Bug #2020474 “openssh-server-1:9.2p1-2ubuntu1 cannot be installe...” : Bugs : openssh package : Ubuntu

Revision history for this message

scottfk (scottfk) wrote on 2023-05-23:

#1

Dependencies.txt Edit (2.5 KiB, text/plain; charset="utf-8")
ProcCpuinfoMinimal.txt Edit (144 bytes, text/plain; charset="utf-8")
ProcEnviron.txt Edit (270 bytes, text/plain; charset="utf-8")

Revision history for this message

Nick Rosbrook (enr0n) wrote on 2023-05-23:

#2

How are you configuring sshd to run? It seems like you may have partially-configured socket-activated sshd. The postinst script should only try to resart ssh.socket if it was already enabled, which should not be the case if e.g. you reverted the socket-activation change. So, did you try and disable socket-activated sshd in the past?

The issue is not your active ssh session, because that is not the process that is listening on port 22.

Changed in openssh (Ubuntu):
status:	New → Incomplete

Revision history for this message

scottfk (scottfk) wrote on 2023-05-23:

#3

This is just the out-of-the-box sshd config from the preinstalled Ubuntu 23.04 Server image (https://ubuntu.com/download/risc-v). I didn't make any changes to it.

Interestingly... on my amd64 desktop, I only see a ssh.socket systemd service. On an rpi and my VisionFive2 I see both ssh.socket *and* ssh.service.

Revision history for this message

Nick Rosbrook (enr0n) wrote on 2023-05-23:

#4

Er, is there something else running on port 22 then? What does lsof -i:22 show?

Revision history for this message

scottfk (scottfk) wrote on 2023-05-23:

#5

# lsof -i :22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root 140u IPv6 22354 0t0 TCP *:ssh (LISTEN)
sshd 904 root 3u IPv6 22354 0t0 TCP *:ssh (LISTEN)
sshd 905 root 3u IPv6 22354 0t0 TCP *:ssh (LISTEN)
sshd 905 root 4u IPv6 18405 0t0 TCP venus2.home:ssh->hydra.home:40926 (ESTABLISHED)
sshd 905 root 5u IPv6 18405 0t0 TCP venus2.home:ssh->hydra.home:40926 (ESTABLISHED)
sshd 997 scottfk 3u IPv6 22354 0t0 TCP *:ssh (LISTEN)
sshd 997 scottfk 4u IPv6 18405 0t0 TCP venus2.home:ssh->hydra.home:40926 (ESTABLISHED)
sshd 997 scottfk 5u IPv6 18405 0t0 TCP venus2.home:ssh->hydra.home:40926 (ESTABLISHED)

Revision history for this message

Nick Rosbrook (enr0n) wrote on 2023-05-23:

#6

Yeah that does look a bit odd. What do the following show?

# systemctl status 904
# systemctl status 905
# systemctl status 997

Revision history for this message

scottfk (scottfk) wrote on 2023-05-23:

#7

Download full text (8.1 KiB)

Before retriggering the post-installation:

root@venus2:/home/scottfk# systemctl status 904
● ssh.service - OpenBSD Secure Shell server
     Loaded: loaded (/lib/systemd/system/ssh.service; disabled; preset: enabled)
    Drop-In: /etc/systemd/system/ssh.service.d
             └─00-socket.conf
     Active: active (running) since Tue 2023-05-23 15:17:36 CEST; 4h 40min ago
TriggeredBy: ● ssh.socket
       Docs: man:sshd(8)
             man:sshd_config(5)
   Main PID: 904 (sshd)
      Tasks: 1 (limit: 9378)
     Memory: 5.1M
        CPU: 468ms
     CGroup: /system.slice/ssh.service
             └─904 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"

May 23 15:17:35 venus2 systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
May 23 15:17:36 venus2 sshd[904]: Server listening on :: port 22.
May 23 15:17:36 venus2 systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
May 23 15:17:36 venus2 sshd[905]: Accepted publickey for scottfk from 2a02:1210:2a23:5600:9e82:2fb7:9772:3bf6 port 4092>
May 23 15:17:36 venus2 sshd[905]: pam_unix(sshd:session): session opened for user scottfk(uid=1000) by (uid=0)
root@venus2:/home/scottfk# systemctl status 905
● session-2.scope - Session 2 of User scottfk
     Loaded: loaded (/run/systemd/transient/session-2.scope; transient)
  Transient: yes
     Active: active (running) since Tue 2023-05-23 15:17:37 CEST; 4h 41min ago
      Tasks: 8
     Memory: 18.2M
        CPU: 4.330s
     CGroup: /user.slice/user-1000.slice/session-2.scope
             ├─ 905 "sshd: scottfk [priv]"
             ├─ 997 "sshd: scottfk@pts/0"
             ├─ 998 -bash
             ├─1113 sudo bash -o vi
             ├─1114 sudo bash -o vi
             ├─1115 bash -o vi
             ├─1301 systemctl status 905
             └─1302 less

May 23 15:17:37 venus2 systemd[1]: Started session-2.scope - Session 2 of User scottfk.
May 23 15:17:41 venus2 sshd[905]: pam_env(sshd:session): deprecated reading of user environment enabled
May 23 17:41:33 venus2 sudo[1108]: scottfk : TTY=pts/0 ; PWD=/home/scottfk ; USER=root ; COMMAND=/usr/bin/lsof -i :22
May 23 17:41:33 venus2 sudo[1108]: pam_unix(sudo:session): session opened for user root(uid=0) by scottfk(uid=1000)
May 23 17:41:33 venus2 sudo[1108]: pam_unix(sudo:session): session closed for user root
May 23 17:42:20 venus2 sudo[1113]: scottfk : TTY=pts/0 ; PWD=/home/scottfk ; USER=root ; COMMAND=/usr/bin/bash -o vi
May 23 17:42:20 venus2 sudo[1113]: pam_unix(sudo:session): session opened for user root(uid=0) by scottfk(uid=1000)
root@venus2:/home/scottfk# systemctl status 997
● session-2.scope - Session 2 of User scottfk
     Loaded: loaded (/run/systemd/transient/session-2.scope; transient)
  Transient: yes
     Active: active (running) since Tue 2023-05-23 15:17:37 CEST; 4h 41min ago
      Tasks: 8
     Memory: 18.3M
        CPU: 4.376s
     CGroup: /user.slice/user-1000.slice/session-2.scope
             ├─ 905 "sshd: scottfk [priv]"
             ├─ 997 "sshd: scottfk@pts/0"
             ├─ 998 -bash
             ├─1113 sudo bash -o vi
             ├─1114 sudo bash -o vi
             ├─1115 bash -o vi
             ├─1304 systemctl status 997
             └─1305 less

May 23 ...

