[SOLVED] sshd: invalid DenyUsers pattern

HMW · 10-26-2017, 02:44 AM

I want to block external access via ssh for a particular user, and this works with:

Code:

OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013

On:

Code:

CentOS release 6.9 (Final)

Excerpt from sshd_config:

Code:

# Deny this user if not from this host
DenyUsers foobar@!192.168.26.128,

The above works perfectly. User foobar can only log in from 192.168.26.128 and not from anywhere else.

However, when trying to implement this with:

Code:

OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017

On:

Code:

Red Hat Enterprise Linux Server release 7.4 (Maipo)

I get this error message:

Code:

/etc/ssh/sshd_config line 89: invalid DenyUsers pattern: "foobar@!192.168.26.128,"

Excerpt form sshd_config:

Code:

DenyUsers foobar@!192.168.26.128,

This is extremely annoying, and I have not found any info on what has changed in the different versions. Any help would be appreciated!

Best regards,
HMW

Turbocapitalist · 10-26-2017, 03:36 AM

USER and HOST are supposed to be checked separately and since patterns can be used, and they used to work, they should still work in the newer versions for HOST:

" DenyUsers
This keyword can be followed by a list of user name patterns, separated by spaces. Login is disallowed for user names that match one of the patterns. Only user names are valid; a numerical user ID is not recognized. By default, login is allowed for all users. If the pattern takes the form USER@HOST then USER and HOST are separately checked, restricting logins to particular users from particular hosts. HOST criteria may additionally contain addresses to match in CIDR address/masklen format. The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.

See PATTERNS in ssh_config(5) for more information on patterns."

I'd say it's probably a bug. Report it for your distro.

HMW · 10-26-2017, 03:40 AM

Quote:

Originally Posted by Turbocapitalist

USER and HOST are supposed to be checked separately and since patterns can be used, and they used to work, they should still work in the newer versions for HOST:

" DenyUsers
This keyword can be followed by a list of user name patterns, separated by spaces. Login is disallowed for user names that match one of the patterns. Only user names are valid; a numerical user ID is not recognized. By default, login is allowed for all users. If the pattern takes the form USER@HOST then USER and HOST are separately checked, restricting logins to particular users from particular hosts. HOST criteria may additionally contain addresses to match in CIDR address/masklen format. The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.

See PATTERNS in ssh_config(5) for more information on patterns."

I'd say it's probably a bug. Report it for your distro.

Thanks for your reply. Unfortunately I tested this on Debian 9, and the bug is there too. So it's not distro-specific. Negation simply does not seem to work well with openSSH?

Turbocapitalist · 10-26-2017, 04:09 AM

Quote:

Originally Posted by HMW

Unfortunately I tested this on Debian 9, and the bug is there too. So it's not distro-specific.

Then it might be a regression upstream. Did the release notes between now and the last version that worked have any mention of changing how patterns are done with DenyUsers?

http://www.openssh.com/txt/

Edit: I found nothing direct but there were two changes that might be related.

http://www.openssh.com/txt/release-7.4
http://www.openssh.com/txt/release-6.1

michaelk · 10-26-2017, 04:24 AM

Looks like a bug that has not been fixed yet?

https://bugzilla.mindrot.org/show_bug.cgi?id=2397

HMW · 10-26-2017, 05:18 AM

Thank you both for your replies. Yes, it seems that this is indeed a bug.
This:

Quote:

To calibrate expectations, there's little chance all of these are going to make 7.6.

..was not very comforting. I will have to try and implement a solution that does not require negation for now - even though it will make it more cumbersome.

HMW · 10-26-2017, 11:23 AM

If anyone finds this post, the solution is to use this syntax:

Code:

DenyUsers localuser@*,!10.8.0.*

When implementing on recent versions of openSSH.

Ergo; this:

Code:

DenyUsers foobar@!192.168.26.128,

...on legacy versions of openSSH

Becomes this:

Code:

DenyUsers foobar@*,!192.168.26.128

...on current versions of openSSH