[Bug 2077576] Re: SSH client doesn't handle properly non-ASCII chars
Steve Langasek
2077576 at bugs.launchpad.net
Thu Oct 3 01:21:31 UTC 2024
Ok that's correct, at the time of review Tobias was a member of the
security team so I think we can take that as the necessary sign-off.
--
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/2077576
Title:
SSH client doesn't handle properly non-ASCII chars
Status in openssh package in Ubuntu:
Fix Released
Status in openssh source package in Focal:
Incomplete
Status in openssh source package in Jammy:
Incomplete
Status in openssh source package in Noble:
Fix Released
Bug description:
[ Impact ]
Non-ascii visible chars (including back-slashes, new lines and so) are
not properly rendered by clients, showing their octal visualization.
Such as:
Β Β Hello SSHD \\ We love \360\237\215\225!
Instead of:
Β Β Hello SSHD \ We love π!
This is particularly an issue when a server has configured keyboard
interactive authentication and a PAM module wants to show non-ASCII
characters such as a QR code for web authentication:
When using an ubuntu server running authd for web authentication we
may end up having the login qrcode rendered such as
\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210\342\226\210
Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β https://ubuntu.com
Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β Β 1337
Which is clearly unreadable.
[ Test case ]
## Server preparation
Enable PAM and keyboard interactive authentication in a ssh server:
Add a configuration file such as:
Β /etc/ssh/sshd_config.d/test-ssh-pam.conf
Containing:
Β UsePAM yes
Β KbdInteractiveAuthentication yes# This was working already; here to check potential regressions
Β ForceCommand bash -c "echo Hello from SSHD \ We also love π!; $SHELL"
It's also suggested to check for regressions using a `Banner` option
in sshd, pointing to a file with utf-8 contents:
Β echo "Hello" | qrencode -t ansiutf8 > /tmp/ssh-banner
Β Banner /tmp/ssh-banner
Restart the server:
Β Β sudo systemctl restart ssh.service
Edit the sshd PAM configuration file, adding as first line:
Β Β auth requisite pam_echo.so Hello SSHD \ We love π!
Can be done with the command:
Β Β sudo sed '1 iauth requisite pam_echo.so Hello SSHD! \\ We love π!' \
Β Β Β -i /etc/pam.d/sshd
## Client test
In the same host:
Β ssh -o PubkeyAuthentication=no \
Β Β Β Β Β -o PasswordAuthentication=no \
Β Β Β Β Β -o PreferredAuthentications=keyboard-interactive \
Β Β Β Β Β $USER at localhost
The client should show:
Hello SSHD \ We love π!
($USER at localhost) Password:
...
Hello from SSHD \ We also love π!
βββββββββββββββββββββββββββββ
βββββββββββββββββββββββββββββ
ββββ βββββ βββ β β βββββ ββββ
ββββ β β βββββββ β β ββββ
ββββ βββββ β βββ βββββ ββββ
ββββββββββββ ββββββββββββββββ
ββββ βββββ βββ βββ βββ βββββ
ββββ ββββ ββββββββ ββ ββββ
ββββββββββββ βββ βββββββββ
ββββ βββββ βββββββ β ββ βββββ
ββββ β β ββββββ βββββ ββββ
ββββ βββββ ββ β βββββββββββββ
βββββββββββββββββββββββββββββ
βββββββββββββββββββββββββββββ
βββββββββββββββββββββββββββββ
Retry the same with another host and without keyboard authentication enabled in the server side.
To verify the fix in more complex scenario it's possible to follow the instructions of configuring authd:
Β - https://github.com/ubuntu/authd/wiki/05--How%E2%80%90to-log-in-over-SSH
Once authd is configured, the user should be able to scan a QrCode
from a ssh session.
## Cleanup
Revert the changes done in the cleanup phase, after test is done
sudo sed '/pam_echo\.so/d' -i /etc/pam.d/sshd
sudo rm /etc/ssh/sshd_config.d/test-ssh-pam.conf
# Further testing
It's also required to check if other configurations using keyboard
interactive such as TOTP/HOTP access still work:
https://ubuntu.com/server/docs/openssh-server#two-factor-
authentication-with-totphotp
# Authd testing
- Configurand install authd and MsEntraID broker as described at:
Β Β https://github.com/ubuntu/authd/wiki/01---Get-started-with-authd
- Configure SSHd and try to login using the Qrcode as documented at
Β Β https://github.com/ubuntu/authd/wiki/05--How%E2%80%90to-log-in-over-SSH
- Accessing via SSH to a machine via QrCode should show a properly rendered
Β Β qrcode
[ Regression potential ]
SSH info messages are not shown by the client. Even though those
aren't covered by this change, it's important to check for regressions
in any output that SSH exposes to the user. So banners and other
messages should be checked for regressions.
These kind of messages are normally shown only when PAM *and* keyboard
interaction are enabled in the server side, so it should not affect
the default ubuntu servers behavior.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2077576/+subscriptions
More information about the foundations-bugs
mailing list