Before retriggering the post-installation:

root@venus2:/home/scottfk# systemctl status 904
● ssh.service - OpenBSD Secure Shell server
     Loaded: loaded (/lib/systemd/system/ssh.service; disabled; preset: enabled)
    Drop-In: /etc/systemd/system/ssh.service.d
             └─00-socket.conf
     Active: active (running) since Tue 2023-05-23 15:17:36 CEST; 4h 40min ago
TriggeredBy: ● ssh.socket
       Docs: man:sshd(8)
             man:sshd_config(5)
   Main PID: 904 (sshd)
      Tasks: 1 (limit: 9378)
     Memory: 5.1M
        CPU: 468ms
     CGroup: /system.slice/ssh.service
             └─904 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"

May 23 15:17:35 venus2 systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
May 23 15:17:36 venus2 sshd[904]: Server listening on :: port 22.
May 23 15:17:36 venus2 systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
May 23 15:17:36 venus2 sshd[905]: Accepted publickey for scottfk from 2a02:1210:2a23:5600:9e82:2fb7:9772:3bf6 port 4092>
May 23 15:17:36 venus2 sshd[905]: pam_unix(sshd:session): session opened for user scottfk(uid=1000) by (uid=0)
root@venus2:/home/scottfk# systemctl status 905
● session-2.scope - Session 2 of User scottfk
     Loaded: loaded (/run/systemd/transient/session-2.scope; transient)
  Transient: yes
     Active: active (running) since Tue 2023-05-23 15:17:37 CEST; 4h 41min ago
      Tasks: 8
     Memory: 18.2M
        CPU: 4.330s
     CGroup: /user.slice/user-1000.slice/session-2.scope
             ├─ 905 "sshd: scottfk [priv]"
             ├─ 997 "sshd: scottfk@pts/0"
             ├─ 998 -bash
             ├─1113 sudo bash -o vi
             ├─1114 sudo bash -o vi
             ├─1115 bash -o vi
             ├─1301 systemctl status 905
             └─1302 less

May 23 15:17:37 venus2 systemd[1]: Started session-2.scope - Session 2 of User scottfk.
May 23 15:17:41 venus2 sshd[905]: pam_env(sshd:session): deprecated reading of user environment enabled
May 23 17:41:33 venus2 sudo[1108]:  scottfk : TTY=pts/0 ; PWD=/home/scottfk ; USER=root ; COMMAND=/usr/bin/lsof -i :22
May 23 17:41:33 venus2 sudo[1108]: pam_unix(sudo:session): session opened for user root(uid=0) by scottfk(uid=1000)
May 23 17:41:33 venus2 sudo[1108]: pam_unix(sudo:session): session closed for user root
May 23 17:42:20 venus2 sudo[1113]:  scottfk : TTY=pts/0 ; PWD=/home/scottfk ; USER=root ; COMMAND=/usr/bin/bash -o vi
May 23 17:42:20 venus2 sudo[1113]: pam_unix(sudo:session): session opened for user root(uid=0) by scottfk(uid=1000)
root@venus2:/home/scottfk# systemctl status 997
● session-2.scope - Session 2 of User scottfk
     Loaded: loaded (/run/systemd/transient/session-2.scope; transient)
  Transient: yes
     Active: active (running) since Tue 2023-05-23 15:17:37 CEST; 4h 41min ago
      Tasks: 8
     Memory: 18.3M
        CPU: 4.376s
     CGroup: /user.slice/user-1000.slice/session-2.scope
             ├─ 905 "sshd: scottfk [priv]"
             ├─ 997 "sshd: scottfk@pts/0"
             ├─ 998 -bash
             ├─1113 sudo bash -o vi
             ├─1114 sudo bash -o vi
             ├─1115 bash -o vi
             ├─1304 systemctl status 997
             └─1305 less

May 23 15:17:37 venus2 systemd[1]: Started session-2.scope - Session 2 of User scottfk.
May 23 15:17:41 venus2 sshd[905]: pam_env(sshd:session): deprecated reading of user environment enabled
May 23 17:41:33 venus2 sudo[1108]:  scottfk : TTY=pts/0 ; PWD=/home/scottfk ; USER=root ; COMMAND=/usr/bin/lsof -i :22
May 23 17:41:33 venus2 sudo[1108]: pam_unix(sudo:session): session opened for user root(uid=0) by scottfk(uid=1000)
May 23 17:41:33 venus2 sudo[1108]: pam_unix(sudo:session): session closed for user root
May 23 17:42:20 venus2 sudo[1113]:  scottfk : TTY=pts/0 ; PWD=/home/scottfk ; USER=root ; COMMAND=/usr/bin/bash -o vi
May 23 17:42:20 venus2 sudo[1113]: pam_unix(sudo:session): session opened for user root(uid=0) by scottfk(uid=1000)

Retriggering the post-installation:
root@venus2:/home/scottfk# dpkg --configure -a
Setting up openssh-server (1:9.2p1-2ubuntu1) ...
rescue-ssh.target is a disabled or a static unit not running, not starting it.
Could not execute systemctl:  at /usr/bin/deb-systemd-invoke line 145.
dpkg: error processing package openssh-server (--configure):
 installed openssh-server package post-installation script subprocess returned error exit status 1
Errors were encountered while processing:
 openssh-server
root@venus2:/home/scottfk# systemctl status 904
Failed to get unit for PID 904: PID 904 does not belong to any loaded unit.
root@venus2:/home/scottfk# systemctl status 905
● session-2.scope - Session 2 of User scottfk
     Loaded: loaded (/run/systemd/transient/session-2.scope; transient)
  Transient: yes
     Active: active (running) since Tue 2023-05-23 15:17:37 CEST; 4h 43min ago
      Tasks: 8
     Memory: 33.6M
        CPU: 9.657s
     CGroup: /user.slice/user-1000.slice/session-2.scope
             ├─ 905 "sshd: scottfk [priv]"
             ├─ 997 "sshd: scottfk@pts/0"
             ├─ 998 -bash
             ├─1113 sudo bash -o vi
             ├─1114 sudo bash -o vi
             ├─1115 bash -o vi
             ├─1534 systemctl status 905
             └─1535 less

