17 July 2024
How Debian Broke SSH Server on Upgrades on Bookworm and Ubuntu Noble.
In the Bookworm release cycle someone decided that there was some reason ssh was a bad group name and that because only 1 other package was affected, changing to _ssh wouldn’t break anything.
Except, that when there are local changes to ssh group membership the upgrade still renames the existing group to _ssh. For everyone who had used the builtin ssh group, this change broke remote ssh access on the upgrade to Bullseye, and subsequently Ubuntu’s Noble.
The fix is simple, as long as you remember to do it before upgrading a system. Create a new group (you’ll want it to have different gid than the builtin one) something like sshusers, copy the users to it and then update the sshd configuration to ‘AllowGroups sshusers’ and restart the sshd service. Remember to update your ansible playbooks as needed.