pam_env(sshd:session): deprecated reading of user environment enabled

[Romwriter]

Ubuntu 24.04 / openssh-server/noble-updates 1:9.6p1-3ubuntu3

sshd complains about "deprecated reading of user environment".

This should have been solved upstream, as far as I understand: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1018106

Enclosed /etc/pam.d/sshd file is amended according to the debian bug report.

ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: openssh-server 1:9.6p1-3ubuntu3
ProcVersionSignature: Ubuntu 6.8.0-11.11-generic 6.8.0-rc4
Uname: Linux 6.8.0-11-generic x86_64
ApportVersion: 2.28.0-0ubuntu1
Architecture: amd64
CasperMD5CheckResult: unknown
Date: Sun Mar 31 11:56:25 2024
ProcEnviron:
 LANG=de_DE.UTF-8
 PATH=(custom, no user)
 SHELL=/bin/bash
 TERM=xterm-256color
 XDG_RUNTIME_DIR=<set>
SourcePackage: openssh
UpgradeStatus: No upgrade log present (probably fresh install)
modified.conffile..etc.init.d.apport: [modified]
mtime.conffile..etc.init.d.apport: 2024-02-22T15:20:00
mtime.conffile..etc.pam.d.sshd: 2024-03-31T11:56:12.949543

[Andreas Hasenack (ahasenack)]

Fixing this in noble at this time will require a feature freeze exception, because we would be changing behavior.

The default for user_readenv in pam_env is 0 (off). In the sshd config, ubuntu/debian ship a pam config that sets it to on (1), therefore ~/.pam_environment will be read if it exists.

Upstream has flagged that this feature (of reading user-provided env var files) will be removed in the future, and is thus catching the setting of user_readenv=1 and showing the deprecation notice warning. To get rid of the warning, we have to stop setting user_readenv=1, which will *disable* the feature. Meaning, in noble, if we make this change, ~/.pam_environment (or the file specified by user_envfile) will NOT be read anymore.

Upstream marked this deprecation in version 1.5.0, which means ubuntu Mantic and Noble are affected.

Now is the right time to make this change: mantic had the deprecation notice already, and noble is an LTS.

[Andreas Hasenack (ahasenack)]

Deprecation warning introduced here: https://github.com/linux-pam/linux-pam/releases/tag/v1.5.0

Release notes for all releases up to 1.6.1 don't mention this again, so it's still there: https://github.com/linux-pam/linux-pam/releases

[Andreas Hasenack (ahasenack)]

Commit that added the warning to pam_env.c: https://github.com/linux-pam/linux-pam/commit/ecd526743a27157c5210b0ce9867c43a2fa27784

[Andreas Hasenack (ahasenack)]

We won't fix this in openssh for Ubuntu 24.04 due to the change in behavior that it introduces at this stage in the cycle, but it should be fixed in 24.10.

As for 24.04, what we will attempt to do is suppress the pam_env warning in the src:pam package.

[Andreas Hasenack (ahasenack)]

New pam package uploaded to noble-proposed. It's in the unapproved queue.

[Launchpad Janitor (janitor)]

This bug was fixed in the package pam - 1.5.3-5ubuntu5

---------------
pam (1.5.3-5ubuntu5) noble; urgency=medium

  * d/p/pam_env-remove-deprecation-notice-for-user_readenv.patch: drop
    deprecation warning about user_readenv from pam_env (LP: #2059859)

 -- Andreas Hasenack <email address hidden> Wed, 10 Apr 2024 16:19:22 -0300