May 23 15:17:37 venus2 systemd[1]: Started session-2.scope - Session 2 of User scottfk.
May 23 15:17:41 venus2 sshd[905]: pam_env(sshd:session): deprecated reading of user environment enabled
May 23 17:41:33 venus2 sudo[1108]:  scottfk : TTY=pts/0 ; PWD=/home/scottfk ; USER=root ; COMMAND=/usr/bin/lsof -i :22
May 23 17:41:33 venus2 sudo[1108]: pam_unix(sudo:session): session opened for user root(uid=0) by scottfk(uid=1000)
May 23 17:41:33 venus2 sudo[1108]: pam_unix(sudo:session): session closed for user root
May 23 17:42:20 venus2 sudo[1113]:  scottfk : TTY=pts/0 ; PWD=/home/scottfk ; USER=root ; COMMAND=/usr/bin/bash -o vi
May 23 17:42:20 venus2 sudo[1113]: pam_unix(sudo:session): session opened for user root(uid=0) by scottfk(uid=1000)
root@venus2:/home/scottfk# systemctl status 997
● session-2.scope - Session 2 of User scottfk
     Loaded: loaded (/run/systemd/transient/session-2.scope; transient)
  Transient: yes
     Active: active (running) since Tue 2023-05-23 15:17:37 CEST; 4h 44min ago
      Tasks: 8
     Memory: 33.5M
        CPU: 9.713s
     CGroup: /user.slice/user-1000.slice/session-2.scope
             ├─ 905 "sshd: scottfk [priv]"
             ├─ 997 "sshd: scottfk@pts/0"
             ├─ 998 -bash
             ├─1113 sudo bash -o vi
             ├─1114 sudo bash -o vi
             ├─1115 bash -o vi
             ├─1536 systemctl status 997
             └─1537 less

May 23 15:17:37 venus2 systemd[1]: Started session-2.scope - Session 2 of User scottfk.
May 23 15:17:41 venus2 sshd[905]: pam_env(sshd:session): deprecated reading of user environment enabled
May 23 17:41:33 venus2 sudo[1108]:  scottfk : TTY=pts/0 ; PWD=/home/scottfk ; USER=root ; COMMAND=/usr/bin/lsof -i :22
May 23 17:41:33 venus2 sudo[1108]: pam_unix(sudo:session): session opened for user root(uid=0) by scottfk(uid=1000)
May 23 17:41:33 venus2 sudo[1108]: pam_unix(sudo:session): session closed for user root
May 23 17:42:20 venus2 sudo[1113]:  scottfk : TTY=pts/0 ; PWD=/home/scottfk ; USER=root ; COMMAND=/usr/bin/bash -o vi
May 23 17:42:20 venus2 sudo[1113]: pam_unix(sudo:session): session opened for user root(uid=0) by scottfk(uid=1000)
root@venus2:/home/scottfk# lsof -i :22
COMMAND PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd    905    root    3u  IPv6  22354      0t0  TCP *:ssh (LISTEN)
sshd    905    root    4u  IPv6  18405      0t0  TCP venus2.home:ssh->hydra.home:40926 (ESTABLISHED)
sshd    905    root    5u  IPv6  18405      0t0  TCP venus2.home:ssh->hydra.home:40926 (ESTABLISHED)
sshd    997 scottfk    3u  IPv6  22354      0t0  TCP *:ssh (LISTEN)
sshd    997 scottfk    4u  IPv6  18405      0t0  TCP venus2.home:ssh->hydra.home:40926 (ESTABLISHED)
sshd    997 scottfk    5u  IPv6  18405      0t0  TCP venus2.home:ssh->hydra.home:40926 (ESTABLISHED)
root@venus2:/home/scottfk# ps -ef | grep sshd
root         905       1  0 15:17 ?        00:00:00 sshd: scottfk [priv]
scottfk      997     905  0 15:17 ?        00:00:00 sshd: scottfk@pts/0
root        1540    1115  0 20:03 pts/1    00:00:00 grep --color=auto sshd

Revision history for this message

scottfk (scottfk) wrote on 2023-05-23:

#8

So I tried this in an amd64 VM. Installing this version of openssh-server (from inside a GNOME session) worked just fine.

ssh-ing to localhost and attempting a reinstall ended up in the exact same FAIL.

So it seems the upgrade of openssh-server 1:9.2p1-2ubuntu1 can't be done from an ssh session (regardless of processor architecture). I'll do more poking around to see if I can't figure out why systemd won't/can't.

Revision history for this message

scottfk (scottfk) wrote on 2023-05-23:

#9

root@venus2:/home/scottfk# systemctl restart ssh.socket
Job failed. See "journalctl -xe" for details.

May 23 20:36:21 venus2 systemd[2014]: ssh.socket: Failed to create listening socket ([::]:22): Address already in use
May 23 20:36:21 venus2 systemd[1]: ssh.socket: Failed to receive listening socket ([::]:22): Input/output error
May 23 20:36:21 venus2 systemd[1]: ssh.socket: Failed to listen on sockets: Input/output error
May 23 20:36:21 venus2 systemd[1]: ssh.socket: Failed with result 'resources'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ The unit ssh.socket has entered the 'failed' state with result 'resources'.
May 23 20:36:21 venus2 systemd[1]: Failed to listen on ssh.socket - OpenBSD Secure Shell server socket.
░░ Subject: A start job for unit ssh.socket has failed
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit ssh.socket has finished with a failure.
░░
░░ The job identifier is 1542 and the job result is failed.

