Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-5279

Cannot login when sshd configuration is larger than 256KB

    • openssh-8.0p1-21.el8
    • None
    • Important
    • 1
    • rhel-sst-security-crypto
    • ssg_security
    • 26
    • 1
    • QE ack
    • False
    • Hide

      None

      Show
      None
    • Yes
    • Crypto24Q1
    • Bug Fix
    • Hide
      .Large SSHD configuration files no longer prevent login

      Previously, when the SSHD configuration file was larger than 256 KB, an error occurred when logging into the system. As a consequence, remote systems were unreachable. This update removes the file size limitation, and therefore users can log in to the system when the SSHD configuration file is larger than 256 KB.
      Show
      .Large SSHD configuration files no longer prevent login Previously, when the SSHD configuration file was larger than 256 KB, an error occurred when logging into the system. As a consequence, remote systems were unreachable. This update removes the file size limitation, and therefore users can log in to the system when the SSHD configuration file is larger than 256 KB.
    • Done
    • None

      Description of problem:

      When the sshd configuration file is larger than 256K (main /etc/ssh/sshd_config + includes), it's not possible to log in to the system anymore and the following message is recorded in the journal:
      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
      Feb 14 12:10:48 vm-rhel8 sshd[2979]: error: ssh_msg_recv: read: bad msg_len 618704
      Feb 14 12:10:48 vm-rhel8 sshd[2979]: fatal: recv_rexec_state: ssh_msg_recv failed
      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

      On the client side, the ssh process hangs forever.

      The root cause for this is the size of the configuration which cannot be sent to the ssh connection handler, due to the size being larger than 256KB:
      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
      139 void
      140 mm_request_receive(int sock, struct sshbuf *m)
      141 {
      :
      153 msg_len = PEEK_U32(buf);
      154 if (msg_len > 256 * 1024)
      155 fatal("%s: read: bad msg_len %d", _func_, msg_len);
      :
      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

      The ssh connection handler exits on error, but the main sshd process hangs on sending the configuration.
      This additionally leads to not handling incoming connections anymore and restart of the service to take a long time (1min30) due to Stop timeout.

      Version-Release number of selected component (if applicable):

      openssh-server-8.0p1-16.el8.x86_64

      How reproducible:

      Always

      Steps to Reproduce:
      1. Generate a large configuration file

      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

      1. for i in $(seq 1 10000); do echo -e "Match Group GRP$i\nChrootDirectory /some/path/for/group/$i" >> /etc/ssh/sshd_config; done
                    • 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

      2. Restart the service

      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

      1. systemctl restart sshd
                    • 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

      3. Try connecting

      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
      $ ssh localhost
      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

      Actual results:

      Hang of ssh client and message on sshd side

      Expected results:

      No hang, prompt being displayed

      Additional info:

      Doesn't affect RHEL9.

              dbelyavs@redhat.com Dmitry Belyavskiy
              rhn-support-rmetrich Renaud Métrich
              Dmitry Belyavskiy Dmitry Belyavskiy
              Miluse Bezo Konecna Miluse Bezo Konecna
              Jan Fiala Jan Fiala
              Votes:
              0 Vote for this issue
              Watchers:
              11 Start watching this issue

                Created:
                Updated:
                Resolved: