Skip to content

WIP: add collection of OpenSSH Include config files#305

Draft
jiri-belka wants to merge 28 commits into
openSUSE:devfrom
jiri-belka:sshd_config_d
Draft

WIP: add collection of OpenSSH Include config files#305
jiri-belka wants to merge 28 commits into
openSUSE:devfrom
jiri-belka:sshd_config_d

Conversation

@jiri-belka
Copy link
Copy Markdown

Hi,
we do not collect config files defined in OpenSSH configuration via `Include'.

Should I loop multiple times for Include ???

An example:

#==[ Configuration File ]===========================#
# /usr/etc/ssh/ssh_config
Include /etc/ssh/ssh_config.d/*.conf
Include /usr/etc/ssh/ssh_config.d/*.conf
Host *
    ForwardX11Trusted yes
    SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
    SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
    SendEnv LC_IDENTIFICATION LC_ALL
    SendEnv LC_TERMINAL LC_TERMINAL_VERSION
    SendEnv COLORTERM TERM_PROGRAM TERM_PROGRAM_VERSION


#==[ Configuration File ]===========================#
# /etc/ssh/ssh_config - File not found

#==[ Configuration File ]===========================#
# /usr/etc/ssh/sshd_config
Include /etc/ssh/sshd_config.d/*.conf
Include /usr/etc/ssh/sshd_config.d/*.conf
AuthorizedKeysFile      .ssh/authorized_keys
UsePAM yes
X11Forwarding yes
PrintMotd no
Subsystem       sftp    /usr/libexec/ssh/sftp-server
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL
AcceptEnv LC_TERMINAL LC_TERMINAL_VERSION
AcceptEnv COLORTERM TERM_PROGRAM TERM_PROGRAM_VERSION


#==[ Configuration File ]===========================#
# /etc/ssh/sshd_config - File not found

#==[ Configuration File ]===========================#
# /usr/lib/pam.d/sshd
auth        requisite   pam_nologin.so
auth        substack    common-auth
auth        include     postlogin-auth
account     requisite   pam_nologin.so
account     substack    common-account
account     include     postlogin-account
password    substack    common-password
password    include     postlogin-password
session     required    pam_loginuid.so
session     optional    pam_keyinit.so   force revoke
session     substack    common-session
session     include     postlogin-session
session     optional    pam_motd.so


#==[ Configuration File ]===========================#
# /etc/pam.d/sshd - File not found

#==[ Configuration File ]===========================#
# /etc/ssh/ssh_config.d/50-suse.conf
Match final all
        Include /etc/crypto-policies/back-ends/openssh.config


#==[ Configuration File ]===========================#
# /etc/ssh/sshd_config.d/99-krb5.conf
GSSAPIAuthentication yes
KerberosUniqueCCache yes


#==[ Configuration File ]===========================#
# /etc/ssh/sshd_config.d/99-root-ok.conf
PermitRootLogin yes


#==[ Configuration File ]===========================#
# /etc/ssh/sshd_config.d/99-test.conf
LogLevel DEBUG3


#==[ Configuration File ]===========================#
# /usr/etc/ssh/sshd_config.d/40-suse-crypto-policies.conf
Include /etc/crypto-policies/back-ends/opensshserver.config

wtmpx and others added 28 commits December 22, 2025 05:01
* Update supportconfig - add note about bpftool

I noticed in SLE 16 the bpftool is not in enhnaced_base. But since we ship out-of-the-box bpf programs and these will be displayed in supportconfig, let us add hint in case bpftool not installed.

* Update supportconfig

Changed the lines as requested.
Let us verify procps pkg because it contains important binaries. 
E.g., /sbin/sysctl
…etermining systemd unit files AND the drop-in files are included after the unit file if they exist
Check for /usr/lib/pam.d
Ignore deprecated crash variable message
Removed comment
Added systemd cat unit.service output
ha.txt: Collect hacluster passwd entry
I noticed in recent supportconfig I got, that env.txt contains credential information about the proxy if used: 

scc_aas15sp7_260326_1156/env.txt:https_proxy=http://MY_USER:MY_PASSWORD@172.20.1.32:8080
scc_aas15sp7_260326_1156/env.txt:http_proxy=http://MY_USER:MY_PASSWORD@172.20.1.32:8080
scc_aas15sp7_260326_1156/env.txt:ftp_proxy=http://MY_USER:MY_PASSWORD@172.20.1.32:8080
scc_aas15sp7_260326_1156/sysconfig.txt:HTTP_PROXY="http://*REMOVED BY SUPPORTCONFIG*@172.20.1.32:8080"
scc_aas15sp7_260326_1156/sysconfig.txt:HTTPS_PROXY="http://*REMOVED BY SUPPORTCONFIG*@172.20.1.32:8080"
scc_aas15sp7_260326_1156/sysconfig.txt:FTP_PROXY="http://*REMOVED BY SUPPORTCONFIG*@172.20.1.32:8080"

To reproduce: add something to sysconfig/proxy and run: supportconfig -m -i SYSCONFIG,ENV 
the data in sysconfig.txt is removed, but env contains the username/password. 

Also I noticed with: supportconfig -m it doesn't include env.txt
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants