#745778 openssh-server/permit-root-login should be honored for new installs too

Package:
openssh-server
Source:
openssh
Description:
secure shell (SSH) server, for secure access from remote machines
Submitter:
Marco d'Itri
Date:
2017-12-08 12:51:03 UTC
Severity:
normal
#745778#5
Date:
2014-04-24 23:54:23 UTC
From:
To:
Some environments need PermitRootLogin=yes.
They will configure it no matter what the openssh maintainers think
about it, so please let's save time for everybody and allow this to be
preseeded for new installs as well.
#745778#10
Date:
2014-09-16 23:02:00 UTC
From:
To:
Would you accept a patch to implement this?
#745778#15
Date:
2015-04-28 12:05:20 UTC
From:
To:
The preseed possibility is actually documented in the jessie release
notes, see
https://www.debian.org/releases/jessie/amd64/release-notes/ch-information.en.html#openssh
I tried to use it in vain, then found this bug.
Please raise its urgency. :)
#745778#20
Date:
2015-04-28 13:19:23 UTC
From:
To:
What's the problem with simply changing the configuration by usual means
as with all other options which are not specifically handled by debconf?

Cheers,
Chris.
#745778#25
Date:
2015-04-30 21:00:59 UTC
From:
To:
By "usual means" do you mean preseeding late_command with a sed script
editing sshd_config?
https://www.debian.org/releases/jessie/i386/apbs05.html.en#preseed-hooks
That's certainly possible, but preseeding a boolean (as documented) is
significantly simpler.
#745778#30
Date:
2015-05-01 20:02:29 UTC
From:
To:
No I rather meant by using the installation system or configuration
system you use (FAI, puppet, etc.)

Cheers,
Chris.
#745778#35
Date:
2015-05-03 19:14:44 UTC
From:
To:
Christoph Anton Mitterer <calestyo@scientia.net> writes:

Actually, we only need the initial root login so that our configuration
system can bootstrap the login policy of the organization (which means
LDAP user DB, SSH key authorization and no root login at all).  We could
work around this issue in various ways, but we'd rather continue on the
known path if possible.  And the documentation says it is...
#745778#40
Date:
2017-01-31 15:23:07 UTC
From:
To:
Hi,

How is this supposed to work now?  On a fresh stretch install, with
/etc/ssh/sshd_config being identical to /usr/share/openssh/sshd_config,
dpkg-reconfigure openssh-server does not ask anything:

# DEBCONF_DEBUG=developer dpkg-reconfigure openssh-server
debconf (developer): starting /var/lib/dpkg/info/openssh-server.config reconfigure 1:7.4p1-5
debconf (developer): <-- VERSION 2.0
debconf (developer): --> 0 2.0
debconf (developer): <-- SET openssh-server/permit-root-login true
debconf (developer): --> 0 value set
debconf (developer): starting /var/lib/dpkg/info/openssh-server.postinst configure 1:7.4p1-5
debconf (developer): <-- VERSION 2.0
debconf (developer): --> 0 2.0
debconf (developer): <-- GET openssh-server/permit-root-login
debconf (developer): --> 0 true
debconf (developer): <-- X_LOADTEMPLATEFILE /var/lib/dpkg/info/ucf.templates ucf
debconf (developer): --> 0
debconf (developer): <-- STOP

Should it?  Or did this debconf question become deprecated?
#745778#45
Date:
2017-12-08 12:47:31 UTC
From:
To:
Hi Ferenc,

I noticed, in
https://www.debian.org/releases/jessie/amd64/release-notes/ch-information.en.html#openssh

# The "false" value is in fact correct despite being confusing.
$ echo 'openssh-server openssh-server/permit-root-login boolean false' | debconf-set-selections

Regards,
Salvatore