- This topic has 16 replies, 4 voices, and was last updated Jul 8-9:33 am by Captain Stall.
-
Posts
-
Robin
The last update of the nosystemd version in antiX 23 is two years old and dates from 04 Jul 2024 (see $ zless /usr/share/doc/openssh-client/changelog.Debian.gz). During the last 2 years, the following CVEs have been fixed in debian, which are open in antiX 23 still:
CVE-2021-36368, CVE-2026-55653, CVE-2026-35414, CVE-2026-35388, CVE-2026-35387, CVE-2026-35386, CVE-2026-35385, CVE-2026-3497, CVE-2025-61985, CVE-2025-61984, CVE-2025-32728, CVE-2025-26466, CVE-2025-26465, CVE-2024-39894, CVE-2024-7589, CVE-2024-6409, CVE-2024-6387
Some of them are severe and said to be relevant for normal users: The “unimportant” ones have a separate list.
(still unfixed/undecided also in latest debian: CVE-2026-55655, CVE-2026-55654)
$ apt-cache policy openssh-client openssh-client: Installiert: 1:9.2p1-2.0nosystemd2 Installationskandidat: 1:9.2p1-2.0nosystemd2 Versionstabelle: 1:10.0p1-7~bpo12+1 100 100 http://deb.debian.org/debian bookworm-backports/main amd64 Packages *** 1:9.2p1-2.0nosystemd2 500 500 http://ftp.halifax.rwth-aachen.de/mxlinux/packages/antix/bookworm bookworm/nosystemd amd64 Packages 100 /var/lib/dpkg/status@anticapitalista: Is there any chance that you could unsystemd the current 10.0p1-7, so the fixes available for bookworm based systemd-systems are also available for antiX 23?
Windows is like a submarine. Open a window and serious problems will start.
anti-apXos
Sorry, I misread the post, so nevermind…
- This reply was modified 2 months, 3 weeks ago by anti-apXos.
"--"
anticapitalista
Has Debian updated their bookworm version?
I see a bookworm backports upgrade.
Do you want me to package that version (systemd/elogind free)?Philosophers have interpreted the world in many ways; the point is to change it.
antiX with runit - leaner and meaner.
anticapitalista
Can you test these backported from trixie debs on antiX-23?
https://repo.antixlinux.com/uploads/bookworm/dev/
No issues installing on my laptop.
here’s a link to backported debs to antiX-21/22 (bullseye)
https://repo.antixlinux.com/uploads/bullseye/dev/Philosophers have interpreted the world in many ways; the point is to change it.
antiX with runit - leaner and meaner.
Captain Stall
Today I learned (TIL) about the backports repo.
This is a good guide: https://linuxcapable.com/how-to-install-backports-experimental-repository-on-debian/
Since I use “nala” mostly instead of apt, I first had to upgrade that because the installed version 0.12.2 doesn’t have target-release features.
$ sudo apt install nala/bookworm-backportsThen I was able to install the openssh packages:
$ sudo nala install --target-release bookworm-backports openssh-clientThat pulled in openssh-server and openssh-sftp-server as well. Now all three are version 10.0p1-7, and note there are no systemd/elogind dependencies.
$ nala list openssh* --installed openssh-client 1:10.0p1-7~bpo12+1 [Debian Backports/bookworm-backports main] ├── is installed └── secure shell (SSH) client, for secure access to remote machines openssh-server 1:10.0p1-7~bpo12+1 [Debian Backports/bookworm-backports main] ├── is installed └── secure shell (SSH) server, for secure access from remote machines openssh-sftp-server 1:10.0p1-7~bpo12+1 [Debian Backports/bookworm-backports main] ├── is installed └── secure shell (SSH) sftp server module, for SFTP access from remote machinesSnippet from nala show openssh-client
Provides: ssh-client Depends: adduser passwd init-system-helpers (>= 1.52) libc6 (>= 2.36) libedit2 (>= 2.11-20080614-0) libfido2-1 (>= 1.8.0) libgssapi-krb5-2 (>= 1.17) libselinux1 (>= 3.1~) libssl3 (>= 3.0.0) zlib1g (>= 1:1.1.4) Recommends: xauth Suggests: keychain, libpam-ssh, monkeysphere, ssh-askpass Replaces: openssh-sk-helper, ssh, ssh-krb5 Conflicts: sftp Breaks: openssh-sk-helper [more output removed]- This reply was modified 2 months, 3 weeks ago by Captain Stall. Reason: Add "nala show openssh-client" snippet
The antiX Software Installer/Package Installer also has a tab (for me) called “Debian Backports” – it is greyed out and I have to click “Enabled Repos” first but then it works.
