#36291: openssh sshd won't accept incoming connections --------------------------+------------------- Reporter: beckettbt@… | Owner: jwa@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.1.2 Resolution: | Keywords: Port: openssh | --------------------------+------------------- Changes (by cal@…): * owner: macports-tickets@… => jwa@… Comment: Please remember to Cc the maintainer when reporting tickets. Does `/usr/lib/libsandbox.1.dylib` exist on your system? -- Ticket URL: <https://trac.macports.org/ticket/36291#comment:1> MacPorts <http://www.macports.org/> Ports system for Mac OS

#36291: openssh sshd won't accept incoming connections --------------------------+------------------- Reporter: beckettbt@… | Owner: jwa@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.1.2 Resolution: | Keywords: Port: openssh | --------------------------+------------------- Comment (by beckettbt@…): Replying to [comment:1 cal@…]:

Please remember to Cc the maintainer when reporting tickets.

Does `/usr/lib/libsandbox.1.dylib` exist on your system?

Yes. $ls /usr/lib/libsandbox.1.dylib /usr/lib/libsandbox.1.dylib -- Ticket URL: <https://trac.macports.org/ticket/36291#comment:3> MacPorts <http://www.macports.org/> Ports system for Mac OS

#36291: openssh sshd won't accept incoming connections --------------------------+------------------- Reporter: beckettbt@… | Owner: jwa@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.1.2 Resolution: | Keywords: Port: openssh | --------------------------+------------------- Comment (by joshua.newton@…): Confirmed on 10.8.2 x86_64. -- Ticket URL: <https://trac.macports.org/ticket/36291#comment:6> MacPorts <http://www.macports.org/> Ports system for Mac OS

#36291: openssh sshd won't accept incoming connections --------------------------+------------------- Reporter: beckettbt@… | Owner: jwa@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.1.2 Resolution: | Keywords: Port: openssh | --------------------------+------------------- Comment (by macintosh@…): is this a macports only problem -or- is it an upstream problem ??? -- Ticket URL: <https://trac.macports.org/ticket/36291#comment:11> MacPorts <http://www.macports.org/> Ports system for Mac OS

#36291: openssh sshd won't accept incoming connections --------------------------+------------------- Reporter: beckettbt@… | Owner: jwa@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.1.2 Resolution: | Keywords: Port: openssh | --------------------------+------------------- Comment (by swordangel@…): This problem still exists with openssh @6.2p2_3, from MacPorts 2.2.0, under Mac OS X Lion. -- Ticket URL: <https://trac.macports.org/ticket/36291#comment:14> MacPorts <http://www.macports.org/> Ports system for OS X

#36291: openssh sshd won't accept incoming connections --------------------------+------------------- Reporter: beckettbt@… | Owner: jwa@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.1.2 Resolution: | Keywords: Port: openssh | --------------------------+------------------- Comment (by khepler@…): Here is debug output from a Macports OpenSSH server running on 10.8.4 x86_64: {{{ puadn:~ kris$ sudo /opt/local/sbin/sshd -ddd debug2: load_server_config: filename /opt/local/etc/ssh/sshd_config debug2: load_server_config: done config len = 253 debug2: parse_server_config: config /opt/local/etc/ssh/sshd_config len 253 debug3: /opt/local/etc/ssh/sshd_config:13 setting Port 6422 debug3: /opt/local/etc/ssh/sshd_config:50 setting AuthorizedKeysFile .ssh/authorized_keys debug3: /opt/local/etc/ssh/sshd_config:105 setting UsePrivilegeSeparation sandbox debug3: /opt/local/etc/ssh/sshd_config:121 setting Subsystem sftp /opt/local/libexec/sftp-server debug1: sshd version OpenSSH_6.2, OpenSSL 1.0.1e 11 Feb 2013 debug3: Incorrect RSA1 identifier debug1: read PEM private key done: type RSA debug1: private host key: #0 type 1 RSA debug3: Incorrect RSA1 identifier debug1: read PEM private key done: type DSA debug1: private host key: #1 type 2 DSA debug1: could not open key file '/opt/local/etc/ssh/ssh_host_ecdsa_key': No such file or directory Could not load host key: /opt/local/etc/ssh/ssh_host_ecdsa_key debug1: rexec_argv[0]='/opt/local/sbin/sshd' debug1: rexec_argv[1]='-ddd' debug2: fd 4 setting O_NONBLOCK debug1: Bind to port 6422 on 0.0.0.0. Server listening on 0.0.0.0 port 6422. debug2: fd 5 setting O_NONBLOCK debug3: sock_set_v6only: set socket 5 IPV6_V6ONLY debug1: Bind to port 6422 on ::. Server listening on :: port 6422. debug1: fd 6 clearing O_NONBLOCK debug1: Server will not fork when running in debugging mode. debug3: send_rexec_state: entering fd = 9 config len 253 debug3: ssh_msg_send: type 0 debug3: send_rexec_state: done debug1: rexec start in 6 out 6 newsock 6 pipe -1 sock 9 debug1: inetd sockets after dupping: 5, 5 Connection from x.x.x.x port 51775 debug1: Client protocol version 2.0; client software version OpenSSH_5.9p1-hpn13v11 debug1: match: OpenSSH_5.9p1-hpn13v11 pat OpenSSH_5* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.2 debug2: fd 5 setting O_NONBLOCK debug3: ssh_sandbox_init: preparing Darwin sandbox debug2: Network child is on pid 2892 debug3: preauth child monitor started debug3: privsep user:group 75:75 [preauth] debug1: permanently_set_uid: 75/75 [preauth] debug3: ssh_sandbox_child: starting Darwin sandbox [preauth] ssh_sandbox_child: sandbox_init: dlopen(/usr/lib/libsandbox.1.dylib, 261): image not found [preauth] debug1: do_cleanup [preauth] debug1: monitor_read_log: child log fd closed debug3: mm_request_receive entering debug1: do_cleanup debug1: Killing privsep child 2892 puadn:~ kris$ }}} -- Ticket URL: <https://trac.macports.org/ticket/36291#comment:16> MacPorts <http://www.macports.org/> Ports system for OS X

