would want password root logins enabled by default. In the meantime, I've now done `zypper add-lock openssh-server-config-rootlogin` to prevent this package from ever being installed.
Comment 2 pragma- 2024-05-17 02:06:42 UTC
I am on Tumbleweed, by the way.
Comment 3 Ana Guerrero 2024-05-17 07:39:15 UTC
*** Bug 1224397 has been marked as a duplicate of this bug. ***
Comment 4 Dominique Leuenberger 2024-05-17 08:08:55 UTC
https://build.opensuse.org/package/rdiff/openSUSE:Factory/openssh?linkrev=base&rev=176

I have reverted openssh in openSUSE:Factory and released that reverted version into the :Update channel.

People that skipped the dup for a day are safe - the others will need to clean this up unfortunately (we can't just remove the package, as some users might have it pre-installed intentionally before already)
Comment 5 Antonio Larrosa 2024-05-17 08:13:22 UTC
I'm sorry, this was my fault when replacing (wrongly) the condition for recommending the package, which I should have removed instead. 

Dominique already reverted the openssh change in TW so the openssh-server-config-rootlogin is not recommended anymore . I also submitted a fix now in https://build.opensuse.org/request/show/1174781 and it seems it will be included in the next TW release, which should happen today.
Comment 6 Andreas Stieger 2024-05-18 01:12:49 UTC
*** Bug 1224446 has been marked as a duplicate of this bug. ***
Comment 7 Andreas Stieger 2024-05-18 01:16:32 UTC
A user noted (Bug 1224446) that his also affects openSUSE Leap 15.6 RCs and requested for an equivalent change SUSE:SLE-15-SP6:GA/openssh
Comment 8 Dirk Weber 2024-05-18 04:42:58 UTC
(In reply to Andreas Stieger from comment #7)
> A user noted (Bug 1224446) that his also affects openSUSE Leap 15.6 RCs and
> requested for an equivalent change SUSE:SLE-15-SP6:GA/openssh

If for some reasons it is really desired to
PermitRootLogin yes
for SLES/Leap 15.x I think there should be a big obvious announcement or warning in the release notes with the hint to lock the package on systems where this is not wanted prior to the upgrade.

I already added locking the package to my pre-upgrade checklist.
Comment 9 Dirk Weber 2024-05-18 16:16:39 UTC
(In reply to Dirk Weber from comment #8)
> (In reply to Andreas Stieger from comment #7)
> I already added locking the package to my pre-upgrade checklist.

Probably locking the package is not a sufficient approach.

Creating something like an
/etc/ssh/sshd_config.d/00_localsettings.conf
containing 
PermitRootLogin no

and other settings which should not be overwritten by distribution defaults might be better.
Comment 10 Dirk Weber 2024-05-19 07:01:29 UTC
(In reply to Dirk Weber from comment #9)
> (In reply to Dirk Weber from comment #8)
> > (In reply to Andreas Stieger from comment #7)
> Creating something like an
> /etc/ssh/sshd_config.d/00_localsettings.conf
> containing 
> PermitRootLogin no


I did another upgrade test of Leap 15.5 -> Leap 15.6 RC.

This time the 15.5 system prior to the upgrade
had a modified
/etc/ssh/sshd_config
file, containing
PermitRootLogin no

This file is preserved during rpm installation and the new
config is created as 
sshd_config.rpmnew

As the preserved sshd_config does not 
Include /etc/ssh/sshd_config.d/*.conf

/etc/ssh/sshd_config.d/50-permit-root-login.conf
is harmless and when doing the post upgrade
cleanup of rpmnew files these configurations can be handled properly 
by moving the previous local modifications to an
/etc/ssh/sshd_config.d/*.conf file and there is no
security problem created by the upgrade.

I still see a possible problem:
the new
/etc/ssh/sshd_config[.rpmnew] file contains the paragraph:

# To modify the system-wide sshd configuration, create a "*.conf" file under
# "/etc/ssh/sshd_config.d/" which will be automatically included below.
# Don't edit this configuration file itself if possible to avoid update
# problems.
Include /etc/ssh/sshd_config.d/*.conf

This does not mention that these *.conf files are read in
alphabetic order and that the first appearance of a setting will be
used.
If a user creates a 
/etc/ssh/sshd_config.d/local.conf
containing 
PermitRootLogin no
then the file
/etc/ssh/sshd_config.d/50-permit-root-login.conf
will take precedence.

The new /etc/ssh/sshd_config[.rpmnew] also includes
/usr/etc/ssh/sshd_config.d/*.conf:

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.
Include /usr/etc/ssh/sshd_config.d/*.conf

Therefore I would suggest that the distribution does not put conf files into 
/etc/ssh/sshd_config.d/ at all but into /usr/etc/ssh/sshd_config.d/ which is included after /etc/ssh/sshd_config.d/ and therefore will not overwrite user defined settings from /etc/ssh/sshd_config.d/.

Or conf files put by the distribution into /etc/ssh/sshd_config.d/ should at least always have names starting with
zz, e.g. zz_-permit-root-login.conf, in order
to avoid overwriting user defined settings.
Comment 11 Antonio Larrosa 2024-05-21 06:47:15 UTC
Please note that the SLE/Leap case is something different from this issue, but since boo#1224446 was already marked as a duplicate (incorrectly, IMHO) I'll just comment here.

In SLE/Leap openssh has changed the default value for PermitRootLogin since SLE-12 times (this has been documented). PermitRootLogin was also set to "yes" in the configuration so that it was clear to anyone reading sshd_config that it was set to allow root to do a password login.

For SP6, I tried to make the package more similar to the TW package. This means in SP6 we can use the /etc/ssh/sshd_config.d directory structure for configuration snippets and so I removed the PermitRootLogin default value change and made it use a openssh-server-config-rootlogin package like in TW. But in the SLE/Leap case, instead of just offering it, it was recommended in order to not change the behaviour from previous SLE-15 releases. Please consider that some users expect and rely on being allowed to log in as root as they've been doing for years, and we absolutely don't want to break their systems.

This was released like that in the PublicRC but then we found that it broke in the case of users having recommended packages disabled and upgrading from SP5 to SP6. In those situations a system that allowed root to do a password logins stopped allowing that after upgrading to SP6 which is a behaviour change we MUST avoid, so we had to go back to the old solution of changing the default PermitRootLogin value in sshd_config and we're now providing a openssh-server-config-disallow-rootlogin package that users can install to disable root password logins (the package drops a file in /etc/ssh/sshd_config.d with "PermitRootLogin prohibit-password"). Note that openssh-server-config-rootlogin is no longer provided in SLE/Leap.
Comment 17 Maintenance Automation 2024-07-10 16:30:03 UTC
SUSE-SU-2024:2393-1: An update that solves two vulnerabilities and has three security fixes can now be installed.

Category: security (moderate)
Bug References: 1218215, 1224392, 1225904, 1227318, 1227350
CVE References: CVE-2023-51385, CVE-2024-39894
Maintenance Incident: [SUSE:Maintenance:34681](https://smelt.suse.de/incident/34681/)
Sources used:
openSUSE Leap 15.6 (src):
 openssh-askpass-gnome-9.6p1-150600.6.6.1, openssh-9.6p1-150600.6.6.1
Basesystem Module 15-SP6 (src):
 openssh-9.6p1-150600.6.6.1
Desktop Applications Module 15-SP6 (src):
 openssh-askpass-gnome-9.6p1-150600.6.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.