[Bug 1863930] Re: SSH 1.99 clients fail to connect to openssh-server 1:7.6p1-4ubuntu0.3

[Łukasz Zemczak]

Thank you for the detailed test case, rationale and security-team review
of the patches! I have accepted those into bionic-proposed and added,
for the time being, a block-proposed-bionic tag. I am still not sure
about the severity of this bug.

As I don't work on the openssh package, I'd like to leave the decision
to the Server and Security teams. Are there any other changes scheduled
to be released shortly? Do you think it's worth releasing to -updates
even now? From the SRU perspective I'm +0, since it always is a concern
that many users will get the update, but on the other hand if a certain
set of users is broken, medium prio bugs are also good to fix. If it's
decided that we want it, please remove the block tag.

** Tags added: block-proposed-bionic

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1863930

Title:
  SSH 1.99 clients fail to connect to openssh-server 1:7.6p1-4ubuntu0.3

Status in openssh package in Ubuntu:
  Fix Released
Status in openssh source package in Bionic:
  Fix Committed

Bug description:
  [Impact]

   * The version check in ssh was broken no more following RFC 4253 and
     thereby denying some clients that it shouldn't. 

     https://datatracker.ietf.org/doc/html/rfc4253#section-5.1

   * It is intended for clients reporting SSH-1.99 to be treated as if 
     they were advertising SSH-2.0, but with some backwards compatibility.

   * Upstream fixed that, and this request is to back-port the changes into
     18.04 Bionic.

   * In practice this is affecting clients using the SolarWinds
  monitoring agent. Solarwinds SSH client advertises SSH-1.99 and Ubuntu
  18.04 openssh-server is refusing the connection.

   * This results in the following error in the auth.log, and a failed
  connection from the agent.

  Protocol major versions differ for <IP> port <port>:
    SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3 vs. SSH-1.99-WeOnlyDo.Net

   * More information from SolarWinds at the link below. They call out
  18.04 as affected and recommend upgrading OpenSSH-server to 7.7 or
  greater.

  https://support.solarwinds.com/SuccessCenter/s/article/SAM-s-Linux-
  Unix-Script-monitor-fails-to-connect-on-a-server-running-
  OpenSSH-7-6?language=en_US

  [Test Case]

   # Prep
   * configure the ssh server to generally work
   # Testcase
   $ wget https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1863930/+attachment/5332797/+files/test_bug_1863930.py
   $ apt install python3-paramiko
   $ python3 test_bug_1863930.py localhost (or whatever your host is)

   Will report "Server is not patched." or "Server is patched.

   * for an extra regression check it might be worth to do some "normal" ssh
     connections as well

  [Regression Potential]

   * The change is very small and reviewable as well as being upstream and
     in all Ubuntu releases >=Cosmic for a while now so it seems safe.
     If anything the kind of regression to expect is that some former
     (wrong) connection denials will then succeed. I can only think of
     that being an issue in test suites but not in the real world.

  [Other Info]

   * n/a

  --

  SSHD closes the connection and logs the error message below when a
  client presents a protoversion of "1.99":

      Protocol major versions differ for X.X.X.X port X:
  SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3 vs. SSH-1.99-XXX

  RFC 4253 only states that clients should treat a server's protoversion
  of "1.99" as equivalent to "2.0"; however, some backward-compatible
  clients send a protoversion of "1.99" and expect the server to treat
  it as "2.0".

  This regression was introduced in openssh-portable 7.6p1 from commit
  97f4d3083; fixes were implemented in commits 9e9c4a7e5 and c9c1bba06.
  I've attached a patch with both of those fixes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1863930/+subscriptions