Revision history for this message

scottfk (scottfk) wrote on 2023-05-23:

#10

root@venus2:/etc/systemd/system/ssh.service.d# /usr/sbin/sshd -d
debug1: sshd version OpenSSH_9.2, OpenSSL 3.0.8 7 Feb 2023
debug1: private host key #0: ssh-rsa SHA256:jBRj9thNiN3QA5SVICY9H4/b2f2tvIqyKv2krB+q1+E
debug1: private host key #1: ecdsa-sha2-nistp256 SHA256:+AoeQEDs9PNiD54EnDi/YTJksSDND59lJqCe5BAgdz0
debug1: private host key #2: ssh-ed25519 SHA256:fJj+sS6kyWxB/3Z36XR7DE7J1w9TYvR8GLRT0Kr+DNU
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
debug1: Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 22 on 0.0.0.0.
Bind to port 22 on 0.0.0.0 failed: Address already in use.
debug1: Bind to port 22 on ::.
Bind to port 22 on :: failed: Address already in use.
Cannot bind any address.

Revision history for this message

Nick Rosbrook (enr0n) wrote on 2023-05-23:

#11

You're right, I was able to reproduce this just now in the same way. I also tried in Lunar, but Lunar does not appear to be affected.

summary:	- openssh-server-1:9.2p1-2ubuntu1 fails post-installation + openssh-server-1:9.2p1-2ubuntu1 cannot be installed from active ssh + session
Changed in openssh (Ubuntu):
status:	Incomplete → Confirmed

Revision history for this message

Nick Rosbrook (enr0n) wrote on 2023-05-23:

#12

This appears to have to do with the patch addressing bug 2011458.

Nick Rosbrook (enr0n) on 2023-05-23

tags:

added: rls-mm-incoming

Revision history for this message

Nick Rosbrook (enr0n) wrote on 2023-05-23:

#13

Workaround:

For me, when I reboot, the ssh.socket unit comes up again and I can establish a session. To avoid continuously hitting the error in the postint, run e.g. dpkg --configure -a from a non-ssh session, or script this to happen once on reboot or something.

Changed in openssh (Ubuntu):
importance:	Undecided → Medium

Revision history for this message

scottfk (scottfk) wrote on 2023-05-24:

#14

Still an issue in the latest version:

Setting up openssh-server (1:9.2p1-2ubuntu2) ...
rescue-ssh.target is a disabled or a static unit not running, not starting it.
Could not execute systemctl: at /usr/bin/deb-systemd-invoke line 145.
dpkg: error processing package openssh-server (--configure):
installed openssh-server package post-installation script subprocess returned error exit status 1
Setting up sosreport (4.5.3ubuntu2) ...
Processing triggers for man-db (2.11.2-2) ...
Processing triggers for ufw (0.36.2-1) ...
Errors were encountered while processing:
openssh-server
needrestart is being skipped since dpkg has failed
E: Sub-process /usr/bin/dpkg returned an error code (1)
scottfk@venus2:~$ apt policy openssh-server
openssh-server:
  Installed: 1:9.2p1-2ubuntu2
  Candidate: 1:9.2p1-2ubuntu2
  Version table:
*** 1:9.2p1-2ubuntu2 500
        500 http://ch.ports.ubuntu.com/ubuntu-ports mantic-proposed/main riscv64 Packages
        100 /var/lib/dpkg/status
     1:9.0p1-1ubuntu8.1 500
        500 http://ch.ports.ubuntu.com/ubuntu-ports mantic/main riscv64 Packages

Re: Workaround, adding this to root's crontab sorted me:
@reboot dpkg --configure -a

Jeremy Bícha (jbicha) on 2023-05-24

tags:

added: update-excuse

Nick Rosbrook (enr0n) on 2023-05-24

Changed in openssh (Ubuntu):
assignee:	nobody → Nick Rosbrook (enr0n)
status:	Confirmed → In Progress

Nick Rosbrook (enr0n) on 2023-05-25

tags:

added: foundations-todo

Nick Rosbrook (enr0n) on 2023-05-25

tags:

removed: rls-mm-incoming

Jeremy Bícha (jbicha) on 2023-05-26

Changed in openssh (Ubuntu):
status:	In Progress → Fix Committed

Revision history for this message

scottfk (scottfk) wrote on 2023-05-27:

#15

Seems fixed. Huzzah!

$ apt policy openssh-server
openssh-server:
  Installed: 1:9.2p1-2ubuntu3
  Candidate: 1:9.2p1-2ubuntu3
  Version table:
*** 1:9.2p1-2ubuntu3 500
        500 http://ch.ports.ubuntu.com/ubuntu-ports mantic-proposed/main riscv64 Packages
        100 /var/lib/dpkg/status
     1:9.0p1-1ubuntu8.1 500
        500 http://ch.ports.ubuntu.com/ubuntu-ports mantic/main riscv64 Packages

Revision history for this message

scottfk (scottfk) wrote on 2023-06-02:

#16

Seems this has now made its way downstream to openssh-server 9.0 (on a different box):

