misc/58420: ssh silently fails attempting to authenticate from NetBSD to another host

To: misc-bug-people%netbsd.org@localhost,gnats-admin%netbsd.org@localhost,netbsd-bugs%netbsd.org@localhost
Subject: misc/58420: ssh silently fails attempting to authenticate from NetBSD to another host
From: dgbulk%gmail.com@localhost
Date: Thu, 11 Jul 2024 19:20:01 +0000 (UTC)

>Number:         58420
>Category:       misc
>Synopsis:       ssh silently fails attempting to authenticate from NetBSD to another host
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    misc-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 11 19:20:00 +0000 2024
>Originator:     DG
>Release:        NetBSD 9.0
>Organization:
>Environment:
NetBSD localhost 9.0 NetBSD 9.0 (GENERIC) #0: Fri Feb 14 00:06:28 UTC 2020  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64

-bash-5.2$ ssh -V
OpenSSH_8.0 NetBSD_Secure_Shell-20190418-hpn13v14-lpk, OpenSSL 1.1.1d  10 Sep 2019

-bash-5.2$ openssl version
OpenSSL 1.1.1d  10 Sep 2019

Also note - fresh NetBSD 9.0 install in QEMU/KVM VM; KVM itself is running in Ubuntu 22.04 LTS. Other VMs in this KVM (not running NetBSD) don't have the issue.
>Description:
When attempting to ssh to another host, ssh exits on login attempt without giving a reason, thus:
-bash-5.2$ ssh <username>@openbsd
The authenticity of host '<ip addr> (<ip addr>)' can't be established.
ECDSA key fingerprint is SHA256:<xxx>.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
-bash-5.2$

I have tried ssh-ing from netBSD to Linux, OpenBSD and FreeBSD target hosts, same result.

I can ping the target hosts from the NetBSD VM, no problem. I can ssh to the target hosts from other VMs that are _not_ running NetBSD, no problem. I can even ssh _to_ the NetBSD machine, no problem (of course, sshd is running on NetBSD in that case).

The problem occurs whether NetBSD is authenticating with the target host using password or public key.

The problem occurs whether ssh is being executed as a root or as a regular user.

Before it exits, as expected ssh prompts the user:
The authenticity of host '... (...)' can't be established.
ECDSA key fingerprint is SHA256:....
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Although answering yes to the above question, nothing is written to ~/.ssh/known_hosts. Note: I tried with no known_hosts, and empty known_hosts, makes no difference.

When using public key auth, on the target host, nothing is written to the /var/log/authlog file as a result of the attempt to ssh from NetBSD.

When using password auth, on the target host, the following is written to the /var/log/authlog file as a result of the attempt to ssh from NetBSD:
Jul 10 19:07:20 <target host name> sshd[<process>]: Connection closed by <NetBSD IP> port <number> [preauth]

Using ktrace, the tail of the ktrace dump for the ssh run is as follows. 

I hope this is not just some misconfiguration on my part, but in any case would appreciate any thoughts.