#36291: openssh sshd won't accept incoming connections --------------------------+---------------------- Reporter: beckettbt@… | Owner: cal@… Type: defect | Status: assigned Priority: Normal | Milestone: Component: ports | Version: 2.1.2 Resolution: | Keywords: Port: openssh | --------------------------+---------------------- Changes (by cal@…): * status: new => assigned * owner: jwa@… => cal@… Comment: Should be fixed in r116989 without reverting to `UsePrivilegeSeparation yes` and preserving the sandboxing feature. -- Ticket URL: <https://trac.macports.org/ticket/36291#comment:20> MacPorts <http://www.macports.org/> Ports system for OS X

#36291: openssh sshd won't accept incoming connections --------------------------+-------------------- Reporter: beckettbt@… | Owner: cal@… Type: defect | Status: closed Priority: Normal | Milestone: Component: ports | Version: 2.1.2 Resolution: fixed | Keywords: Port: openssh | --------------------------+-------------------- Comment (by beckettbt@…): Installed this new version. (Note: Had to add "UsePAM yes" in my sshd.config, by default it is disabled but as noted in patch/version changelog is required.) Tried connecting: ssh 192.168.1.10 -p2222 Connection closed by 192.168.1.10 Log shows: sshd: fatal: ssh_sandbox_child: sandbox_init: dlopen(/usr/lib/libsandbox.1.dylib, 261): image not found [preauth] If I change UsePrivilegeSeparation back to yes, I can connect. But this appears to conflict with the purpose of the latest update. Please advise. -- Ticket URL: <https://trac.macports.org/ticket/36291#comment:22> MacPorts <http://www.macports.org/> Ports system for OS X

#36291: openssh sshd won't accept incoming connections --------------------------+-------------------- Reporter: beckettbt@… | Owner: cal@… Type: defect | Status: closed Priority: Normal | Milestone: Component: ports | Version: 2.1.2 Resolution: fixed | Keywords: Port: openssh | --------------------------+-------------------- Comment (by cal@…): Sounds like 10.5's sandbox mechanism doesn't yet support the keywords used by the sandbox file source:trunk/dports/net/openssh/files/org.openssh.sshd.sb. Feel free to find out which commands don't work and patch them yourself on 10.5, or switch back to calling `sandbox_init(3)` with a predefined sandbox (i.e. reverting source:trunk/dports/net/openssh/files/patch-sandbox-darwin.c -apple-sandbox-named-external.diff). I'm not going to work on 10.5 support. -- Ticket URL: <https://trac.macports.org/ticket/36291#comment:24> MacPorts <http://www.macports.org/> Ports system for OS X

#36291: openssh sshd won't accept incoming connections --------------------------+-------------------- Reporter: beckettbt@… | Owner: cal@… Type: defect | Status: closed Priority: Normal | Milestone: Component: ports | Version: 2.1.2 Resolution: fixed | Keywords: Port: openssh | --------------------------+-------------------- Comment (by dluke@…): Replying to [comment:25 dluke@…]:

Replying to [comment:24 cal@…]:

...

switch back to calling `sandbox_init(3)` with a predefined sandbox (i.e. reverting source:trunk/dports/net/openssh/files/patch-sandbox- darwin.c-apple-sandbox-named-external.diff).

I'll test this, as it should just restore the previous (6.4) behavior. If it works, will you accept a patch for it?

nevermind, it's nomaintainer, so I'll just commit a patch if it works ;-) -- Ticket URL: <https://trac.macports.org/ticket/36291#comment:26> MacPorts <http://www.macports.org/> Ports system for OS X

#36291: openssh sshd won't accept incoming connections --------------------------+-------------------- Reporter: beckettbt@… | Owner: cal@… Type: defect | Status: closed Priority: Normal | Milestone: Component: ports | Version: 2.1.2 Resolution: fixed | Keywords: Port: openssh | --------------------------+-------------------- Comment (by dluke@…): Replying to [comment:26 dluke@…]:

nevermind, it's nomaintainer, so I'll just commit a patch if it works ;-)

r117010 -- Ticket URL: <https://trac.macports.org/ticket/36291#comment:28> MacPorts <http://www.macports.org/> Ports system for OS X