AuthorizedPrincipalsCommand is ignored if AuthorizedKeysCommand is set

[Matthew Garrett]

[Impact]

User of openssh reported an issue that affects Lunar and Jammy.

If AuthorizedKeysCommand is set, an AuthorizedPrincipalsCommand configuration in sshd_config that comes after it is ignored. In this scenario, where AuthorizedPrincipalsCommand is needed and set, users relying on ssh certificates for authentication will be denied access.

[Test Plan]

Launch container:
$ lxc launch ubuntu:jammy <container-name>

Shell into that container:
$ lxc shell <container-name>

Create the main directory for our task (e.g. “reproducer”)
# mkdir reproducer

Go to that directory:
# cd reproducer

Create 2 more dirs that reflect users:
# mkdir certuser keyonlyuser

Go to the keyonlyuser:
# cd keyonlyuser

Do:
# ssh-keygen -t ed25519 -f key

Go to the certuser:
# cd /root/reproducer/certuser/

Do:
# ssh-keygen -t rsa -f ca
# ssh-keygen -t ed25519 -f key
# ssh-keygen -s ca -I key_id -n certuser key.pub

Create a script '/root/reproducer/authorized_principals' with permissions 755 as follows:
#!/bin/sh
if [ "$1" = "otheruser" ]; then
echo certuser
fi

Exit the file.

Ensure you are in the /root/reproducer/ directory:
# adduser --disabled-password otheruser
(Enter multiple times, leave all fields blank)

Then do the same for another user:
# adduser --disabled-password keyonlyuser

Create a script '/root/reproducer/authorized_keys' with permissions 755 as follows:
#!/bin/sh
if [ "$1" = "keyonlyuser" ]; then
echo <key.pub from keyonlyuser e.g. ssh-ed25519 AAAdjakdjaskdajd>
fi

Go to the /etc/ssh/sshd_config file.
Add at the top:

AuthorizedKeysCommand /root/reproducer/authorized_keys %u
AuthorizedKeysCommandUser root

AuthorizedPrincipalsCommand /root/reproducer/authorized_principals %u
AuthorizedPrincipalsCommandUser root

TrustedUserCAKeys /root/reproducer/certuser/ca.pub

Exit from the file and restart the ssh service:
# systemctl restart ssh

Use these commands to manifest the bug:

# ssh keyonlyuser@localhost -i /root/reproducer/keyonlyuser/key

# ssh otheruser@localhost -i /root/reproducer/certuser/key -o CertificateFile=/root/reproducer/certuser/key-cert.pub

Expected results: both ssh commands should succeed.

Actual results: the second ssh fails because the AuthorizedPrincipalsCommand is ignored if AuthorizedKeysCommand is set.

[Where problems could occur]

* The patch itself modifies only the servconf.c, so regressions should be limited to the server configuration.

* Since the fix touches pointers, there might be regression related to memory handling and fetching data.

---------------------------------original report--------------------------

Versions of OpenSSH from 8.7p1 to 9.3p1 contain the following code:

                if (*activep && options->authorized_keys_command == NULL)
                        *charptr = xstrdup(str + len);

However, this is executed for both authorized_keys_command and authorized_principals_command. As a result, if authorized_keys_command is set (for instance, if using ec2-instance-connect), any AuthorizedPrincipalsCommand configuration in sshd_config is ignored. This is fixed in 9.4p1 with the attached patch.

[Matthew Garrett (mjg59)]

Upstream bug: https://bugzilla.mindrot.org/show_bug.cgi?id=3574

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "fix-parsing.diff" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Michał Małoszewski (michal-maloszewski99)]

Hi, I assigned myself to the bug and I will deal with it :)

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssh - 1:9.3p1-1ubuntu3

---------------
openssh (1:9.3p1-1ubuntu3) mantic; urgency=medium

  * d/p/fix-authorized-principals-command.patch: Fix the situation where
    sshd ignores AuthorizedPrincipalsCommand if AuthorizedKeysCommand
    is also set by checking if the value pointed to by the pointer
    'charptr' is NULL. (LP: #2031942)

 -- Michal Maloszewski <email address hidden> Thu, 24 Aug 2023 15:20:27 +0200

[Andreas Hasenack (ahasenack)]

Hello Matthew, or anyone else affected,

Accepted openssh into lunar-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/openssh/1:9.0p1-1ubuntu8.5 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-lunar to verification-done-lunar. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-lunar. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

Hello Matthew, or anyone else affected,

Accepted openssh into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/openssh/1:8.9p1-3ubuntu0.4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted openssh (1:9.0p1-1ubuntu8.5) for lunar have finished running.
The following regressions have been reported in tests triggered by the package:

ganeti/3.0.2-3 (armhf)
gvfs/1.50.4-1 (arm64)
lava/unknown (amd64)
oz/unknown (i386)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/lunar/update_excuses.html#openssh

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted openssh (1:8.9p1-3ubuntu0.4) for jammy have finished running.
The following regressions have been reported in tests triggered by the package:

ganeti/3.0.2-1ubuntu1 (armhf)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/jammy/update_excuses.html#openssh

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Andreas Hasenack (ahasenack)]

All autopkgtests have been cleared after retries (both lunar and jammy ones).

