openssh bugs - Oct 2025 - [Bug 3875] New: SSH client behavior breaks non-interactive sudo/stdio handling used by Ansible (automation times out waiting for privilege escalation)

https://bugzilla.mindrot.org/show_bug.cgi?id=3875

            Bug ID: 3875
           Summary: SSH client behavior breaks non-interactive sudo/stdio
                    handling used by Ansible (automation times out waiting
                    for privilege escalation)
           Product: Portable OpenSSH
           Version: 10.1p1
          Hardware: amd64
                OS: Linux
            Status: NEW
          Severity: major
          Priority: P5
         Component: Miscellaneous
          Assignee: unassigned-bugs at mindrot.org
          Reporter: daedra1980 at gmail.com

After upgrading to OpenSSH 10.1p1 on Slackware64-current, both Ansible
ad-hoc commands and playbooks that use sudo/become started failing with

?Timeout (12s) waiting for privilege escalation prompt.? 

Downgrading OpenSSH immediately fixes it. Disabling SSH multiplexing
(ControlMaster/ControlPersist) also fixes it, confirming the issue is
in the client?s multiplexing path. Reproducible by running any playbook
with become: yes on multiple Linux hosts. This regression prevents
Ansible from detecting the BECOME-SUCCESS marker over a multiplexed
connection, causing privilege escalation tasks to hang and fail.

If any other info is needed just let me know.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3875

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at dtucker.net

--- Comment #1 from Darren Tucker <dtucker at dtucker.net> ---
This sounds like bug#3872, which is being worked on over there.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3875

--- Comment #2 from Matt D. <daedra1980 at gmail.com> ---
Yeah, that does look like the same issue. I?ll keep an eye on bug 3872,
and once a fix is proposed I?ll patch OpenSSH and retest with Ansible
to confirm.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3875

--- Comment #3 from Matt D. <daedra1980 at gmail.com> ---
After applying the both patches suggested in bug#3872 I can confirm
that it fixes the issue with Ansible.

Applied patches
https://bugzilla.mindrot.org/attachment.cgi?id=3904&action=edit
https://bugzilla.mindrot.org/attachment.cgi?id=3907&action=edit

It required both patches, testing with only one or the other did not
resolve the problem, but applying both together completely fixed it.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3875

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org

--- Comment #4 from Damien Miller <djm at mindrot.org> ---
I'm pretty sure the first patch isn't necessary.

As far as I'm aware, the second patch (to channels.[ch]) should
completely fix it. Can you confirm?

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3875

--- Comment #5 from Matt D. <daedra1980 at gmail.com> ---
False alarm, you are correct.  The one patch did the trick.  Ansible is
working correctly again. 

Thanks

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3875

Matt D. <daedra1980 at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3875

Sam James <sam at gentoo.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sam at gentoo.org

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.