openssh-server: fails in failsafe mode

[rucketeg]

Maintainer: @SibrenVasse
Environment:
OPENWRT_BOARD="ramips/mt7621"
OPENWRT_ARCH="mipsel_24kc"
OPENWRT_RELEASE="OpenWrt SNAPSHOT r18773-04ed224543"

Description:

Custom build with openssh-server instead of dropbear. After starting the system in failsafe mode, the ssh attempt fails with:

ssh -p 2222 root@192.168.1.1
WARNING: Your password has expired.
You must change your password now and login again!
passwd: No such file or directory
Connection to 192.168.1.1 closed.

[rucketeg]

As a side note, it seems that the following line:

	sed -i 's/^root:.*/root::0:17000:::::/g' /etc/shadow

from here is not needed, as /etc/shadow looks like follows under preinit environment:

root@(none):/# cat /etc/shadow 
root::0:0:99999:7:::
daemon:*:0:0:99999:7:::
ftp:*:0:0:99999:7:::
network:*:0:0:99999:7:::
nobody:*:0:0:99999:7:::
ntp:x:0:0:99999:7:::
logd:x:0:0:99999:7:::
sshd:x:0:0:99999:7:::
ubus:x:0:0:99999:7:::

[rucketeg]

The error seems to be issued here.

[rucketeg]

And caused by wrong path to the passwd binary used by openssh here.

[rucketeg]

Created #17834 for this issue.

[rucketeg]

Unfortunately this is still not fixed.

When I tested the patch I noticed password change prompt on connection attempt and I was happy that sshd was finally able to find the passwd binary.
But now there is new problem - passwd binary is unable to change the password because / is mounted read-only:

ssh root@192.168.1.1
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for root
New password: 
Retype password: 
passwd: /etc/passwd: Read-only file system
passwd: can't update password file /etc/passwd
Connection to 192.168.1.1 closed.

Similarly any changes to the /etc/shadow of /etc/passwd from inside the sshd initscript (like here) are failing because of the same reason - read-only fs:

sed: can't create temp file '/etc/shadowXXXXXX': Read-only file system

@neheb can you please reopen this issue, as I'm unable to.

I'm also open to ideas about how to fix this issue.

[rucketeg]

According to shadow(5), the 3rd field in this file is:

date of last password change

• (...)
• The value 0 has a special meaning, which is that the user should change her pasword the next time she will log in the system.
• An empty field means that password aging features are disabled.

The default shadow file, as provided in the base-files package, uses value 0 here. With such setup openssh-server is forcing the password change on a login attempt (which fails due to fs being RO), while dropbear seems to be ignoring this setting.

For now I have following ideas:

1. Drop failsafe functionality from the openssh-server package and warn about this in the help text. Users can sill choose to include the dropbear binary and disable it trough config during normal operation.
2. Disable password aging features in /etc/shadow. This option, potentially, has be biggest impact as it affects the base-files package. I tested that it allows openssh-server functionality in failsafe mode. Interestingly, empty password check from /etc/profile is still working as it only checks for the 2nd field in the shadow file. I'm unable to asses the full impact of such change, there might be packages that are relying on the current setup.
3. Patch openssh binary to notice if it's being executed under failsafe mode, or maybe more generally, with read-only /etc filesystem, and act accordingly.

[rucketeg]

Fixed in commit e040d31.