Merge ~kstenerud/ubuntu/+source/openssh:xenial-sshd-reload-1771340 into ubuntu/+source/openssh:ubuntu/xenial-devel

[Karl Stenerud]

Copied existing debian fix from https://salsa.debian.org/ssh-team/openssh/commit/d4181e15b03171d1363cd9d7a50b209697a80b01 to check sshd_config for errors before starting or reloading the service.

PPA: ppa:kstenerud/sshd-reload-1771340

Steps to Test
-------------

$ lxc launch ubuntu:xenial tester
$ lxc exec tester bash

# echo "blah blah" >>/etc/ssh/sshd_config
# systemctl reload sshd
Job for ssh.service failed because the control process exited with error code. See "systemctl status ssh.service" and "journalctl -xe" for details.
# systemctl status ssh.service
● ssh.service - OpenBSD Secure Shell server
   Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Tue 2018-08-21 18:15:41 UTC; 19s ago

* The service should have checked the config file, failed to reload, but remained active in its current configuration. Instead it's now in the failed state.

Remove the last line "blah blah" in /etc/ssh/sshd_config, then:

# systemctl start sshd
# add-apt-repository -y ppa:kstenerud/sshd-reload-1771340
# apt update
# apt upgrade -y
# echo "blah blah" >>/etc/ssh/sshd_config
# systemctl reload sshd
Job for ssh.service failed because the control process exited with error code. See "systemctl status ssh.service" and "journalctl -xe" for details.
# systemctl status ssh.service
● ssh.service - OpenBSD Secure Shell server
   Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)
   Active: active (running) (Result: exit-code) since Tue 2018-08-21 18:39:03 UTC; 31s ago

* Service is active (running), which is as it should be.

Package Test Results
--------------------

autopkgtest [13:45:46]: test regress: -----------------------]
autopkgtest [13:45:47]: test regress: - - - - - - - - - - results - - - - - - - - - -
regress PASS
autopkgtest [13:45:47]: @@@@@@@@@@@@@@@@@@@@ summary
regress PASS

[Andreas Hasenack (ahasenack)]

Some comments inline.

review: Needs Fixing

4248756... by Karl Stenerud on 2018-08-21

        * debian/systemd/ssh.service: Test configuration before starting or
          reloading sshd (LP: #1771340)

[Karl Stenerud (kstenerud)]

> Some comments inline.

Replaced with clean commits.

5c1b475... by Karl Stenerud on 2018-08-21

changelog

[Andreas Hasenack (ahasenack)]

looks good!

review: Approve

[Christian Ehrhardt  (paelzer)]

Ack and:
To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/openssh
 * [new tag] upload/1%7.2p2-4ubuntu2.5 -> upload/1%7.2p2-4ubuntu2.5

Let me know this is supposed to be uploaded as-is or if there are any last minute things to consider.

[Karl Stenerud (kstenerud)]

Yes, it's ready for upload

[Christian Ehrhardt  (paelzer)]

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading openssh_7.2p2-4ubuntu2.5.dsc: done.
  Uploading openssh_7.2p2-4ubuntu2.5.debian.tar.xz: done.
  Uploading openssh_7.2p2-4ubuntu2.5_source.buildinfo: done.
  Uploading openssh_7.2p2-4ubuntu2.5_source.changes: done.
Successfully uploaded packages.

review: Approve

[Christian Ehrhardt  (paelzer)]

Please set to merged once accepted by the SRU Team.

[Christian Ehrhardt  (paelzer)]

Setting to approved, to get it out of the overview page.
As mentioned before when accepted by the SRU team please set this to merged.

[Christian Ehrhardt  (paelzer)]

arrived in proposed, please verify

diff --git a/debian/changelog b/debian/changelog
index fdfdd8c..bbb67a2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openssh (1:7.2p2-4ubuntu2.5) xenial; urgency=medium
+
+  * debian/systemd/ssh.service: Test configuration before starting or
+    reloading sshd (LP: #1771340)
+
+ -- Karl Stenerud <[e-mail]>  Tue, 21 Aug 2018 10:45:26 -0700
+
 openssh (1:7.2p2-4ubuntu2.4) xenial-security; urgency=medium
 
   * SECURITY UPDATE: untrusted search path when loading PKCS#11 modules
diff --git a/debian/systemd/ssh.service b/debian/systemd/ssh.service
index 3df8c64..c75e590 100644
--- a/debian/systemd/ssh.service
+++ b/debian/systemd/ssh.service
@@ -5,7 +5,9 @@ ConditionPathExists=!/etc/ssh/sshd_not_to_be_run
 
 [Service]
 EnvironmentFile=-/etc/default/ssh
+ExecStartPre=/usr/sbin/sshd -t
 ExecStart=/usr/sbin/sshd -D $SSHD_OPTS
+ExecReload=/usr/sbin/sshd -t
 ExecReload=/bin/kill -HUP $MAINPID
 KillMode=process
 Restart=on-failure