[Bug 1668093] Update Released
Robie Basak
1668093 at bugs.launchpad.net
Wed May 10 16:24:09 UTC 2017
The verification of the Stable Release Update for openssh has completed
successfully and the package has now been released to -updates.
Subsequently, the Ubuntu Stable Release Updates Team is being
unsubscribed and will not receive messages about this bug report. In
the event that you encounter a regression using the package from
-updates please report a new bug using ubuntu-bug and tag the bug report
regression-update so we can easily find any regressions.
--
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1668093
Title:
ssh-keygen -H corrupts already hashed entries
Status in openssh package in Ubuntu:
Fix Released
Status in openssh source package in Xenial:
Fix Committed
Status in openssh source package in Yakkety:
Fix Released
Status in openssh package in Debian:
Fix Released
Bug description:
[Impact]
* re-execution of ssh-keygen -H can clobber known-hosts
* Due to that users might get spurious re-warnings of known systems. For Automation it might be worse as it might stop to work when re-executed.
* This is a regression from Trusty (working) to Xenial (fail) upgrade
due to an upstream bug in the versions we merged.
* This is a backport of the upstream fix
[Test Case]
* Pick a Host IP to scan keys from that you can reach and replies with SSH, then run the following trivial loop:
$ ssh-keyscan ${IP} > ~/.ssh/known_hosts; for i in $(seq 1 20); do ssh-keygen -H; diff -Naur ~/.ssh/known_hosts.old ~/.ssh/known_hosts; done
* Expected: no diff reported, since already hashed entries should be left as-is
* Without fix: - diff in the hashes
[Regression Potential]
* The fix is upstream and soon in Debian as well, so we are not
custom diverting here.
* The risk should be minimal as this only changes ssh-keygen so
despite openssh being really critical this doesn't affect ssh itself
at all.
[Other Info]
* n/a
---
xenial @ 1:7.2p2-4ubuntu2.1 on amd64 has this bug. trusty @
1:6.6p1-2ubuntu2.8 on amd64 does not have this bug. I have not tested
any other ssh versions.
The following should reproduce the issue:
#ssh-keyscan XXXX > ~/.ssh/known_hosts
# ssh root at XXXXX
Permission denied (publickey).
# ssh-keygen -H
/root/.ssh/known_hosts updated.
Original contents retained as /root/.ssh/known_hosts.old
WARNING: /root/.ssh/known_hosts.old contains unhashed entries
Delete this file to ensure privacy of hostnames
# ssh root at XXXXXX
Permission denied (publickey).
# ssh-keygen -H
/root/.ssh/known_hosts updated.
Original contents retained as /root/.ssh/known_hosts.old
WARNING: /root/.ssh/known_hosts.old contains unhashed entries
Delete this file to ensure privacy of hostnames
# ssh root at XXXXX
The authenticity of host 'XXXXXX' can't be established.
RSA key fingerprint is XXXXXX.
Are you sure you want to continue connecting (yes/no)?
# diff known_hosts.old known_hosts
1c1
< |1|BoAbRpUE3F5AzyprJcbjdepeDh8=|x/1AcaLxh45FlShmVQnlgx2qjxY= XXXXX
---
> |1|nTPsoLxCugQyZi3pqOa2pc/cX64=|bUH5qwZlZPp8msMGHdLtslf3Huk= XXXXX
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1668093/+subscriptions
More information about the Ubuntu-sponsors
mailing list