SSH checks fail if "ForceCommand" parameter is used for sshd

XMLWordPrintable

    • Type: Incident report
    • Resolution: Won't fix
    • Priority: Major
    • None
    • Affects Version/s: None
    • Component/s: None
    • None
    • Environment:
      sshd
    • 2

      Just add a line:

      ForceCommand /bin/bash
      

      to /etc/ssh/sshd_config

      Or whatever shell is needed, which exists on the system.

      Item will get unsupported with error logged:

      Cannot read data from SSH server: timeout error
      

      The error logged according to this:
      https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/src/libs/zbxpoller/ssh2_run.c#491

      "man sshd_config" for the option:

      ForceCommand
      Forces the execution of the command specified by ForceCommand, ignoring any command supplied by the client and ~/.ssh/rc if present. The command is invoked by using the user's login shell with the -c option. This applies to shell, command, or subsystem execution. It is most useful inside a Match block. The command originally supplied by the client is available in the SSH_ORIGINAL_COMMAND environment
      variable. Specifying a command of internal-sftp will force the use of an in-process SFTP server that requires no support files when used with ChrootDirectory. The default is none.

      I've played with the option (also trying "/bin/sh" value) and see a real influence how processes looking, here is "sh" at last line:

      # pstree -a | grep sshd -A4
      |-sshd
      |   `-sshd-session
      |       `-sshd-session
      |           `-sh
      

      When I tried with "/bin/bash", then processes structures tree is identical to when the parameter is not defined at all.

      Interactively I do not see much difference except of "Welcome ...." block is presented if the parameter is not defined.
      But last invitation line after log-in is always the same for bash:

      username@hostname:~$
      

      Looking to https://libssh2.org/libssh2_channel_read_ex.html I feel it might be related to a "channel" parameter of the function call.

      TCP/SSH session is happening of course. I can just see a differences in number of TCP packets.
      Success session with command "echo 5" has 23 packets, while the failing one has 18 packets.

            Assignee:
            Vjaceslavs Smelovs
            Reporter:
            Oleksii Zagorskyi
            Team B
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved:

                Estimated:
                Original Estimate - 16h
                16h
                Remaining:
                Time Spent - 8h Remaining Estimate - 8h
                8h
                Logged:
                Time Spent - 8h Remaining Estimate - 8h
                8h