Re: bin/60512: sshd: hosts.deny and hosts.allow for NetBSD 10 not working for 11

["Taylor R Campbell via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR bin/60512; it has been noted by GNATS.

From: Taylor R Campbell <riastradh%NetBSD.org@localhost>
To: Rin Okuyama <rokuyama.rk%gmail.com@localhost>,
	Martin Husemann <martin%duskware.de@localhost>,
	Brian Buhrow <buhrow%NetBSD.org@localhost>
Cc: gnats-bugs%NetBSD.org@localhost, netbsd-bugs%NetBSD.org@localhost
Subject: Re: bin/60512: sshd: hosts.deny and hosts.allow for NetBSD 10 not working for 11
Date: Tue, 28 Jul 2026 13:18:48 +0000

 > Date: Tue, 28 Jul 2026 12:20:15 +0200
 > From: Martin Husemann <martin%duskware.de@localhost>
 >=20
 > If that change is not acceptable, this needs to be checked by
 > postinstall(8). "postinstall check" could just fail with a message
 > pointing the admin at what manual fix would work.
 
 That's absurd; the introduction of an internal privilege separation
 measure in the implementation of sshd should not reinterpret the
 operator's intent!
 
 This was previously discussed at:
 
 https://mail-index.netbsd.org/current-users/2025/01/06/msg045945.html
 
 As a result of that discussion, we updated our local patch for libwrap
 support to check _both_ `sshd-session' and `sshd':
 
 https://mail-index.netbsd.org/source-changes/2025/01/08/msg155130.html
 
     106 #ifdef LIBWRAP
 ...
     112 static void
     113 check_connection(const char *argv0, int sock_in)
     114 {
     115 	struct request_info req;
     116=20
     117 	request_init(&req, RQ_DAEMON, argv0, RQ_FILE, sock_in, 0);
     118 	fromhost(&req);
     119=20
     120 	if (hosts_access(&req))
     121 		return;
     122 	debug("Connection refused by tcp wrapper");
     123 	/* n.b. hosts_access(3) has logged and notified blocklistd */
     124 	refuse(&req);
     125 	/* NOTREACHED */
     126 	fatal("libwrap refuse returns");
     127 }
     128 #endif /* LIBWRAP */
 ...
    1171 #ifdef LIBWRAP
    1172 	/* Check whether logins are denied from this host. */
    1173 	if (ssh_packet_connection_is_on_socket(ssh)) {
    1174 		/* First, try with the value stored in __progname */
    1175 		check_connection(__progname, sock_in);
    1176 		/*
    1177 		 * Test with "sshd" as well, since that is what most people
    1178 		 * will have in their hosts.allow and hosts.deny files.
    1179 		 */
    1180 		check_connection("sshd", sock_in);
    1181 	}
    1182 #endif /* LIBWRAP */
 
 https://nxr.netbsd.org/xref/src/crypto/external/bsd/openssh/dist/sshd-sessi=
 on.c?r=3D1.13#106
 
 However, I suspect that logic only works for hosts.deny, not for
 hosts.allow.
 
 Frankly, I don't think we should use the name sshd-session at all;
 it's an internal implementation detail, not the name of the service
 users are configuring.  We should just fix openssh to use the name
 "sshd" again.