The following packages will be upgraded:
openssh-client openssh-server openssh-sftp-server
3 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 1295 kB of archives.
After this operation, 65.5 kB disk space will be freed.
Do you want to continue? [Y/n]
Get:1 http://ca.ports.ubuntu.com/ubuntu-ports lunar-proposed/main arm64 openssh-sftp-server arm64 1:9.0p1-1ubuntu8.2 [36.0 kB]
Get:2 http://ca.ports.ubuntu.com/ubuntu-ports lunar-proposed/main arm64 openssh-server arm64 1:9.0p1-1ubuntu8.2 [409 kB]
Get:3 http://ca.ports.ubuntu.com/ubuntu-ports lunar-proposed/main arm64 openssh-client arm64 1:9.0p1-1ubuntu8.2 [849 kB]
Fetched 1295 kB in 1s (921 kB/s)
Preconfiguring packages ...
(Reading database ... 104735 files and directories currently installed.)
Preparing to unpack .../openssh-sftp-server_1%3a9.0p1-1ubuntu8.2_arm64.deb ...
Unpacking openssh-sftp-server (1:9.0p1-1ubuntu8.2) over (1:9.0p1-1ubuntu8.1) ...
Preparing to unpack .../openssh-server_1%3a9.0p1-1ubuntu8.2_arm64.deb ...
Unpacking openssh-server (1:9.0p1-1ubuntu8.2) over (1:9.0p1-1ubuntu8.1) ...
Preparing to unpack .../openssh-client_1%3a9.0p1-1ubuntu8.2_arm64.deb ...
Unpacking openssh-client (1:9.0p1-1ubuntu8.2) over (1:9.0p1-1ubuntu8.1) ...
Setting up openssh-client (1:9.0p1-1ubuntu8.2) ...
Setting up openssh-sftp-server (1:9.0p1-1ubuntu8.2) ...
Setting up openssh-server (1:9.0p1-1ubuntu8.2) ...
rescue-ssh.target is a disabled or a static unit not running, not starting it.
Could not execute systemctl: at /usr/bin/deb-systemd-invoke line 145.
dpkg: error processing package openssh-server (--configure):
installed openssh-server package post-installation script subprocess returned error exit status 1
Processing triggers for man-db (2.11.2-1) ...
Processing triggers for ufw (0.36.1-4.1) ...
Errors were encountered while processing:
openssh-server
needrestart is being skipped since dpkg has failed
E: Sub-process /usr/bin/dpkg returned an error code (1)

Should I cut a new bug for this? It's a different arch and a different version of Ubuntu, but it's the exact same symptom (and, likely, cause).

Seems this has now made its way downstream to openssh-server 9.0 (on a different box):

The following packages will be upgraded:
  openssh-client openssh-server openssh-sftp-server
3 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 1295 kB of archives.
After this operation, 65.5 kB disk space will be freed.
Do you want to continue? [Y/n] 
Get:1 http://ca.ports.ubuntu.com/ubuntu-ports lunar-proposed/main arm64 openssh-sftp-server arm64 1:9.0p1-1ubuntu8.2 [36.0 kB]
Get:2 http://ca.ports.ubuntu.com/ubuntu-ports lunar-proposed/main arm64 openssh-server arm64 1:9.0p1-1ubuntu8.2 [409 kB]
Get:3 http://ca.ports.ubuntu.com/ubuntu-ports lunar-proposed/main arm64 openssh-client arm64 1:9.0p1-1ubuntu8.2 [849 kB]
Fetched 1295 kB in 1s (921 kB/s)        
Preconfiguring packages ...
(Reading database ... 104735 files and directories currently installed.)
Preparing to unpack .../openssh-sftp-server_1%3a9.0p1-1ubuntu8.2_arm64.deb ...
Unpacking openssh-sftp-server (1:9.0p1-1ubuntu8.2) over (1:9.0p1-1ubuntu8.1) ...
Preparing to unpack .../openssh-server_1%3a9.0p1-1ubuntu8.2_arm64.deb ...
Unpacking openssh-server (1:9.0p1-1ubuntu8.2) over (1:9.0p1-1ubuntu8.1) ...
Preparing to unpack .../openssh-client_1%3a9.0p1-1ubuntu8.2_arm64.deb ...
Unpacking openssh-client (1:9.0p1-1ubuntu8.2) over (1:9.0p1-1ubuntu8.1) ...
Setting up openssh-client (1:9.0p1-1ubuntu8.2) ...
Setting up openssh-sftp-server (1:9.0p1-1ubuntu8.2) ...
Setting up openssh-server (1:9.0p1-1ubuntu8.2) ...
rescue-ssh.target is a disabled or a static unit not running, not starting it.
Could not execute systemctl:  at /usr/bin/deb-systemd-invoke line 145.
dpkg: error processing package openssh-server (--configure):
 installed openssh-server package post-installation script subprocess returned error exit status 1
Processing triggers for man-db (2.11.2-1) ...
Processing triggers for ufw (0.36.1-4.1) ...
Errors were encountered while processing:
 openssh-server
needrestart is being skipped since dpkg has failed
E: Sub-process /usr/bin/dpkg returned an error code (1)

Should I cut a new bug for this?  It's a different arch and a different version of Ubuntu, but it's the exact same symptom (and, likely, cause).

Revision history for this message

Nick Rosbrook (enr0n) wrote on 2023-06-02:

#17

You are correct that this is the same issue. However, the reason you are seeing this in Lunar is that
you are running with -proposed enabled, which is where packages are staged before being released to -release, or -updates for stable release updates. So, this means that you installed 1:9.0p1-1ubuntu8.1 from lunar-proposed, which contains the bug that causes the problem on upgrade. However, thanks to this bug report from you, we have uploaded 1:9.0p1-1ubuntu8.2 to lunar-proposed to fix the underlying issue *before* openssh is released to lunar-updates. This means that users who upgrade to 1:9.0p1-1ubuntu8.2 from 1:9.0p1-1ubuntu8 (i.e. they never installed 1:9.0p1-1ubuntu8.1) will not see this bug. Since a buggy version of openssh was not yet released to lunar-updates, we did not apply the extra patches that we did in mantic to work around the bug on upgrade (for mantic, a buggy version was released to mantic-release, so the situation was a bit different).

So, anyone running -proposed on kinetic or lunar will hit this bug once, but those users should be able to reboot, run dpkg --configure -a, and be sorted.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2023-06-04:

#18

Download full text (16.6 KiB)

