#884624 openssh-server: serice fails with invalid argument to Match Address in sshd_config

Package:
openssh-server
Source:
openssh
Description:
secure shell (SSH) server, for secure access from remote machines
Submitter:
Benoît-Pierre DEMAINE
Date:
2017-12-17 19:30:05 UTC
Severity:
normal
#884624#5
Date:
2017-12-17 19:26:38 UTC
From:
To:
Dear Maintainer,

DO NOT TRY TO REPRO THIS BUG ON A MACHINE UNLESS YOU HAVE PHYSICAL ACCESS
TO LOCAL CONSOLE

echo "Match Address 10.0.0.8/8
       PasswordAuthentication yes
" >>/etc/ssh/sshd_config

or

echo "Match Address fdfd::1/64
    PasswordAuthentication yes
" >>/etc/ssh/sshd_config

/etc/init.d/ssh restart
... it will restart service without any error

you can even do
sshd -t
which will confirm that everything is fine

but, try to initiate a new cession, you will get "Connection closed"

I have been explained why such lines are invalid. I am not arguing about
the fact those lines are invalid. I am complaining about the fact very
small typo can render a server completely unreachable, while service
restart and internal test both say the conf is fine.

Ideally, I would expect sshd to accept such arguments, and not care about
extra bits in the provided address.

At the very least, restart, and -t should both complain about invalid conf.

Change the line for 10.0.0.0/8 or fdfd::/64 ... restart daemon, you can
connect.

I have not tried, but, I expect similar bug may occur with many other
invalid arguments: 192.168.2.1.3 or 192.168.2 or fdfd::1::/64 ...

DO NOT TRY TO REPRO THIS BUG ON A MACHINE UNLESS YOU HAVE PHYSICAL ACCESS
TO LOCAL CONSOLE