There is a filtering dropdown list at the top right of the window that defaults to “All packages” but “Upgradable” is an option.
Can you test these backported from trixie debs on antiX-23?
https://repo.antixlinux.com/uploads/bookworm/dev/
No issues installing on my laptop.On antiX 23 full 64 bit:
$ sudo apt-get install ./libssh2-1_1.11.1-1+antix1_amd64.deb ./libssh2-1_1.11.1-1+antix1_i386.deb Paketlisten werden gelesen… Fertig Abhängigkeitsbaum wird aufgebaut… Fertig Statusinformationen werden eingelesen… Fertig Hinweis: »libssh2-1« wird an Stelle von »./libssh2-1_1.11.1-1+antix1_amd64.deb« gewählt. Hinweis: »libssh2-1:i386« wird an Stelle von »./libssh2-1_1.11.1-1+antix1_i386.deb« gewählt. Die folgenden Pakete werden aktualisiert (Upgrade): libssh2-1 libssh2-1:i386 2 aktualisiert, 0 neu installiert, 0 zu entfernen und 0 nicht aktualisiert. Es müssen noch 0 B von 500 kB an Archiven heruntergeladen werden. Nach dieser Operation werden 176 kB Plattenplatz zusätzlich benutzt. Holen:1 /media/Test/libssh2/libssh2-1_1.11.1-1+antix1_i386.deb libssh2-1 i386 1.11.1-1+antix1 [256 kB] Holen:2 /media/Test/libssh2/libssh2-1_1.11.1-1+antix1_amd64.deb libssh2-1 amd64 1.11.1-1+antix1 [245 kB] (Lese Datenbank ... 293408 Dateien und Verzeichnisse sind derzeit installiert.) Vorbereitung zum Entpacken von .../libssh2-1_1.11.1-1+antix1_i386.deb ... De-konfigurieren von libssh2-1:amd64 (1.10.0-3+b1), um libssh2-1:i386 (1.11.1-1+antix1) konfigurieren zu können ... Entpacken von libssh2-1:i386 (1.11.1-1+antix1) über (1.10.0-3+b1) ... Vorbereitung zum Entpacken von .../libssh2-1_1.11.1-1+antix1_amd64.deb ... Entpacken von libssh2-1:amd64 (1.11.1-1+antix1) über (1.10.0-3+b1) ... libssh2-1:amd64 (1.11.1-1+antix1) wird eingerichtet ... libssh2-1:i386 (1.11.1-1+antix1) wird eingerichtet ... Trigger für libc-bin (2.36-9+deb12u14) werden verarbeitet ...@anticapitalista many many thanks! But, did you happen to mix the two threads? Since the packages behind your links are libssh2-1, I guess you actually meant answering in this thread instead of here? Whatsoever, I can confirm your libssh2-1 packages do install fine, and I didn’t notice any issues so far. If I understand correctly, these won’t address the parallel existing identical issues present in openssh-client. Maybe I’m mistaken.
Has Debian updated their bookworm version?
I see a bookworm backports upgrade.
Do you want me to package that version (systemd/elogind free)?From what I perceive, Debian seems to be little concerned of oldstable security in some/many packages. Important updates lag behind for more than a month, if they come at all, or like in this case, only via the backports instead of the security channel. While the details and exploits are published already. So yes, if a specifically systemd/elogind free version of the openssh-client package is needed to avoid drawing in systemd or elogind on users systems, this is what I initially asked for. But if the standard debian packages are fine, like Captain Stall’s answers suggest, not drawing in systemd nor elogind, how can default users receive the upgrade to the fixed version 10 when performing a normal system upgrade?
