mirror of
https://github.com/usnistgov/macos_security.git
synced 2026-02-03 05:53:24 +00:00
os_sshd_permit_root_login_configure code fails to run the validation script #217
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @cipineda on GitHub.
Originally assigned to: @brodjieski on GitHub.
Summary
Running the
os_sshd_permit_root_login_configurevalidation script fails to execute with error:sshd: no hotkeys available -- exiting
Steps to reproduce
Open terminal and run:
/usr/sbin/sshd -TTherefore, running the validation script for
os_sshd_permit_root_login_configurefails:/usr/sbin/sshd -T | /usr/bin/awk '/permitrootlogin/{print $2}'error:
sshd: no hotkeys available -- exiting
If I run the code for this same item but using the code for Monterey on my Ventura systems, it works as expected:
/usr/bin/grep -c "^PermitRootLogin no" /etc/ssh/sshd_configreturns a value of "1"
Operating System version
Tested this on Ventura 13.0 22A380 and Ventura Beta 13.1 22C5033e
Intel or Apple Silicon
Silicon
What is the current bug behavior?
error:
sshd: no hotkeys available -- exiting
What is the expected correct behavior?
On computers that have the PermitRootLogin set to no, the script should detect it.
Relevant logs and/or screenshots
Output of checks
Possible fixes
Use the same code you have in the Monterey branch.
@cipineda commented on GitHub:
yes autocorrect changed it, it is hostkeys, right ssh has not been enabled on my system, yet the script should account for this event.
Does not seem like a good idea to enable ssh just to disable and validate.
It seems like the way you handled it with Monterey worked a lot better.
@robertgendler commented on GitHub:
Did you mean
hostkeysnot hostkeys?It appears Apple's autocorrect wants to constantly change it to hotkeys.
This will appear if ssh has never been enabled.
@robertgendler commented on GitHub:
The previous way we were handling it was grepping for a line in sshd_config which is messy because you can have multiple ways to set the same value if I remember right.
And then you have sshd_config.d/ folder which is really where things should be going. So just grepping isn't really a great option.
@K1jaff commented on GitHub:
I think this might be because you need to start the
sudo /bin/launchctl enable system/com.openssh.sshdservice once for the keys to be created, you can thensudo /bin/launchctl disable system/com.openssh.sshdandsudo /usr/sbin/sshd -Twill return the thehostkeys@cipineda commented on GitHub:
right but the code is assuming that the service has been started at least once, and for our case, by default ssh is not enabled, until a remote support session is required.
@robertgendler commented on GitHub:
This is now resolved in 'ventura', 'monterey', and 'big_sur'. Issue #245 also was covering this.
@cipineda commented on GitHub:
I tried enabling sshd, then disable and the issue persists:
cesar@AMR-20ZMQ6X8 ssh % sudo /bin/launchctl enable system/com.openssh.sshd
Password:
cesar@AMR-20ZMQ6X8 ssh % sudo /bin/launchctl disable system/com.openssh.sshd
Password:
cesar@AMR-20ZMQ6X8 ssh % sudo /usr/sbin/sshd -T | /usr/bin/awk '/permitrootlogin/{print $2}'
Password:
sshd: no hostkeys available -- exiting.
@robertgendler commented on GitHub:
This is now resolved in 'ventura', 'monterey', and 'big_sur'. Issue #245 also was covering this.