Bug 56147 - Adapt to OpenSSH 9.2p1-2
Summary: Adapt to OpenSSH 9.2p1-2
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: SSH
Version: UCS 5.2
Hardware: Other Linux
: P5 normal
Target Milestone: UCS 5.2
Assignee: Marius Meschter
QA Contact: Iván.Delgado
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-06-14 09:00 CEST by Philipp Hahn
Modified: 2024-08-26 09:17 CEST (History)
4 users (show)

See Also:
What kind of report is it?: Release Management
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Philipp Hahn univentionstaff 2023-06-14 09:00:33 CEST 
In OpenSSH "ChallangeResponseAuthentication" has been replaced my "KbdInteractiveAuthentication" and MUST be replaced; otherwise `ssh.service` will no longer start!

Also check for other deprecated options [7.9p1-10+deb10u2 … 9.2p1-2]:
- https://www.openssh.com/releasenotes.html
- https://univention-dist-binpkg-webgui.k8s.knut.univention.de/source/openssh/?since=5.0-0
Comment 1 Florian Best univentionstaff 2023-09-05 19:10:33 CEST 
(5.0-5) $ git grep -i ChallangeResponseAuthentication
→ I can't find any usage of it

So this is probably set via UCRv "sshd/config/.*"
Comment 2 Erik Damrose univentionstaff 2023-09-06 08:55:50 CEST 
There is a typo in the option in the initial bug description
(5.0-4) $ rgrep -i ChallengeResponseAuthentication | wc -l
11
Comment 4 Marius Meschter univentionstaff 2023-10-10 13:13:32 CEST 
Replaced "ChallangeResponseAuthentication" with "KbdInteractiveAuthentication" and added a new UCRv "sshd/KbdInteractiveAuthentication" which defaults to the old "sshd/challengeresponse". This only affects 5.2 and not 5.1 since Debian Bullseye has OpenSSH 8.4 and this change was introduced in OpenSSH 8.7.

Looked through OpenSSH changelogs for any other major changes since or deprecated options since 7.9.
Comment 5 Iván.Delgado univentionstaff 2023-10-11 12:32:06 CEST 
OK: code review
OK: test ucr set sshd/KbdInteractiveAuthentication=no
OK: changelog
Comment 6 Florian Best univentionstaff 2024-03-08 11:01:21 CET 
univention-base-files (11.0.4)
a457ee8f54b2 | Bug #56147: Adapt to OpenSSH 9.2p1-2