Created attachment 2475 [details] config-add-option-to-customize-moduli-file-location.patch Currently all files can be customized via sshd_config, however, the moduli file cannot. Running sshd in unprivileged context requires customization of all resources, especially when some distributions sets the moduli as world unreadable. --- I hope I got this right. I could use the copy of options within the child process, but I preferred to use the rpc in order to pass all parameters, maybe you want this the other way arround. This continue the series of unprivilege helpful functionality bug#2081, bug#2276.
I cannot rebase this patch easily due to the split of ssh api, the kex is not linked against sshd and there is no [trivial] way to pass options. I do not think the API as a library should access files in fixed locations, I suggest to consider either removing fixed location or adding ability to pass options to the api. Another option is to control the moduli file location via the environment.
(In reply to Alon Bar-Lev from comment #1) > I cannot rebase this patch easily due to the split of ssh api, the > kex is not linked against sshd and there is no [trivial] way to pass > options. > > I do not think the API as a library should access files in fixed > locations, I suggest to consider either removing fixed location or > adding ability to pass options to the api. The API isn't close to stable yet, it's likely to change substantially before we are ready to expose for non-internal use
(In reply to Damien Miller from comment #2) > (In reply to Alon Bar-Lev from comment #1) > > I cannot rebase this patch easily due to the split of ssh api, the > > kex is not linked against sshd and there is no [trivial] way to pass > > options. > > > > I do not think the API as a library should access files in fixed > > locations, I suggest to consider either removing fixed location or > > adding ability to pass options to the api. > > The API isn't close to stable yet, it's likely to change > substantially before we are ready to expose for non-internal use I understand. Do you have any preferences of how to pass the file location into the kex module? For example, can we add options to ssh structure?
(In reply to Alon Bar-Lev from comment #3) > Do you have any preferences of how to pass the file location into > the kex module? For example, can we add options to ssh structure? Yes, something like that - ultimately we want to get rid of all global or file-static variables. Making it configurable will also help us write unit tests, so it's desirable for that too.
This was added in openssh-8.6
Closing bugs from openssh-9.1 release cycle