[Lena Voytek (lvoytek)]

Verified for lunar and jammy:

# lxc launch ubuntu:jammy test-openssh-lunar
# lxc exec test-openssh-lunar bash

# cat <<EOF >/etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
# Enable Ubuntu proposed archive
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF

# apt update && apt dist-upgrade -y

# mkdir reproducer
# cd reproducer
# mkdir certuser keyonlyuser
# cd keyonlyuser

# ssh-keygen -t ed25519 -f key
Generating public/private ed25519 key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in key
Your public key has been saved in key.pub
...

# cd ../certuser/

# ssh-keygen -t rsa -f ca
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in ca
Your public key has been saved in ca.pub

# ssh-keygen -t ed25519 -f key
Generating public/private ed25519 key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in key
Your public key has been saved in key.pub

# ssh-keygen -s ca -I key_id -n certuser key.pub
Signed user key key-cert.pub: id "key_id" serial 0 for certuser valid forever

# cd ..
# cat <<EOF >authorized_principals
#!/bin/sh
if [ "$1" = "otheruser" ]; then
echo certuser
fi
EOF

# chmod 755 authorized_principals

# adduser --disabled-password otheruser
Adding user `otheruser' ...
Adding new group `otheruser' (1001) ...
Adding new user `otheruser' (1001) with group `otheruser' ...
Creating home directory `/home/otheruser' ...
Copying files from `/etc/skel' ...
Changing the user information for otheruser
Enter the new value, or press ENTER for the default
 Full Name []:
 Room Number []:
 Work Phone []:
 Home Phone []:
 Other []:
Is the information correct? [Y/n] y

# adduser --disabled-password keyonlyuser
Adding user `keyonlyuser' ...
Adding new group `keyonlyuser' (1002) ...
Adding new user `keyonlyuser' (1002) with group `keyonlyuser' ...
Creating home directory `/home/keyonlyuser' ...
Copying files from `/etc/skel' ...
Changing the user information for keyonlyuser
Enter the new value, or press ENTER for the default
 Full Name []:
 Room Number []:
 Work Phone []:
 Home Phone []:
 Other []:
Is the information correct? [Y/n] y

# cat <<EOF >authorized_keys
#!/bin/sh
if [ "$1" = "keyonlyuser" ]; then
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBbBpE1TDzG48CLKI6bWQbIE87ke4ZJmgFQ0LFnYyikT root@test-openssh-lunar"
fi
EOF

# chmod 755 authorized_keys

# vi /etc/ssh/sshd_config
i
AuthorizedKeysCommand /root/reproducer/authorized_keys %u
AuthorizedKeysCommandUser root

AuthorizedPrincipalsCommand /root/reproducer/authorized_principals %u
AuthorizedPrincipalsCommandUser root

TrustedUserCAKeys /root/reproducer/certuser/ca.pub
[esc]
:wq

# systemctl restart ssh

# ssh keyonlyuser@localhost -i /root/reproducer/keyonlyuser/key
The authenticity of host 'localhost (127.0.0.1)' can't be established.
ED25519 key fingerprint is SHA256:hCVcIK0Q/jBlQqqyEAcGnxgXnd46/kaT7j+78BobN2E.
This key is not known by any other names
Are you sure you want to continue...

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssh - 1:9.0p1-1ubuntu8.5

---------------
openssh (1:9.0p1-1ubuntu8.5) lunar; urgency=medium

  * d/p/fix-authorized-principals-command.patch: Fix the situation where
    sshd ignores AuthorizedPrincipalsCommand if AuthorizedKeysCommand
    is also set by checking if the value pointed to by the pointer
    'charptr' is NULL. (LP: #2031942)

 -- Michal Maloszewski <email address hidden> Thu, 24 Aug 2023 15:52:47 +0200

[Andreas Hasenack (ahasenack)]

The verification of the Stable Release Update for openssh has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssh - 1:8.9p1-3ubuntu0.4

---------------
openssh (1:8.9p1-3ubuntu0.4) jammy; urgency=medium

  * d/p/fix-authorized-principals-command.patch: Fix the situation where
    sshd ignores AuthorizedPrincipalsCommand if AuthorizedKeysCommand
    is also set by checking if the value pointed to by the pointer
    'charptr' is NULL. (LP: #2031942)

 -- Michal Maloszewski <email address hidden> Thu, 24 Aug 2023 15:40:24 +0200