Bug#1142354: sshd-session built without crypt(), breaking UsePAM=no password auth
Alexander Fisher <[email protected]> Sat, 18 Jul 2026 14:28:43 +0100
| Newsgroups | gmane.linux.debian.devel.ssh |
|---|---|
| Message-ID | <CAC34VL7UkzCD80BA1Qj5EugkN-cAmwCYVVH7zKbQJsjBcnyebg__29159.5095930219$1784381488$gmane$org@mail.gmail.com> |
--000000000000a1b6ab0656e2a747 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Package: src:openssh Version: 1:10.4p1-1 Severity: important sshd-session is built without crypt() support, so password authentication fails when UsePAM is set to "no" =E2=80=94 sshd logs "Failed password" for a correct password. UsePAM yes is unaffected (that path goes through pam_unix, which links libcrypt itself). The build no longer detects crypt: [1] checking for crypt in -lcrypt... no checking for crypt... no This is a side effect of libc6-dev dropping its libcrypt-dev dependency (glibc 2.42-7) [2][3]. openssh only ever got libcrypt-dev transitively, so it's now absent from the build chroot and crypt() is compiled out. It builds cleanly (no FTBFS), which is why the archive rebuild for that transition didn't flag it. trixie (1:10.0p1-7+deb13u4) still links libcrypt and is fine. [4] The fix is to add libcrypt-dev to Build-Depends. I'll submit an MR with that plus a regression test once my Salsa account is approved. Same issue hit Ubuntu 26.04 (LP: #2161162). [5] [1] - https://buildd.debian.org/status/fetch.php?pkg=3Dopenssh&arch=3Damd64&ver= =3D1%3A10.4p1-1&stamp=3D1783366343&raw=3D0 [2] - https://salsa.debian.org/glibc-team/glibc/-/commit/10c4a331fb977ae5ae7255e9= ee1c9c133f9d9da9 [3] - https://www.freexian.com/blog/debian-contributions-04-2025/ [4] - https://buildd.debian.org/status/fetch.php?pkg=3Dopenssh&arch=3Damd64&ver= =3D1%3A10.0p1-7%2Bdeb13u4&stamp=3D1778093735&raw=3D0 [5] - https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2161162 --000000000000a1b6ab0656e2a747 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Package: src:openssh<br>Version: 1:10.4p1-1<br>Severity: i= mportant<br><br>sshd-session is built without crypt() support, so password<= br>authentication fails when UsePAM is set to "no" =E2=80=94 sshd= logs "Failed<br>password" for a correct password. UsePAM yes is = unaffected (that path<br>goes through pam_unix, which links libcrypt itself= ).<br><br>The build no longer detects crypt: [1]<br><br>=C2=A0 checking for= crypt in -lcrypt... no<br>=C2=A0 checking for crypt... no<br><br>This is a= side effect of libc6-dev dropping its libcrypt-dev dependency<br>(glibc 2.= 42-7) [2][3]. openssh only ever got libcrypt-dev transitively, so it's<= br>now absent from the build chroot and crypt() is compiled out. It builds<= br>cleanly (no FTBFS), which is why the archive rebuild for that transition= <br>didn't flag it.<br><br>trixie (1:10.0p1-7+deb13u4) still links libc= rypt and is fine. [4]<br><br>The fix is to add libcrypt-dev to Build-Depend= s. I'll submit an MR with<br>that plus a regression test once my Salsa = account is approved. Same issue<br>hit Ubuntu 26.04 (LP: #2161162). [5]<br>= <br>[1] -=C2=A0<a href=3D"https://buildd.debian.org/status/fetch.php?pkg=3D= openssh&arch=3Damd64&ver=3D1%3A10.4p1-1&stamp=3D1783366343&= raw=3D0">https://buildd.debian.org/status/fetch.php?pkg=3Dopenssh&arch= =3Damd64&ver=3D1%3A10.4p1-1&stamp=3D1783366343&raw=3D0</a><br>[= 2] -=C2=A0<a href=3D"https://salsa.debian.org/glibc-team/glibc/-/commit/10c= 4a331fb977ae5ae7255e9ee1c9c133f9d9da9">https://salsa.debian.org/glibc-team/= glibc/-/commit/10c4a331fb977ae5ae7255e9ee1c9c133f9d9da9</a><br>[3] -=C2=A0<= a href=3D"https://www.freexian.com/blog/debian-contributions-04-2025/">http= s://www.freexian.com/blog/debian-contributions-04-2025/</a><br>[4] -=C2=A0<= a href=3D"https://buildd.debian.org/status/fetch.php?pkg=3Dopenssh&arch= =3Damd64&ver=3D1%3A10.0p1-7%2Bdeb13u4&stamp=3D1778093735&raw=3D= 0">https://buildd.debian.org/status/fetch.php?pkg=3Dopenssh&arch=3Damd6= 4&ver=3D1%3A10.0p1-7%2Bdeb13u4&stamp=3D1778093735&raw=3D0</a><b= r>[5] -=C2=A0<a href=3D"https://bugs.launchpad.net/ubuntu/+source/openssh/+= bug/2161162">https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2161162= </a><br></div> --000000000000a1b6ab0656e2a747--