Merge ~michal-maloszewski99/ubuntu/+source/openssh:mantic-openssh-lp2031942 into ubuntu/+source/openssh:ubuntu/devel

[Michał Małoszewski]

PPA: https://launchpad.net/~michal-maloszewski99/+archive/ubuntu/ppa-openssh-mantic-lp2031942

[Michał Małoszewski (michal-maloszewski99)]

Results: (from http://autopkgtest.ubuntu.com/results/autopkgtest-mantic-michal-maloszewski99-ppa-openssh-mantic-lp2031942/?format=plain)
  openssh @ amd64:
    http://autopkgtest.ubuntu.com/results/autopkgtest-mantic-michal-maloszewski99-ppa-openssh-mantic-lp2031942/mantic/amd64/o/openssh/20230824_225956_6f57b@/log.gz
    24.08.23 22:59:56 ✅ Triggers: openssh/1:9.3p1-1ubuntu3~ppa1
  openssh @ arm64:
    http://autopkgtest.ubuntu.com/results/autopkgtest-mantic-michal-maloszewski99-ppa-openssh-mantic-lp2031942/mantic/arm64/o/openssh/20230824_233617_e1c56@/log.gz
    24.08.23 23:36:17 ✅ Triggers: openssh/1:9.3p1-1ubuntu3~ppa1
  openssh @ ppc64el:
    http://autopkgtest.ubuntu.com/results/autopkgtest-mantic-michal-maloszewski99-ppa-openssh-mantic-lp2031942/mantic/ppc64el/o/openssh/20230824_224848_b01f8@/log.gz
    24.08.23 22:48:48 ✅ Triggers: openssh/1:9.3p1-1ubuntu3~ppa1
  openssh @ s390x:
    http://autopkgtest.ubuntu.com/results/autopkgtest-mantic-michal-maloszewski99-ppa-openssh-mantic-lp2031942/mantic/s390x/o/openssh/20230824_233826_27e9f@/log.gz
    24.08.23 23:38:26 ✅ Triggers: openssh/1:9.3p1-1ubuntu3~ppa1
Running: (none)
Waiting: (none)

[Michał Małoszewski (michal-maloszewski99)]

Please review.

[Sergio Durigan Junior (sergiodj)]

Thanks, Michal.

LGTM. This actually fixes the bug. I suspect that the reason you are not able to verify is because the process is (much) more involved.

You have to set up the Authorized*Commands scripts making sure to set their permission bits exactly as openssh expects. You also need to configure openssh to authenticate users using signed keys with principals (see https://dmuth.medium.com/ssh-at-scale-cas-and-principals-b27edca3a5d which contains a good initial guide on how to do this). Finally, it's really important to declare AuthorizedKeysCommands *before* AuthorizedPrincipalCommands, otherwise the bug won't manifest due to the way the config file parsing is done.

After all that, you should be able to finally verify the bug manifesting, and also seeing it being fixed with the proposed change.

I'll go ahead and upload this one because it doesn't require an SRU text.

Uploaded:

$ dput openssh_9.3p1-1ubuntu3_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/openssh/openssh_9.3p1-1ubuntu3_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/openssh/openssh_9.3p1-1ubuntu3.dsc: Valid signature from 106DA1C8C3CBBF14
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading openssh_9.3p1-1ubuntu3.dsc: done.
  Uploading openssh_9.3p1-1ubuntu3.debian.tar.xz: done.
  Uploading openssh_9.3p1-1ubuntu3_source.buildinfo: done.
  Uploading openssh_9.3p1-1ubuntu3_source.changes: done.
Successfully uploaded packages.

review: Approve

[Sergio Durigan Junior (sergiodj)]

Ops, when I was writing the main comment I forgot about the minor nit I raised on d/changelog. Oh well, that's not really important, so it should be fine.

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: sergiodj, michal-maloszewski99
Uploaders: sergiodj
MP auto-approved

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 478108f..240901f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+openssh (1:9.3p1-1ubuntu3) mantic; urgency=medium
+
+  * d/p/fix-authorized-principals-command.patch: Fix the situation where
+    sshd ignores AuthorizedPrincipalsCommand if AuthorizedKeysCommand
+    is also set by checking if the value pointed to by the pointer
+    'charptr' is NULL. (LP: #2031942)
+
+ -- Michal Maloszewski <[e-mail]>  Thu, 24 Aug 2023 15:20:27 +0200
+
 openssh (1:9.3p1-1ubuntu2) mantic; urgency=medium
 
   * SECURITY UPDATE: remote code execution relating to PKCS#11 providers
diff --git a/debian/patches/fix-authorized-principals-command.patch b/debian/patches/fix-authorized-principals-command.patch
new file mode 100644
index 0000000..9a41dc3
--- /dev/null
+++ b/debian/patches/fix-authorized-principals-command.patch
@@ -0,0 +1,34 @@
+From fcd78e31cdd45a7e69ccfe6d8a3b1037dc1de290 Mon Sep 17 00:00:00 2001
+From: "[e-mail]" <[e-mail]>
+Date: Wed, 24 May 2023 23:01:06 +0000
+Subject: [PATCH] upstream: fix AuthorizedPrincipalsCommand when
+ AuthorizedKeysCommand
+
+Origin: upstream, https://github.com/openssh/openssh-portable/commit/fcd78e31cdd45a7e69ccfe6d8a3b1037dc1de290
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=3574
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2031942
+Last-Update: 2023-08-24
+---
+ servconf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/servconf.c b/servconf.c
+index 9d5b73ecfc0..0f4fd2f17e3 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -1,5 +1,5 @@
+ 
+-/* $OpenBSD: servconf.c,v 1.392 2023/03/05 05:34:09 dtucker Exp $ */
++/* $OpenBSD: servconf.c,v 1.393 2023/05/24 23:01:06 djm Exp $ */
+ /*
+  * Copyright (c) 1995 Tatu Ylonen <[e-mail]>, Espoo, Finland
+  *                    All rights reserved
+@@ -2403,7 +2403,7 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+ 			fatal("%.200s line %d: %s must be an absolute path",
+ 			    filename, linenum, keyword);
+ 		}
+-		if (*activep && options->authorized_keys_command == NULL)
++		if (*activep && *charptr == NULL)
+ 			*charptr = xstrdup(str + len);
+ 		argv_consume(&ac);
+ 		break;
diff --git a/debian/patches/series b/debian/patches/series
index 6230ec4..6df52e3 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -30,3 +30,4 @@ test-set-UsePAM-no-on-some-tests.patch
 CVE-2023-38408-1.patch
 CVE-2023-38408-2.patch
 CVE-2023-38408-3.patch
+fix-authorized-principals-command.patch