Comment 16 for bug 286337

I will volunteer happily! :)

Aras "Russ" Memisyazici
Systems Administrator

Office of Research
Virginia Tech

-----Original Message-----
From: Scott Kitterman <email address hidden>
Sent: Saturday, October 10, 2009 11:25 AM
To: Memisyazici, Aras <email address hidden>
Subject: [Bug 286337] Re: Please backport OpenSSH 5.1 to Hardy

This bug and the rationale for it has morphed a bit over time. Based on
the features being discussed, I can see where a backport might make
sense if we can test it adequately (meaning make sure it works with all
the rdepends). Is anyone up for doing the testing?

--
Please backport OpenSSH 5.1 to Hardy
https://bugs.launchpad.net/bugs/286337
You received this bug notification because you are a direct subscriber
of the bug.

Status in Hardy Heron Backports: Won't Fix

Bug description:
OpenSSH 4.9 - 5.1 has been out for some time but unfortunately wasn't placed into Hardy Heron.

It has a number of features which would are very interesting and should improve security. One of the most important features introduced in 5.1 according to my view is the chroot simplification.

OpenSSH now has a chroot option built-in which allows administrators to simplify their chroot installations a lot if they're only need SSH cli access and SFTP. This means fewer mis-configurations and improved overall security.

Basically, introducing a chroot setup with OpenSSH has become as simple as adding 2-3 lines in the sshd config file.

Since Hardy Heron is supposed to be an LTS version, I'm actually really surprised that this isn't in Hardy already. This is because the feature I'm describing here was introduced in OpenSSH 4.9 and Ubuntu Hardy is apparently using an even older version.

This gives me some concerns with regards to security in Hardy Heron and makes me (and my company) wonder if LTS is really the way to go.

Other changes include:

Added an extended test mode (-T) to sshd(8) to request that it write
   its effective configuration to stdout and exit. Extended test mode
   also supports the specification of connection parameters (username,
   source address and hostname) to test the application of
   sshd_config(5) Match rules.

ssh(1) and sshd(8): avoid unnecessary malloc/copy/free when receiving
   network data, resulting in a ~10% speedup

"Match group" blocks in sshd_config(5) now support negation of
   groups. E.g. "Match group staff,!guests" (bz#1315)

The sftp-server(8) manual now describes the requirements for
   transfer logging in chroot environments. (bz#1488)

Already introduced in OpenSSH 4.9 (!!!)

Added chroot(2) support for sshd(8), controlled by a new option
    "ChrootDirectory". Please refer to sshd_config(5) for details, and
    please use this feature carefully. (bz#177 bz#1352)

Linked sftp-server(8) into sshd(8). The internal sftp server is
    used when the command "internal-sftp" is specified in a Subsystem
    or ForceCommand declaration. When used with ChrootDirectory, the
    internal sftp server requires no special configuration of files
    inside the chroot environment. Please refer to sshd_config(5) for
    more information.