Bug 717237 - Double negation not matching
Summary: Double negation not matching
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: openssh
Version: 6.1
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: Jan F. Chadima
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-06-28 12:46 UTC by Gabor Szathmari
Modified: 2011-06-29 08:05 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-06-29 08:05:24 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Gabor Szathmari 2011-06-28 12:46:18 UTC
Double negation is not working as advertised in the Match stanza of sshd_config

Disable login for non-admins from non-corporate (Example Ltd) network
# cat /etc/ssh/sshd_config
Match Group !admin Host !*.example.com
    MaxSessions 0

eviluser is not member of admins:
# id eviluser | grep admin
uid=1510(eviluser) gid=1500(evil) groups=2000(othergroup)
	
# sshd -T -C user=eviluser,host=server.evilsite.com,addr=10.0.0.1 | grep -i maxsess
maxsessions 10


Description of problem:
Double negation is not working as advertised in the Match stanza of sshd_config

Disable non-admin login from non-corporate (Example Ltd) network
# cat /etc/ssh/sshd_config
Match Group !admin Host !*.example.com
    MaxSessions 0

eviluser is not member of admins:
# id eviluser | grep admin
uid=1510(eviluser) gid=1500(evil) groups=2000(othergroup)
	
# sshd -T -C user=eviluser,host=server.evilsite.com,addr=10.0.0.1 | grep -i maxsess
maxsessions 10


Version-Release number of selected component (if applicable):
openssh-5.3p1-52.el6_1.2.i686
openssh-clients-5.3p1-52.el6_1.2.i686
openssh-server-5.3p1-52.el6_1.2.i686

How reproducible:
If negation is not used, it just works:

Match Group test Host *.example.com
    MaxSessions 0

# usermod -a -G test eviluser
# id eviluser | grep admin
uid=1510(eviluser) gid=1500(evil) groups=2000(othergroup),2018(admin)

# sshd -T -C user=eviluser,host=server.example.com,addr=10.0.0.1 | grep -i maxsess
maxsessions 0

Steps to Reproduce:
1. Configure sshd_config
2. Test configuration file like above
  
Actual results:
Rules are not working as expected.

Expected results:
Excerpt from man sshd_config:
"If all of the criteria on the Match line are satisfied, the keywords on the following lines
override those set in the global section of the config file"

Comment 1 Gabor Szathmari 2011-06-28 12:50:29 UTC
So it seems that if negation is used, only the first criteria is used by the openssh daemon.

Comment 2 Gabor Szathmari 2011-06-28 12:55:59 UTC
Sorry, the first few lines are duplicated in the original description. Please omit everything before the "Description of problem:" line.

Comment 4 Gabor Szathmari 2011-06-28 13:23:27 UTC
Additional info: "eviluser" is a user from OpenLDAP, but the "admins" group
belongs the the local server.

Comment 5 Gabor Szathmari 2011-06-28 13:23:46 UTC
Additional info: "eviluser" is a user from OpenLDAP, but the "admins" group
belongs to the local server.

Comment 6 Jan F. Chadima 2011-06-28 13:57:26 UTC
verified

Comment 7 Jan F. Chadima 2011-06-28 14:45:08 UTC
there is in configuration of the Match command mentioned ! only once :

A pattern-list is a comma-separated list of patterns.  Patterns within pattern-lists may be negated by preceding them with an exclamation mark (‘!’).

For example, to allow a key to be used from anywhere within an organisation except from the “dialup” pool, the following entry (in authorized_keys) could be used:

from="!*.dialup.example.com,*.example.com"

There is not generic negation support in the match command.

Comment 8 Gabor Szathmari 2011-06-28 15:03:18 UTC
(In reply to comment #7)
> there is in configuration of the Match command mentioned ! only once :
> A pattern-list is a comma-separated list of patterns.  Patterns within
> pattern-lists may be negated by preceding them with an exclamation mark (‘!’).
> For example, to allow a key to be used from anywhere within an organisation
> except from the “dialup” pool, the following entry (in authorized_keys) could
> be used:
> from="!*.dialup.example.com,*.example.com"
> There is not generic negation support in the match command.

The man page might be slightly misleading. The following configuration settings work as expected, though:

Match User "!username,*"
    MaxSessions 0

# sshd -T -C user=username,host=client.example.com,addr=10.0.0.1 |grep maxsess
maxsessions 10

# sshd -T -C user=otheruser,host=client.example.com,addr=10.0.0.1 |grep maxsess
maxsessions 0

# sshd -T -C user=otheruser2,host=client.example.com,addr=10.0.0.1 |grep maxsess
maxsessions 0

Comment 9 Gabor Szathmari 2011-06-28 15:07:36 UTC
Excerpts from the OpenSSH 5.1 Changelog:
http://www.openssh.org/txt/release-5.1

 * sshd_config(5) now supports CIDR address/masklen matching in "Match
   address" blocks, with a fallback to classic wildcard matching. For 
   example:
     Match address 192.0.2.0/24,3ffe:ffff::/32,!10.*
         PasswordAuthentication yes

 * "Match group" blocks in sshd_config(5) now support negation of
   groups. E.g. "Match group staff,!guests" (bz#1315)

Comment 10 Jan F. Chadima 2011-06-28 15:24:52 UTC
you have omitted trailng ,* in your config
try:

Match Group !admin,* Host !*.example.com,*
        MaxSessions 0

Comment 11 Gabor Szathmari 2011-06-29 07:11:57 UTC
(In reply to comment #10)
> you have omitted trailng ,* in your config
> try:
> Match Group !admin,* Host !*.example.com,*
>         MaxSessions 0

Thank you for your help, it seems to work now as expected. I reckon the manual page could be more detailed on the matter.

On a related note, the Match criterias are not working between quotation marks. It is not a bug but it is nice to know:
Match Group "!admin,*" Host "!*.example.com,*" <= erroneous config

Comment 12 Jan F. Chadima 2011-06-29 08:05:24 UTC
thanks for the report
closing as not a bug


Note You need to log in before you can comment on or make changes to this bug.