Bug 185546 - freebsd-update(8) can modify sshd and lock you out of your system
Summary: freebsd-update(8) can modify sshd and lock you out of your system
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 9.1-RELEASE
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-01-07 09:10 UTC by janow49420
Modified: 2023-06-21 12:58 UTC (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description janow49420 2014-01-07 09:10:00 UTC
I think this is a usability bug:

When upgrading a system for example from FreeBSD 9.1 to 9.2 with these instructions: http://www.freebsd.org/releases/9.2R/installation.html I was locked out of my FreeBSD system.

The freebsd-update process made some changes to my sshd configuration:

51 <<<<<<< current version
52 AuthorizedKeysFile .ssh/authorized_keys
53 =======
54
55 # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
56 #AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2
57
58 #AuthorizedPrincipalsFile none
59
60 #AuthorizedKeysCommand none
61 #AuthorizedKeysCommandUser nobody
62 >>>>>>> 9.2-RELEASE

Now of course the changes are on lines 51, 53 and 62 were read in by sshd as invalid parameters and stopped sshd from starting on reboot.

This isn't an issue for things like ntp.conf which will just simply print a warning to syslog, but for critical services such as sshd, it will stop the service from starting.

If adding these markers is necessary why don't you at very least put a # in front of them.
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2014-04-14 00:27:34 UTC
Responsible Changed
From-To: freebsd-bugs->cperciva

Over to maintainer.
Comment 2 Eitan Adler freebsd_committer freebsd_triage 2018-05-28 19:45:26 UTC
batch change:

For bugs that match the following
-  Status Is In progress 
AND
- Untouched since 2018-01-01.
AND
- Affects Base System OR Documentation

DO:

Reset to open status.


Note:
I did a quick pass but if you are getting this email it might be worthwhile to double check to see if this bug ought to be closed.
Comment 3 Gerald Aryeetey 2019-01-23 19:20:59 UTC
During the upgrade process a prompt should have appeared similar with the text:
> The following file could not be merged automatically ... edit this file and 
> resolve the conflicts manually...
followed by the file in question being opened in an editor (like vi).

It appears like after this step, conflicts still existed in the file (either because it was ignored or it was missed).

It may be beneficial to add a check that conflicts were indeed resolved.
Comment 4 Colin Percival freebsd_committer freebsd_triage 2019-03-12 22:59:59 UTC
Drop freebsd-update PRs which were assigned to me.  I'm not working on this code any more.
Comment 5 Ed Maste freebsd_committer freebsd_triage 2022-12-14 16:28:08 UTC
As comment #3 points out this conflict should have emitted a message and opened an editor; this may not be particularly user-friendly, and also as comment #3 suggests we ought to check for "<<<<<<<" markers and refuse to continue until they are addressed.

That said, this 3-way diff resolution is best addressed by having freebsd-update use a tool (like etcmerge) rather than having built-in logic.
Comment 6 Ed Maste freebsd_committer freebsd_triage 2022-12-14 17:39:46 UTC
See https://reviews.freebsd.org/D37703 for a proposed change
Comment 7 commit-hook freebsd_committer freebsd_triage 2023-03-02 01:22:02 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=ceb5f28ba5fcfa69de7410d2327d4a5abf2a421f

commit ceb5f28ba5fcfa69de7410d2327d4a5abf2a421f
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2022-12-14 17:34:59 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2023-03-02 01:20:33 +0000

    freebsd-update: re-edit files if merge conflict markers remain

    freebsd-update will open ${EDITOR} if conflicts occur while merging
    updates to config files.  Inform the user if they've left conflict
    markers behind, and go back to editing the file.

    PR:             185546
    PR:             229689
    Reviewed by:    delphij
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D37703

 usr.sbin/freebsd-update/freebsd-update.sh | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)
Comment 8 commit-hook freebsd_committer freebsd_triage 2023-03-02 18:32:04 UTC
A commit in branch stable/13 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=c7e3703352037a5afacdc4126725f351fe7da72b

commit c7e3703352037a5afacdc4126725f351fe7da72b
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2022-12-14 17:34:59 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2023-03-02 18:29:57 +0000

    freebsd-update: re-edit files if merge conflict markers remain

    freebsd-update will open ${EDITOR} if conflicts occur while merging
    updates to config files.  Inform the user if they've left conflict
    markers behind, and go back to editing the file.

    PR:             185546
    PR:             229689
    Reviewed by:    delphij
    Approved by:    re (cperciva, expedited MFC)
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D37703

    (cherry picked from commit ceb5f28ba5fcfa69de7410d2327d4a5abf2a421f)

 usr.sbin/freebsd-update/freebsd-update.sh | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)
Comment 9 commit-hook freebsd_committer freebsd_triage 2023-03-02 20:51:28 UTC
A commit in branch releng/13.2 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=a6c6edbe9d37caf1dbc81f918adf8c1f451a534e

commit a6c6edbe9d37caf1dbc81f918adf8c1f451a534e
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2022-12-14 17:34:59 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2023-03-02 20:50:57 +0000

    freebsd-update: re-edit files if merge conflict markers remain

    freebsd-update will open ${EDITOR} if conflicts occur while merging
    updates to config files.  Inform the user if they've left conflict
    markers behind, and go back to editing the file.

    PR:             185546
    PR:             229689
    Reviewed by:    delphij
    Approved by:    re (cperciva)
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D37703

    (cherry picked from commit ceb5f28ba5fcfa69de7410d2327d4a5abf2a421f)
    (cherry picked from commit c7e3703352037a5afacdc4126725f351fe7da72b)

 usr.sbin/freebsd-update/freebsd-update.sh | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)
Comment 10 commit-hook freebsd_committer freebsd_triage 2023-06-21 12:58:50 UTC
A commit in branch stable/12 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=bb727917364f7ded1d24f599389288c63b23d862

commit bb727917364f7ded1d24f599389288c63b23d862
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2022-12-14 17:34:59 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2023-06-21 12:58:01 +0000

    freebsd-update: re-edit files if merge conflict markers remain

    freebsd-update will open ${EDITOR} if conflicts occur while merging
    updates to config files.  Inform the user if they've left conflict
    markers behind, and go back to editing the file.

    PR:             185546
    PR:             229689
    Reviewed by:    delphij
    Approved by:    re (cperciva, expedited MFC)
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D37703

    (cherry picked from commit ceb5f28ba5fcfa69de7410d2327d4a5abf2a421f)
    (cherry picked from commit c7e3703352037a5afacdc4126725f351fe7da72b)
    (cherry picked from commit e27ded83c76a609687a3d9e82b80fe7e1b782bf6)
    (cherry picked from commit b562307b70346030f59fe6a05d125814c74da47b)

 usr.sbin/freebsd-update/freebsd-update.sh | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)