Mailing List Archive

[Bug 3247] SendEnv exclusion doesn't work as documented
https://bugzilla.mindrot.org/show_bug.cgi?id=3247

--- Comment #3 from Guilhem <guilhem@fripost.org> ---
(In reply to Damien Miller from comment #2)
> Yes, it is intended behaviour and follows the option resolution
> ordering mentioned at the start of the ssh_config man page.

I see, should I rename this issue into a documentation clarification
request for SendEnv/SetEnv then?

> It's not really friendly unfortunately and that's a consequence of
> the mistake I made when originally implementing SendEnv of allowing
> multiple SendEnv directives to concatenate results. It's too late to
> fix this without causing widespread incompatibility though.
>
> As far as achieving what you want to do, putting this in your
> ~/.ssh/config should do the trick:
>
> Match final
> SendEnv -whatever
>
> Unfortunately there's no nice way to do this on the command-line

As far as I'm concerned a ssh_config snippet would do, but
unfortunately I'm unable to get the above to work. The distro-provided
/etc/ssh/ssh_config contains

Host *
SendEnv LANG LC_*

(With a matching `AcceptEnv` setting in /etc/ssh/sshd_config.) I'd
like to add a custom Host/Match block in ~/.ssh/config to clear locales
(or set to C) for a subset of selected hosts. But even with the
following ~/.ssh/config

Match final
SendEnv -LC_*
SendEnv -LC_TIME
SendEnv -LANG

LANG, LC_TIME, LC_PAPER etc. are sent along. The debug log contains

debug3: …/.ssh/config line 2: removing environment LC_*
debug3: …/.ssh/config line 4: removing environment LANG
debug3: Ignored env LANGUAGE
debug1: Sending env LC_PAPER = sv_SE.UTF-8
debug1: Sending env LANG = en_US.UTF-8
debug1: Sending env LC_MEASUREMENT = sv_SE.UTF-8
debug1: Sending env LC_TIME = C.UTF-8

AFAICT the `Match final` tricks works when I remove the `SendEnv LANG
LC_*` from /etc/ssh/ssh_config and add it to ~/.ssh/config instead, but
I'd prefer to preserve the system-provided configuration file and
override in ~/.ssh/config instead, like for boolean settings
PasswordAuthentication, CheckHostIP etc. Is there a way to override in
~/.ssh/config a SendEnv setting defined in /etc/ssh/ssh_config?

--
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
[Bug 3247] SendEnv exclusion doesn't work as documented [ In reply to ]
https://bugzilla.mindrot.org/show_bug.cgi?id=3247

--- Comment #4 from Damien Miller <djm@mindrot.org> ---
I see what is happening.

With "SendEnv LC_CTYPE" in /etc/ssh/ssh_config and "Match
final\nSendEnv -*" in ~/.ssh/config:

[djm@tiresias ~]$ ssh -vvv charon
OpenSSH_8.4, LibreSSL 3.3.1
debug1: Reading configuration data /home/djm/.ssh/config
debug2: checking match for 'final' host charon originally charon
debug3: /home/djm/.ssh/config line 117: not matched 'final'
debug2: match not found
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: configuration requests final Match pass
debug1: re-parsing configuration
debug1: Reading configuration data /home/djm/.ssh/config
debug2: checking match for 'final' host charon originally charon
debug3: /home/djm/.ssh/config line 117: matched 'final'
debug2: match found
debug3: /home/djm/.ssh/config line 118: removing environment LC_CTYPE
debug1: Reading configuration data /etc/ssh/ssh_config

The configuration in ~/.ssh/config is working but, because
/etc/ssh/ssh_config is reparsed after it, the "SendEnv LC_CTYPE" gets
re-added.

A workaround for this would be to change /etc/ssh/ssh_config to wrap
all SendEnv in "Match !final"

--
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
[Bug 3247] SendEnv exclusion doesn't work as documented [ In reply to ]
https://bugzilla.mindrot.org/show_bug.cgi?id=3247

--- Comment #5 from Guilhem <guilhem@fripost.org> ---
(In reply to Damien Miller from comment #4)
> A workaround for this would be to change /etc/ssh/ssh_config to wrap
> all SendEnv in "Match !final"

Ack, thanks! That seems to work with simple `Host foo` blocks for
clearing SendEnv/SetEnv. I'll see if the distro maintainer accepts to
ship a modified /etc/ssh/ssh_config.

--
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs