From owner-freebsd-stable@FreeBSD.ORG Mon Mar 3 20:38:47 2014 Return-Path: Delivered-To: stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id AF8E4DE0; Mon, 3 Mar 2014 20:38:47 +0000 (UTC) Received: from roadkill.tharned.org (roadkill.tharned.org [75.145.12.185]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 54E5CAA1; Mon, 3 Mar 2014 20:38:47 +0000 (UTC) Received: from badger.tharned.org (badger.tharned.org [10.10.10.23]) (authenticated bits=0) by roadkill.tharned.org (8.14.7/8.14.7) with ESMTP id s23KcdOA033103 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 3 Mar 2014 14:38:45 -0600 (CST) (envelope-from gcr+freebsd-stable@tharned.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tharned.org; s=2014; t=1393879125; bh=RC3t4MK3MkWogrwiDUFO7EacLUrH2lm7bLUmJy5m7JQ=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=UrBoj+qQlGAPuqNHP3J5UntU0M30ZGu/XX/uOvXqYI8CYAwwMf0yOWDWoL0fK9z4g 0XETvBAu29M7OBHqLmDnQZI8JPUm2KsoIGz+svagLCTghPqrIj7kWx8LAH/+FUwEim s2I/BZtph1Xcr1NIHbPgUEM0XVY7XrpueyjKJX+JF6yG/nhcAV85igBxtFMXgbOvET 8J3PQLIhfSSSvvjFtHGz4hqp/eMAB6sr6koBG3Pac6ZKjY3gP7pkZZRc7cjLDZpqk9 1yYID1Q9Izt62ndnEhZ53rStZ+fbaFb+y43yhPLUD2Alt5+gPveCs4mMuBDETgoN3n TqrHoA75kwthg== Date: Mon, 3 Mar 2014 14:38:39 -0600 (CST) From: Greg Rivers To: Kevin Oberman Subject: Re: openssh in stable-10 broken config or sandbox In-Reply-To: Message-ID: References: <531184A8.4050909@freebsd.org> <53118E9C.5030804@freebsd.org> <5314D1F9.20909@intertainservices.com> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.4.3 (roadkill.tharned.org [75.145.12.185]); Mon, 03 Mar 2014 14:38:45 -0600 (CST) Cc: Mike Jakubik , Andrey Chernov , FreeBSD Stable ML , des@freebsd.org X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Mar 2014 20:38:47 -0000 On Mon, 3 Mar 2014, Kevin Oberman wrote: > On Mon, Mar 3, 2014 at 11:03 AM, Mike Jakubik < > mike.jakubik@intertainservices.com> wrote: > >> On 03/01/14 02:39, Andrey Chernov wrote: >> >>> On 01.03.2014 10:56, Andrey Chernov wrote: >>> >>>> Hi. >>>> Default /etc/ssh/sshd_config have >>>> #UsePrivilegeSeparation sandbox >>>> I.e. 'sandbox' by default. It breaks logins with error: >>>> sshd[81721]: fatal: ssh_sandbox_child: failed to limit the network >>>> socket [preauth] >>>> Fixed by using old way, i.e. direct >>>> UsePrivilegeSeparation yes >>>> instead of 'sandbox'. Please fix this bug. >>>> >>> Just find that capsicum is required now for default (i.e. sandbox) mode. >>> Don't think it is wise move, people may lost remote connections that >>> way, at least UPDATING entry is needed, but check for WITHOUT_CAPSICUM >>> for defaults will be better. >>> >>> >> Personally I find this to be a monumental screw up, such a drastic change >> and not even so much as an entry in UPDATING, what ever happened to POLA? >> > > +1 > > I didn't get bitten by this by the good fortune of seeing the first message > on this issue just minutes after I updated my system. Saw the change in > mergemaster, so immediately edited the installed file back to "yes". But, > if this had been a remote server, I would have been in deep weeds. This is > simply not acceptable practice! > Not to disagree, but I think we should tone down the flogging of a person who's working hard to make FreeBSD better. I'm sure this wasn't intentional, and the change probably passed all of his tests. If this were -RELEASE, I might feel differently, but it is -STABLE after all. I do certainly agree that an UPDATING entry would have been warranted. -- Greg