This bug was fixed in the package openssh - 1:9.2p1-2ubuntu3

---------------
openssh (1:9.2p1-2ubuntu3) mantic; urgency=medium

  * Fix upgrade of openssh-server with active ssh session (LP: #2020474)
    - debian/patches/systemd-socket-activation.patch:
      + Do force closing of listen sockets in child process
      + Set rexec_flag = 0 when sshd is socket-activated so that child process
        does not re-exec
    - debian/openssh-server.postint:
      + When upgrading from affected versions of openssh, do not try to
        restart systemd units, and instead indicate that a reboot is required
    - debian/tests/systemd-socket-activation:
      + Reboot the testbed before starting the test
    - debian/rules:
      + Do not stop ssh.socket on upgrade
  * d/p/test-set-UsePAM-no-on-some-tests.patch: set UsePAM=no for some tests

openssh (1:9.2p1-2ubuntu2) mantic; urgency=medium

* debian/README.Debian: Fix path of addresses.conf drop-in

openssh (1:9.2p1-2ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2018094). Remaining changes:
    - debian/rules: modify dh_installsystemd invocations for
      socket-activated sshd
    - debian/openssh-server.postinst: handle migration of sshd_config options
      to systemd socket options on upgrade.
    - debian/README.Debian: document systemd socket activation.
    - debian/patches/socket-activation-documentation.patch: Document in
      sshd_config(5) that ListenAddress and Port no longer work.
    - debian/openssh-server.templates: include debconf prompt explaining
      when migration cannot happen due to multiple ListenAddress values
    - debian/.gitignore: drop file
    - debian/openssh-server.postrm: remove systemd drop-ins for
      socket-activated sshd on purge
    - debian/openssh-server.ucf-md5sum: Update list of stock sshd_config
      checksums to include those from jammy and kinetic.
    - debian/openssh-server.tmpfile,debian/systemd/ssh.service: Move
      /run/sshd creation out of the systemd unit to a tmpfile config so
      that sshd can be run manually if necessary without having to create
      this directory by hand.
    - debian/patches/systemd-socket-activation.patch: Fix sshd
      re-execution behavior when socket activation is used
    - debian/tests/systemd-socket-activation: Add autopkgtest for systemd socket
      activation functionality.
  * Dropped changes, included in Debian:
    - debian/patches/systemd-socket-activation.patch: Initial implementation
  * New changes:
    - debian/README.Debian: mention drop-in configurations in instructions
      for disabling sshd socket activation (LP: #2017434).
    - debian/openssh-server.ucf-md5sum: update for Ubuntu delta

openssh (1:9.2p1-2) unstable; urgency=medium

* Fix mistakenly-unreleased entry for 1:9.2p1-1 in debian/NEWS.

openssh (1:9.2p1-1) unstable; urgency=medium

  * Set "UsePAM yes" when running regression tests, to match our default
    sshd configuration.
  * Ignore Lintian error about depending on lsb-base for now, to avoid
    problems with partial upgrades on non-default init systems.
  * New upstream release (https://www.openssh.com/releasenotes.html#9.2p1):
    - [SECURITY] sshd...

This bug was fixed in the package openssh - 1:9.2p1-2ubuntu3

---------------
openssh (1:9.2p1-2ubuntu3) mantic; urgency=medium

* Fix upgrade of openssh-server with active ssh session (LP: #2020474)
    - debian/patches/systemd-socket-activation.patch:
      + Do force closing of listen sockets in child process
      + Set rexec_flag = 0 when sshd is socket-activated so that child process
        does not re-exec
    - debian/openssh-server.postint:
      + When upgrading from affected versions of openssh, do not try to
        restart systemd units, and instead indicate that a reboot is required
    - debian/tests/systemd-socket-activation:
      + Reboot the testbed before starting the test
    - debian/rules:
      + Do not stop ssh.socket on upgrade
  * d/p/test-set-UsePAM-no-on-some-tests.patch: set UsePAM=no for some tests

openssh (1:9.2p1-2ubuntu2) mantic; urgency=medium

* debian/README.Debian: Fix path of addresses.conf drop-in

openssh (1:9.2p1-2ubuntu1) mantic; urgency=medium

* Merge with Debian unstable (LP: #2018094). Remaining changes:
    - debian/rules: modify dh_installsystemd invocations for
      socket-activated sshd
    - debian/openssh-server.postinst: handle migration of sshd_config options
      to systemd socket options on upgrade.
    - debian/README.Debian: document systemd socket activation.
    - debian/patches/socket-activation-documentation.patch: Document in
      sshd_config(5) that ListenAddress and Port no longer work.
    - debian/openssh-server.templates: include debconf prompt explaining
      when migration cannot happen due to multiple ListenAddress values
    - debian/.gitignore: drop file
    - debian/openssh-server.postrm: remove systemd drop-ins for
      socket-activated sshd on purge
    - debian/openssh-server.ucf-md5sum: Update list of stock sshd_config
      checksums to include those from jammy and kinetic.
    - debian/openssh-server.tmpfile,debian/systemd/ssh.service: Move
      /run/sshd creation out of the systemd unit to a tmpfile config so
      that sshd can be run manually if necessary without having to create
      this directory by hand.
    - debian/patches/systemd-socket-activation.patch: Fix sshd
      re-execution behavior when socket activation is used
    - debian/tests/systemd-socket-activation: Add autopkgtest for systemd socket
      activation functionality.
  * Dropped changes, included in Debian:
    - debian/patches/systemd-socket-activation.patch: Initial implementation
  * New changes:
    - debian/README.Debian: mention drop-in configurations in instructions
      for disabling sshd socket activation (LP: #2017434).
    - debian/openssh-server.ucf-md5sum: update for Ubuntu delta

openssh (1:9.2p1-2) unstable; urgency=medium

* Fix mistakenly-unreleased entry for 1:9.2p1-1 in debian/NEWS.

openssh (1:9.2p1-1) unstable; urgency=medium

* Set "UsePAM yes" when running regression tests, to match our default
    sshd configuration.
  * Ignore Lintian error about depending on lsb-base for now, to avoid
    problems with partial upgrades on non-default init systems.
  * New upstream release (https://www.openssh.com/releasenotes.html#9.2p1):
    - [SECURITY] sshd(8): fix a pre-authentication double-free memory fault
      introduced in OpenSSH 9.1. This is not believed to be exploitable, and
      it occurs in the unprivileged pre-auth process that is subject to
      chroot(2) and is further sandboxed on most major platforms.
    - [SECURITY] ssh(8): in OpenSSH releases after 8.7, the PermitRemoteOpen
      option would ignore its first argument unless it was one of the
      special keywords "any" or "none", causing the permission list to fail
      open if only one permission was specified.
    - [SECURITY] ssh(1): if the CanonicalizeHostname and
      CanonicalizePermittedCNAMEs options were enabled, and the system/libc
      resolver did not check that names in DNS responses were valid, then
      use of these options could allow an attacker with control of DNS to
      include invalid characters (possibly including wildcards) in names
      added to known_hosts files when they were updated. These names would
      still have to match the CanonicalizePermittedCNAMEs allow-list, so
      practical exploitation appears unlikely.
    - ssh(1): add a new EnableEscapeCommandline ssh_config(5) option that
      controls whether the client-side ~C escape sequence that provides a
      command-line is available. Among other things, the ~C command-line
      could be used to add additional port-forwards at runtime. This option
      defaults to "no", disabling the ~C command-line that was previously
      enabled by default.
    - sshd(8): add support for channel inactivity timeouts via a new
      sshd_config(5) ChannelTimeout directive. This allows channels that
      have not seen traffic in a configurable interval to be automatically
      closed. Different timeouts may be applied to session, X11, agent and
      TCP forwarding channels.
    - sshd(8): add a sshd_config UnusedConnectionTimeout option to terminate
      client connections that have no open channels for a length of time.
      This complements the ChannelTimeout option above.
    - sshd(8): add a -V (version) option to sshd like the ssh client has.
    - ssh(1): add a "Host" line to the output of ssh -G showing the original
      hostname argument. bz3343
    - scp(1), sftp(1): add a -X option to both scp(1) and sftp(1) to allow
      control over some SFTP protocol parameters: the copy buffer length and
      the number of in-flight requests, both of which are used during
      upload/download. Previously these could be controlled in sftp(1) only.
      This makes them available in both SFTP protocol clients using the same
      option character sequence.
    - ssh-keyscan(1): allow scanning of complete CIDR address ranges, e.g.
      "ssh-keyscan 192.168.0.0/24". If a CIDR range is passed, then it will
      be expanded to all possible addresses in the range including the
      all-0s and all-1s addresses.
    - ssh(1): support dynamic remote port forwarding in escape
      command-line's -R processing.
    - ssh(1): when restoring non-blocking mode to stdio fds, restore exactly
      the flags that ssh started with and don't just clobber them with zero,
      as this could also remove the append flag from the set.
    - ssh(1): avoid printf("%s", NULL) if using UserKnownHostsFile=none and
      a hostkey in one of the system known hosts file changes.
    - scp(1): switch scp from using pipes to a socket-pair for communication
      with its ssh sub-processes, matching how sftp(1) operates.
    - sshd(8): clear signal mask early in main(); sshd may have been started
      with one or more signals masked (sigprocmask(2) is not cleared on
      fork/exec) and this could interfere with various things, e.g. the
      login grace timer. Execution environments that fail to clear the
      signal mask before running sshd are clearly broken, but apparently
      they do exist.
    - ssh(1): warn if no host keys for hostbased auth can be loaded.
    - sshd(8): Add server debugging for hostbased auth that is queued and
      sent to the client after successful authentication, but also logged to
      assist in diagnosis of HostbasedAuthentication problems.
    - ssh(1): document use of the IdentityFile option as being usable to
      list public keys as well as private keys.
    - sshd(8): check for and disallow MaxStartups values less than or equal
      to zero during config parsing, rather than failing later at runtime.
    - ssh-keygen(1): fix parsing of hex cert expiry times specified on the
      command-line when acting as a CA.
    - scp(1): when scp(1) is using the SFTP protocol for transport (the
      default), better match scp/rcp's handling of globs that don't match
      the globbed characters but do match literally (e.g. trying to transfer
      a file named "foo.[1]"). Previously scp(1) in SFTP mode would not
      match these pathnames but legacy scp/rcp mode would.
    - ssh-agent(1): document the "-O no-restrict-websafe" command-line
      option.
    - ssh(1): honour user's umask(2) if it is more restrictive then the ssh
      default (022).
    - sshd(8): allow writev(2) in the Linux seccomp sandbox. This seems to
      be used by recent glibcs at least in some configurations during error
      conditions.
    - sshd(8): simplify handling of SSH_CONNECTION PAM env var, removing
      global variable and checking the return value from pam_putenv.
    - sshd(8): disable SANDBOX_SECCOMP_FILTER_DEBUG that was mistakenly
      enabled during the OpenSSH 9.1 release cycle.
    - sshd(8): defer PRNG seeding until after the initial closefrom(2) call.
      PRNG seeding will initialize OpenSSL, and some engine providers (e.g.
      Intel's QAT) will open descriptors for their own use that closefrom(2)
      could clobber.
  * debian/run-tests: Add a little more flexibility for debugging.

openssh (1:9.1p1-2) unstable; urgency=medium

[ Christian Göttsche ]
  * Do not copy SELinux security context in postinst.

[ Colin Watson ]
  * Add missing ${misc:Depends} to Depends for openssh-client-udeb,
    openssh-server-udeb.
  * Use secure URI in Homepage field.
  * Remove 2 obsolete maintscript entries in 2 files.
  * Fix day-of-week for changelog entries 1:3.0.2p1-9, 1:3.0.2p1-2,
    1:3.0.1p1-1.
  * Remove deprecated Encoding key from desktop file
    debian/ssh-askpass-gnome.desktop.
  * Update standards version to 4.6.2, no changes needed.
  * debian/tests/regress: Adjust to cope with changes in adduser 3.130 (see
    #625758).

openssh (1:9.1p1-1) unstable; urgency=medium

[ Markus Teich ]
  * Delete obsolete upstart configuration override.

