(unstable) evolinux-base > ssh.yml - Security directives for Evolinux (Debian 10 or later) failing #52

New Issue

Closed

opened 2019-06-14 15:43:38 +02:00 by lpoujol · 3 comments

lpoujol commented

2019-06-14 15:43:38 +02:00

Owner

Seems this task produce invalid sshd config

TASK [evolinux-base : Security directives for Evolinux (Debian 10 or later)] ***
fatal: [debian10]: FAILED! => {"changed": false, "failed": true, "msg": "failed to validate: rc:255 error:'Match Address' in configuration but 'addr' not in connection test specification.\r\n"}

I had not the time to investigate more. I'll dive-in later.

I've assigned myself, but anyone can help ;)

Seems this task produce invalid sshd config ``` TASK [evolinux-base : Security directives for Evolinux (Debian 10 or later)] *** fatal: [debian10]: FAILED! => {"changed": false, "failed": true, "msg": "failed to validate: rc:255 error:'Match Address' in configuration but 'addr' not in connection test specification.\r\n"} ``` I had not the time to investigate more. I'll dive-in later. I've assigned myself, but anyone can help ;)

lpoujol added this to the Debian 11 (Buster) milestone 2019-06-14 15:43:38 +02:00

lpoujol self-assigned this 2019-06-14 15:43:38 +02:00

lpoujol added the

bug

label 2019-06-14 15:43:38 +02:00

lpoujol commented

2019-06-14 17:35:59 +02:00

Author

Owner

Seems to be the same issue reported here :

https://www.mail-archive.com/bugs@openbsd.org/msg10859.html

Seems to be the same issue reported here : https://www.mail-archive.com/bugs@openbsd.org/msg10859.html

lpoujol commented

2019-06-14 18:20:13 +02:00

Author

Owner

Ahem...

We should use -t instead of -T for config test.

It's seems the behaviour of -T is now more strict. And Match condition validation will expect a context with the -C argument.

Ahem... We should use `-t` instead of `-T` for config test. It's seems the behaviour of `-T` is now more strict. And Match condition validation will expect a context with the `-C` argument.

lpoujol referenced this issue from a commit

2019-06-17 09:47:39 +02:00

evolinux-base: Validate sshd config with "sshd -t" See #52 - It seems the behaviour changed with the recent releases, -T that does an extended test now fails on "Match" blocks when no context is given through -C

lpoujol commented

2019-06-17 09:48:00 +02:00

Author

Owner

Fixed in unstable :)

lpoujol closed this issue

2019-06-17 09:48:00 +02:00

lpoujol referenced this issue from a commit

2019-06-17 10:25:50 +02:00