Security issues in antiX version of openssh-client

Has Debian updated their bookworm version?
I see a bookworm backports upgrade.
Do you want me to package that version (systemd/elogind free)?

Today I learned (TIL) about the backports repo.

This is a good guide: https://linuxcapable.com/how-to-install-backports-experimental-repository-on-debian/

Since I use “nala” mostly instead of apt, I first had to upgrade that because the installed version 0.12.2 doesn’t have target-release features.
$ sudo apt install nala/bookworm-backports

Then I was able to install the openssh packages:
$ sudo nala install --target-release bookworm-backports openssh-client

That pulled in openssh-server and openssh-sftp-server as well. Now all three are version 10.0p1-7, and note there are no systemd/elogind dependencies.

$ nala list openssh* --installed
openssh-client 1:10.0p1-7~bpo12+1 [Debian Backports/bookworm-backports main]
├── is installed
└── secure shell (SSH) client, for secure access to remote machines

openssh-server 1:10.0p1-7~bpo12+1 [Debian Backports/bookworm-backports main]
├── is installed
└── secure shell (SSH) server, for secure access from remote machines

openssh-sftp-server 1:10.0p1-7~bpo12+1 [Debian Backports/bookworm-backports main]
├── is installed
└── secure shell (SSH) sftp server module, for SFTP access from remote machines

Snippet from nala show openssh-client

Provides: ssh-client
Depends:
  adduser
  passwd
  init-system-helpers (>= 1.52)
  libc6 (>= 2.36)
  libedit2 (>= 2.11-20080614-0)
  libfido2-1 (>= 1.8.0)
  libgssapi-krb5-2 (>= 1.17)
  libselinux1 (>= 3.1~)
  libssl3 (>= 3.0.0)
  zlib1g (>= 1:1.1.4)
Recommends: xauth
Suggests: keychain, libpam-ssh, monkeysphere, ssh-askpass
Replaces: openssh-sk-helper, ssh, ssh-krb5
Conflicts: sftp
Breaks: openssh-sk-helper
[more output removed]

• This reply was modified 2 months, 3 weeks ago by Captain Stall. Reason: Add "nala show openssh-client" snippet

So we need both libssh2 (done) and openssh to be updated for antiX-23 and antiX-21/22?

Hi @robin

Here is the description of the package according to apt info opensysusers

Description: processes sysusers.d directory to create system users
 Opensysusers uses the files from sysusers.d directory to create system users
 and groups and to add users to groups, at package installation or boot time.
 This tool may be used to allocate system users and groups only, it is not
 useful for creating non-system (i.e. regular, "human") users and groups, as it
 accesses /etc/passwd and /etc/group directly, bypassing any more complex user
 databases, for example any database involving NIS or LDAP.
 .
 <em>Opensysusers is an alternative implementation of systemd-sysusers that may
 work on systems with or without systemd installed.</em> [my emphasis]

I already had openssh-server installed so opensysusers was already installed before I upgraded to the backport. It appears it is needed to add the “sshd” user to the system.

UPDATE: I see now the previous version openssh-server 1:9.2p1-2.0nosystemd2 did not have that dependency, but openssh-server is the only package I can see that depends on it, and it was not installed when I installed the backports, so I’m not quite sure when it was installed. The history feature is partly why I now use nala instead of apt.

• This reply was modified 2 months, 3 weeks ago by Captain Stall. Reason: added UPDATE

I found it using aptitude but it wasn’t straightforward.

$ aptitude why opensysusers
i   openssh-server Depends  systemd | systemd-standalone-sysusers | systemd-sysusers
i A opensysusers   Provides systemd-sysusers

I already knew that and it didn’t answer the question, so what if I pretend/simulate (“-s”) removing it?

$ aptitude -s purge opensysusers
The following packages will be REMOVED:
  opensysusers{p}
0 packages upgraded, 0 newly installed, 1 to remove and 7 not upgraded.
Need to get 0 B of archives. After unpacking 43.0 kB will be freed.
The following packages have unmet dependencies:
 stunnel4 : Depends: systemd but it is not installable or
                     systemd-standalone-sysusers but it is not installable or
                     systemd-sysusers which is a virtual package, provided by:
                     - systemd-standalone-sysusers (252.38-1~deb12u1), but it is not installable
                     - systemd (252.38-1~deb12u1), but it is not installable
                     - systemd-standalone-sysusers (252.39-1~deb12u2), but it is not installable
                     - systemd (252.39-1~deb12u2), but it is not installable
                     - opensysusers (0.7.3-2), but it is not going to be installed
                     - systemd-standalone-sysusers (254.26-1~bpo12+1), but it is not installable
                     - systemd (254.26-1~bpo12+1), but it is not installable

 openssh-server : Depends: systemd but it is not installable or
                           systemd-standalone-sysusers but it is not installable or
                           systemd-sysusers which is a virtual package, provided by:
                           - systemd-standalone-sysusers (252.38-1~deb12u1), but it is not installable
                           - systemd (252.38-1~deb12u1), but it is not installable
                           - systemd-standalone-sysusers (252.39-1~deb12u2), but it is not installable
                           - systemd (252.39-1~deb12u2), but it is not installable
                           - opensysusers (0.7.3-2), but it is not going to be installed
                           - systemd-standalone-sysusers (254.26-1~bpo12+1), but it is not installable
                           - systemd (254.26-1~bpo12+1), but it is not installable

The following actions will resolve these dependencies:

     Remove the following packages:                                  
1)     1-to-1-assistance-antix [1.2.5 (bookworm, now)]               
2)     openssh-server [1:10.0p1-7~bpo12+1 (now, oldstable-backports)]
3)     ssh-conduit-antix [1.2.1 (bookworm, now)]
4)     ssvnc [1.0.29-6+b1 (now, oldstable)]
5)     stunnel4 [3:5.68-2+deb12u1.0nosystemd1 (bookworm, now)]

Accept this solution? [Y/n/q/?] q
Abandoning all efforts to resolve these dependencies.
Abort.

So it’s stunnel4 3:5.68-2+deb12u1.0nosystemd1 which also depends on opensysusers, and it is present because

$ aptitude why stunnel4
i   1-to-1-assistance-antix Depends stunnel4

Mystery solved!