[ Colin Watson ]
  * Work around apparent dh-exec regressions (closes: #1016340).
  * Don't install unnecessary *.lo files in openssh-tests.
  * Update Lintian overrides to current syntax.
  * Pass on compiler/linker flags when building debian/keygen-test.
  * Remove obsolete and misleading rcp/rlogin/rsh alternatives, and stop
    providing rsh-client (closes: #197037).
  * Add sshd_config checksums for 1:8.2p1-1 and 1:8.7p1-1 to ucf reference
    file.
  * New upstream release (https://www.openssh.com/releasenotes.html#9.1p1,
    closes: #1021585):
    - ssh-keyscan(1): fix a one-byte overflow in SSH- banner processing.
    - ssh-keygen(1): double free() in error path of file hashing step in
      signing/verify code.
    - ssh-keysign(8): double-free in error path introduced in openssh-8.9.
    - ssh(1), sshd(8): SetEnv directives in ssh_config and sshd_config are
      now first-match-wins to match other directives. Previously if an
      environment variable was multiply specified the last set value would
      have been used.
    - ssh-keygen(8): ssh-keygen -A (generate all default host key types)
      will no longer generate DSA keys, as these are insecure and have not
      been used by default for some years.
    - ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum RSA
      key length. Keys below this length will be ignored for user
      authentication and for host authentication in sshd(8). ssh(1) will
      terminate a connection if the server offers an RSA key that falls
      below this limit, as the SSH protocol does not include the ability to
      retry a failed key exchange.
    - sftp-server(8): add a "users-groups-by-id@openssh.com" extension
      request that allows the client to obtain user/group names that
      correspond to a set of uids/gids.
    - sftp(1): use "users-groups-by-id@openssh.com" sftp-server extension
      (when available) to fill in user/group names for directory listings.
    - sftp-server(8): support the "home-directory" extension request defined
      in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with
      the existing "expand-path@openssh.com", but some other clients support
      it.
    - ssh-keygen(1), sshd(8): allow certificate validity intervals, sshsig
      verification times and authorized_keys expiry-time options to accept
      dates in the UTC time zone in addition to the default of interpreting
      them in the system time zone. YYYYMMDD and YYMMDDHHMM[SS] dates/times
      will be interpreted as UTC if suffixed with a 'Z' character. Also
      allow certificate validity intervals to be specified in raw
      seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This is
      intended for use by regress tests and other tools that call ssh-keygen
      as part of a CA workflow.
    - sftp(1): allow arguments to the sftp -D option, e.g. sftp -D
      "/usr/libexec/sftp-server -el debug3".
    - ssh-keygen(1): allow the existing -U (use agent) flag to work with "-Y
      sign" operations, where it will be interpreted to require that the
      private keys is hosted in an agent.
    - ssh-keygen(1): implement the "verify-required" certificate option.
      This was already documented when support for user-verified FIDO keys
      was added, but the ssh-keygen(1) code was missing.
    - ssh-agent(1): hook up the restrict_websafe command-line flag;
      previously the flag was accepted but never actually used.
    - sftp(1): improve filename tab completions: never try to complete names
      to non-existent commands, and better match the completion type (local
      or remote filename) against the argument position being completed.
    - ssh-keygen(1), ssh(1), ssh-agent(1): several fixes to FIDO key
      handling, especially relating to keys that request user-verification.
      These should reduce the number of unnecessary PIN prompts for keys
      that support intrinsic user verification.
    - ssh-keygen(1): when enrolling a FIDO resident key, check if a
      credential with matching application and user ID strings already
      exists and, if so, prompt the user for confirmation before overwriting
      the credential.
    - sshd(8): improve logging of errors when opening authorized_keys files.
    - ssh(1): avoid multiplexing operations that could cause SIGPIPE from
      causing the client to exit early.
    - ssh_config(5), sshd_config(5): clarify that the RekeyLimit directive
      applies to both transmitted and received data.
    - ssh-keygen(1): avoid double fclose() in error path.
    - sshd(8): log an error if pipe() fails while accepting a connection.
    - ssh-keyscan(1): add missing *-sk types to ssh-keyscan manpage.
    - sshd(8): ensure that authentication passwords are cleared from memory
      in error paths.
    - ssh(1), ssh-agent(1): avoid possibility of notifier code executing
      kill(-1).
    - ssh_config(5): note that the ProxyJump directive also accepts the same
      tokens as ProxyCommand.
    - scp(1): do not ftruncate(3) files early when in sftp mode. The
      previous behaviour of unconditionally truncating the destination file
      would cause "scp ~/foo localhost:foo" and the reverse "scp
      localhost:foo ~/foo" to delete all the contents of their destination.
    - ssh-keygen(1): improve error message when 'ssh-keygen -Y sign' is
      unable to load a private key.
    - sftp(1), scp(1): when performing operations that glob(3) a remote
      path, ensure that the implicit working directory used to construct
      that path escapes glob(3) characters. This prevents glob characters
      from being processed in places they shouldn't, e.g. "cd /tmp/a*/",
      "get *.txt" should have the get operation treat the path "/tmp/a*"
      literally and not attempt to expand it (LP: #1483751).
    - ssh(1), sshd(8): be stricter in which characters will be accepted in
      specifying a mask length; allow only 0-9.
    - ssh-keygen(1): avoid printing hash algorithm twice when dumping a KRL.
    - ssh(1), sshd(8): continue running local I/O for open channels during
      SSH transport rekeying. This should make ~-escapes work in the client
      (e.g. to exit) if the connection happened to have stalled during a
      rekey event.
    - ssh(1), sshd(8): avoid potential poll() spin during rekeying.
    - Further hardening for sshbuf internals: disallow "reparenting" a
      hierarchical sshbuf and zero the entire buffer if reallocation fails.
    - sshd(8): add AUDIT_ARCH_PPC to supported seccomp sandbox
      architectures.
  * Drop patch to work around https://twistedmatrix.com/trac/ticket/9765,
    since the fix for that is in Debian testing.
  * Rewrite gnome-ssh-askpass(1) manual page using mdoc macros, and flesh it
    out a bit more.

[ Steve Langasek ]
  * Support systemd socket activation.  Migrate any existing inetd-style
    socket activation to systemd socket activation.

[ Gioele Barabucci ]
  * Remove ancient version constraints.
  * d/openssh-server.{postinst,config}: get_config_option: Replace perl with
    sed.

-- Nick Rosbrook <nick.rosbrook@canonical.com>  Wed, 24 May 2023 18:02:11 -0400

Changed in openssh (Ubuntu):
status:	Fix Committed → Fix Released

Benjamin Drung (bdrung) on 2023-10-23

tags:

removed: foundations-todo

Ubuntu
openssh package

openssh-server-1:9.2p1-2ubuntu1 cannot be installed from active ssh session

Bug Description

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntuopenssh package

openssh-server-1:9.2p1-2ubuntu1 cannot be installed from active ssh session

Bug Description

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
openssh package