Windows is like a submarine. Open a window and serious problems will start.
Important updates lag behind for more than a month, if they come at all, or like in this case, only via the backports instead of the security channel.
The whole point of stable is that Debian doesn’t update packages to new versions except through backports, so if a security fix requires a new version instead of just security patches to the stable version, backports is the only way to do it. Sometimes packages do get a new version through stable-updates if it’s considered really important, but actually I don’t even know if that ever happens on oldstable, like Debian 12, since it’s meant to be associated with point-releases.
"--"
Captain Stall seems to be wrong, that no systemd would be installed: For me using the debian packages would install “systemd-sysusers”:
$ sudo apt-get --simulate install openssh-client=1:10.0p1-7~bpo12+1 openssh-sftp-server=1:10.0p1-7~bpo12+1 openssh-server=1:10.0p1-7~bpo12+1 Paketlisten werden gelesen… Fertig Abhängigkeitsbaum wird aufgebaut… Fertig Statusinformationen werden eingelesen… Fertig Die folgenden zusätzlichen Pakete werden installiert: opensysusers Vorgeschlagene Pakete: keychain libpam-ssh monkeysphere molly-guard Die folgenden NEUEN Pakete werden installiert: opensysusers Die folgenden Pakete werden aktualisiert (Upgrade): openssh-client openssh-server openssh-sftp-server 3 aktualisiert, 1 neu installiert, 0 zu entfernen und 0 nicht aktualisiert. Inst openssh-sftp-server [1:9.2p1-2.0nosystemd2] (1:10.0p1-7~bpo12+1 Debian Backports:oldstable-backports [amd64]) [] Inst openssh-server [1:9.2p1-2.0nosystemd2] (1:10.0p1-7~bpo12+1 Debian Backports:oldstable-backports [amd64]) [] Inst openssh-client [1:9.2p1-2.0nosystemd2] (1:10.0p1-7~bpo12+1 Debian Backports:oldstable-backports [amd64]) [] Inst opensysusers (0.7.3-2 Debian:12.14/oldstable [all]) Conf openssh-sftp-server (1:10.0p1-7~bpo12+1 Debian Backports:oldstable-backports [amd64]) Conf openssh-server (1:10.0p1-7~bpo12+1 Debian Backports:oldstable-backports [amd64]) Conf openssh-client (1:10.0p1-7~bpo12+1 Debian Backports:oldstable-backports [amd64]) Conf opensysusers (0.7.3-2 Debian:12.14/oldstable [all]) $ apt-cache show opensysusers Package: opensysusers ... Provides: systemd-sysusersObviously this systemd component isn’t present currently on my system, so I guess we need actually an antiX specific nosystemd-version.
Windows is like a submarine. Open a window and serious problems will start.
so if a security fix requires a new version instead of just security patches to the stable version, backports is the only way to do it.
True, @anti-apXos. But not precisely what I’d consider a reliable way to maintain security. I guess we’ll have to live with that shortcoming in oldstable. Since antiX considers antiX 23 and even 22/21 as fully supported still, I guess we’ll have to care for security updates on our own, independent of what debian does (or does not).
Windows is like a submarine. Open a window and serious problems will start.
anticapitalista
So we need both libssh2 (done) and openssh to be updated for antiX-23 and antiX-21/22?
Philosophers have interpreted the world in many ways; the point is to change it.
antiX with runit - leaner and meaner.
So we need both libssh2 (done) and openssh to be updated for antiX-23 and antiX-21/22?
If I understand correctly: Yes. These seem to be two completely independent implementations, but with same or similar vulnerabilities. From my understanding fixing libssh2 doesn’t fix openssh the same time.
Windows is like a submarine. Open a window and serious problems will start.
