I cannot login anymore via ssh.
I have the openemediavault installed on this box to manage the setup and
it set AllowGroups to "root ssh" in /etc/ssh/sshd_config.
Thankfully I have a serial console to this ARM board and thus I can
still open a terminal on this box.

After the request from a user to rename the "ssh" group to free it for its
own use, the "ssh" group was rename to "_ssh" in
https://salsa.debian.org/ssh-team/openssh/-/commit/18da782ebe789d0cf107a550e474ba6352e68911

But other users as in
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990456#35 or tools to
manage Debian have come to rely on this "ssh" group. This might be a
mistake. Still could you document this critical item in the bookworm
release notes?

Cheers,
Alban

...

I believe the openssh maintainers' position on this would be that the
ssh group was never intended to have ordinary users added to it, and
therefore this would be a bug in "openemediavault", which seems to be
third-party software that is not included in Debian?

The purpose of the group formerly named ssh (now _ssh) was documented in
the openssh changelog in 2002:

   * New upstream release.
     ...
     - ssh-agent is installed setgid to prevent ptrace() attacks. The group
       actually doesn't matter, as it drops privileges immediately, but to
       avoid confusion the postinst creates a new 'ssh' group for it.

If a sysadmin or a piece of third-party software wants to limit ssh
logins to members of a specific group, I believe the intention is that
they should have created a separate group for that purpose (perhaps
"ssh-users" or "remote-access" or similar) and added their ssh users to
*that* group. Since bookworm, the "ssh" group name is available for that
use, although it might be best avoided.

Unfortunately, /etc/group doesn't have a mechanism for pointing to
documentation about the intended purpose of a group, so it's easy for a
sysadmin or a piece of third-party software to start using a group for
an unintended purpose, and I think that's what has happened here.

     smcv

This is correct.  I 100% intended the group to be for internal use only.

I agree with the sentiment of this bug that it perhaps would have been
worth documenting in the release notes, but I didn't have time; and
since bookworm's release is now receding in the rear-view mirror,
perhaps this has been overtaken by events?  It's probably still worth
documenting somewhere, although as you say:

... so I don't know exactly where.

Control: reassign 1038151 openssh-client

I agree it should not be in trixie's release notes. As this is now
mostly an openssh "issue", I'm reassigning it.

Maybe it should be in openssh-client's README.Debian?

Chris