openssh bugs - Nov 2017 - [Bug 2800] New: sftp fails to connect when login shell is t/csh and user's .cshrc generates output

https://bugzilla.mindrot.org/show_bug.cgi?id=2800

            Bug ID: 2800
           Summary: sftp fails to connect when login shell is t/csh and
                    user's .cshrc generates output
           Product: Portable OpenSSH
           Version: 5.3p1
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: trivial
          Priority: P5
         Component: sftp-server
          Assignee: unassigned-bugs at mindrot.org
          Reporter: david.t.kerns at gmail.com

If the user's login shell is either tcsh or csh and their .cshrc
outputs any characters the sftp fails with the message:

Received message too long xxxxxxx

The work-a-round is for the user to wrap any generated output in the
following if clause:

if ( `tty` != 'is not a tty' ) then
  echo safe to echo
endif

However, I believe a better solution would be to exec the sftp-server
app with the -f argument to the t/csh so that the user's .cshrc file is
never sourced.

The following shows the difference between a sftp session with a login
shell of bash vs csh:

root         2017     1  0 Nov08 ?        00:00:00 /usr/sbin/sshd
root        21480  2017  0 07:44 ?        00:00:00 sshd: usera [priv] 
usera       21484 21480  0 07:44 ?        00:00:00 sshd: usera at notty  
usera       21485 21484  0 07:44 ?        00:00:00
/usr/libexec/openssh/sftp-server


root      3307     1  0 May15 ?        00:00:00 /usr/sbin/sshd
root     16260  3307  0 14:47 ?        00:00:00 sshd: userb [priv]
userb    16267 16260  0 14:47 ?        00:00:00 sshd: userb at notty
userb    16268 16267  0 14:47 ?        00:00:00 csh -c
/usr/libexec/openssh/sftp-server
userb    16288 16268  0 14:47 ?        00:00:00
/usr/libexec/openssh/sftp-server

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2800

--- Comment #1 from dtkerns <david.t.kerns at gmail.com> ---
sorry I typed the "wrapper" script for memory... should be:

if ( `tty` != 'not a tty' ) then
  echo safe to echo
endif

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2800

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at dtucker.net

--- Comment #2 from Darren Tucker <dtucker at dtucker.net> ---
having shell startups pollute stdin/stdout is a common problem for many
tools, not just sftp.  Adding shell-specific startup flags would
require shell (and possibly platform) specific knowledge, and that's a
rathole I am not willing to go down.  There is also the possibility
that something in the shell startup is actually desired (eg umask
setting or something).

It might be possible to give a hint in this case (similar to rsync's
"is your shell clean?" message), but as you've discovered the best
option right now is "so don't do that, then".

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2800

--- Comment #3 from dtkerns <david.t.kerns at gmail.com> ---
ok, I'll settle for a better (eg is your shell startup output clean?)
error message. If nothing else, this bug entry may help save the next
guy a few hours of pulling out precious hair. :)

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2800

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org
   Attachment #3088|                            |ok?(djm at mindrot.org)
              Flags|                            |

--- Comment #4 from Darren Tucker <dtucker at dtucker.net> ---
Created attachment 3088
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3088&action=edit
Output "(is your shell clean?)" for message too big only on initial
request.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2800

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED
             Blocks|                            |2782

--- Comment #5 from Darren Tucker <dtucker at dtucker.net> ---
A variant of that patch was just committed.

% echo "echo foo" >>.cshrc
% sftp localhost
Received message too long 1718578954
Ensure the remote shell produces no output for non-interactive
sessions.


Referenced Bugs:

https://bugzilla.mindrot.org/show_bug.cgi?id=2782
[Bug 2782] Tracking bug for OpenSSH 7.7 release
-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2800

--- Comment #6 from dtkerns <david.t.kerns at gmail.com> ---
I like it.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2800

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #7 from Damien Miller <djm at mindrot.org> ---
Close all resolved bugs after release of OpenSSH 7.7.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2800

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3088|ok?(djm at mindrot.org)        |
              Flags|                            |

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.