Bug 56593 - adjust univention-ssh to openssh changed SSH_ASKPASS behavior
Summary: adjust univention-ssh to openssh changed SSH_ASKPASS behavior
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: SSH
Version: UCS 5.1
Hardware: Other Linux
: P5 normal
Target Milestone: UCS 5.1
Assignee: Florian Best
QA Contact: Christian Castens
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-09-15 10:07 CEST by Florian Best
Modified: 2025-02-05 15:08 CET (History)
2 users (show)

See Also:
What kind of report is it?: Development Internal
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Florian Best univentionstaff 2023-09-15 10:07:41 CEST
univention-ssh needs to be adjusted to changed openssh behavior for SSH_ASKPASS.

With additional SSH_ASKPASS_REQUIRE=force, it works as of openssh-8.4-p1 (this version is already in Debian 11 Bullseye; it should therefore no longer work there either). Since then, the default has changed: use_askpass = 0, allow_askpass = 0 and you have to use either prefer or force if STDIN is not a TTY; which it is not, because rsync needs that for communication with ssh.
This also means that the DISPLAY=:99 ... setsid hack can be omitted.

diff --git base/univention-ssh/univention-ssh.in base/univention-ssh/univention-ssh.in
index 942d8e5d0d..4766dd657b 100755
--- base/univention-ssh/univention-ssh.in
+++ base/univention-ssh/univention-ssh.in
@@ -206,12 +206,7 @@ try:
                 os.environ[UNIVENTION_SSH_ASKPASS_ENV] = password
                 # path to self
                 os.environ['SSH_ASKPASS'] = UNIVENTION_SSH_ASKPASS_HELPER
-                # DISPLAY must be non-empty
-                if 'DISPLAY' not in os.environ:
-                    os.environ['DISPLAY'] = ':99'
-
-                # create new session to force ssh to call SSH_ASKPASS
-                os.setsid()
+                os.environ['SSH_ASKPASS_REQUIRE'] = 'force'
 
                 os.execvp(command[0], command)  # noqa: S606
Comment 2 Christian Castens univentionstaff 2023-10-10 10:52:44 CEST
QA:
  - changelog/changelog-basis-other.56593.rst    OK
  - code review   OK
  - tested `SSH_ASKPASS_REQUIRE=force` by testing univention-ssh. Also installed an app from the appcenter remotely from a master on a slave.
Comment 3 Florian Best univentionstaff 2024-03-08 10:46:50 CET
univention-ssh (12.0.3)
c485ee4d3b86 | fix(univention-ssh): adjust to openssh change