Thanks!
DG

ktrace dump tail:
...
  1014      1 ssh      CALL  open(0x7e48d5b20880,0,0x1b6)
  1014      1 ssh      NAMI  "/etc/ssh/ssh_known_hosts2"
  1014      1 ssh      RET   open -1 errno 2 No such file or directory
  1014      1 ssh      CALL  open(0x7e48d4c5940f,2,0xb)
  1014      1 ssh      NAMI  "/dev/tty"
  1014      1 ssh      RET   open 4
  1014      1 ssh      CALL  write(4,0x7f7fffb53a53,1)
  1014      1 ssh      GIO   fd 4 wrote 1 bytes
       "\r"
  1014      1 ssh      RET   write 1
  1014      1 ssh      CALL  close(4)
  1014      1 ssh      RET   close 0
  1014      1 ssh      CALL  open(0x7e48d396ef93,0x400002,0x400)
  1014      1 ssh      NAMI  "/dev/tty"
  1014      1 ssh      RET   open 4
  1014      1 ssh      CALL  ioctl(4,TIOCGETA,0x7f7fffb539a0)
  1014      1 ssh      GIO   fd 4 read 44 bytes
       "\^B+\0\0\a\0\0\0\0K\0\0\M-O\^E\0 \^D\M^?\M^?\^?\^W\^U\^R\M^?\n\^\\^Z\
        \^Y\^Q\^S\^V\^O\^A\0\^T\M^?\0\M^V\0\0\0\M^V\0\0"
  1014      1 ssh      RET   ioctl 0
  1014      1 ssh      CALL  ioctl(4,TIOCSETAF,0x7f7fffb538f0)
  1014      1 ssh      GIO   fd 4 wrote 44 bytes
       "\^B+\0\0\a\0\0\0\^AK\0\0\0\^D\0 \^D\M^?\M^?\^?\^W\^U\^R\M^?\n\^\\^Z\^Y\
        \^Q\^S\^V\^O\^A\0\^T\M^?\0\M^V\0\0\0\M^V\0\0"
  1014      1 ssh      RET   ioctl 0
  1014      1 ssh      CALL  write(4,0x7f7fffb543a0,0xe3)
  1014      1 ssh      GIO   fd 4 wrote 227 bytes
       "The authenticity of host '192.168.122.13 (192.168.122.13)' can't be es\
        tablished.\nECDSA key fingerprint is SHA256:sUa+qOoJZXvrYf2bAFbreVtJJ7\
        n2zD4ql2sMappghvg.\nAre you sure you want to continue connecting (yes/\
        no/[fingerprint])? "
  1014      1 ssh      RET   write 227/0xe3
  1014      1 ssh      CALL  read(4,0x7f7fffb5398b,1)
  1014      1 ssh      GIO   fd 4 read 1 bytes
       "y"
  1014      1 ssh      RET   read 1
  1014      1 ssh      CALL  write(4,0x7f7fffb5398b,1)
  1014      1 ssh      GIO   fd 4 wrote 1 bytes
       "y"
  1014      1 ssh      RET   write 1
  1014      1 ssh      CALL  read(4,0x7f7fffb5398b,1)
  1014      1 ssh      GIO   fd 4 read 1 bytes
       "e"
  1014      1 ssh      RET   read 1
  1014      1 ssh      CALL  write(4,0x7f7fffb5398b,1)
  1014      1 ssh      GIO   fd 4 wrote 1 bytes
       "e"
  1014      1 ssh      RET   write 1
  1014      1 ssh      CALL  read(4,0x7f7fffb5398b,1)
  1014      1 ssh      GIO   fd 4 read 1 bytes
       "s"
  1014      1 ssh      RET   read 1
  1014      1 ssh      CALL  write(4,0x7f7fffb5398b,1)
  1014      1 ssh      GIO   fd 4 wrote 1 bytes
       "s"
  1014      1 ssh      RET   write 1
  1014      1 ssh      CALL  read(4,0x7f7fffb5398b,1)
  1014      1 ssh      GIO   fd 4 read 1 bytes
       "\n"
  1014      1 ssh      RET   read 1
  1014      1 ssh      CALL  ioctl(4,TIOCSETAF,0x7f7fffb538f0)
  1014      1 ssh      GIO   fd 4 wrote 44 bytes
       "\^B+\0\0\a\0\0\0\^AK\0\0\M-O\^E\0 \^D\M^?\M^?\^?\^W\^U\^R\M^?\n\^\\^Z\
        \^Y\^Q\^S\^V\^O\^A\0\^T\M^?\0\M^V\0\0\0\M^V\0\0"
  1014      1 ssh      RET   ioctl 0
  1014      1 ssh      CALL  close(4)
  1014      1 ssh      RET   close 0
  1014      1 ssh      CALL  _lwp_self
  1014      1 ssh      RET   _lwp_self 1
  1014      1 ssh      CALL  _lwp_kill(1,2)
  1014      1 ssh      RET   _lwp_kill 0
  1014      1 ssh      PSIG  SIGINT SIG_DFL: code=SI_LWP sent by pid=1014, uid=1000)


>How-To-Repeat:
Attempt to ssh to a BSD or Linux host on the local subnet
>Fix:

Prev by Date: Re: bin/58421: awk(1) goes into infinite loop when reading dirs. on tmpfs
Next by Date: Re: pkg/58417: devel/gettext-tools: posix_spawn failure during bootstrap with -j16 on NetBSD/riscv64
Previous by Thread: bin/58421: awk(1) goes into infinite loop when reading dirs. on tmpfs
Next by Thread: Re: misc/58420: ssh silently fails attempting to authenticate from NetBSD to another host
Indexes:

Home | Main Index | Thread Index | Old Index