Hi @robin
Here is the description of the package according to apt info opensysusers
Description: processes sysusers.d directory to create system users Opensysusers uses the files from sysusers.d directory to create system users and groups and to add users to groups, at package installation or boot time. This tool may be used to allocate system users and groups only, it is not useful for creating non-system (i.e. regular, "human") users and groups, as it accesses /etc/passwd and /etc/group directly, bypassing any more complex user databases, for example any database involving NIS or LDAP. . <em>Opensysusers is an alternative implementation of systemd-sysusers that may work on systems with or without systemd installed.</em> [my emphasis]I already had openssh-server installed so opensysusers was already installed before I upgraded to the backport. It appears it is needed to add the “sshd” user to the system.
UPDATE: I see now the previous version openssh-server 1:9.2p1-2.0nosystemd2 did not have that dependency, but openssh-server is the only package I can see that depends on it, and it was not installed when I installed the backports, so I’m not quite sure when it was installed. The history feature is partly why I now use nala instead of apt.
- This reply was modified 2 months, 3 weeks ago by Captain Stall. Reason: added UPDATE
anticapitalista
So we need both libssh2 (done) and openssh to be updated for antiX-23 and antiX-21/22?
If I understand correctly: Yes. These seem to be two completely independent implementations, but with same or similar vulnerabilities. From my understanding fixing libssh2 doesn’t fix openssh the same time.
openssh debs here for testing (antiX-23).
https://repo.antixlinux.com/uploads/bookworm/dev/
I don’t think I’ll be able to update openssh for antiX-21/22 though
Philosophers have interpreted the world in many ways; the point is to change it.
antiX with runit - leaner and meaner.
I found it using aptitude but it wasn’t straightforward.
$ aptitude why opensysusers i openssh-server Depends systemd | systemd-standalone-sysusers | systemd-sysusers i A opensysusers Provides systemd-sysusersI already knew that and it didn’t answer the question, so what if I pretend/simulate (“-s”) removing it?
$ aptitude -s purge opensysusers The following packages will be REMOVED: opensysusers{p} 0 packages upgraded, 0 newly installed, 1 to remove and 7 not upgraded. Need to get 0 B of archives. After unpacking 43.0 kB will be freed. The following packages have unmet dependencies: stunnel4 : Depends: systemd but it is not installable or systemd-standalone-sysusers but it is not installable or systemd-sysusers which is a virtual package, provided by: - systemd-standalone-sysusers (252.38-1~deb12u1), but it is not installable - systemd (252.38-1~deb12u1), but it is not installable - systemd-standalone-sysusers (252.39-1~deb12u2), but it is not installable - systemd (252.39-1~deb12u2), but it is not installable - opensysusers (0.7.3-2), but it is not going to be installed - systemd-standalone-sysusers (254.26-1~bpo12+1), but it is not installable - systemd (254.26-1~bpo12+1), but it is not installable openssh-server : Depends: systemd but it is not installable or systemd-standalone-sysusers but it is not installable or systemd-sysusers which is a virtual package, provided by: - systemd-standalone-sysusers (252.38-1~deb12u1), but it is not installable - systemd (252.38-1~deb12u1), but it is not installable - systemd-standalone-sysusers (252.39-1~deb12u2), but it is not installable - systemd (252.39-1~deb12u2), but it is not installable - opensysusers (0.7.3-2), but it is not going to be installed - systemd-standalone-sysusers (254.26-1~bpo12+1), but it is not installable - systemd (254.26-1~bpo12+1), but it is not installable The following actions will resolve these dependencies: Remove the following packages: 1) 1-to-1-assistance-antix [1.2.5 (bookworm, now)] 2) openssh-server [1:10.0p1-7~bpo12+1 (now, oldstable-backports)] 3) ssh-conduit-antix [1.2.1 (bookworm, now)] 4) ssvnc [1.0.29-6+b1 (now, oldstable)] 5) stunnel4 [3:5.68-2+deb12u1.0nosystemd1 (bookworm, now)] Accept this solution? [Y/n/q/?] q Abandoning all efforts to resolve these dependencies. Abort.So it’s stunnel4 3:5.68-2+deb12u1.0nosystemd1 which also depends on opensysusers, and it is present because
$ aptitude why stunnel4 i 1-to-1-assistance-antix Depends stunnel4Mystery solved!
- You must be logged in to reply to this topic.