[Bug 3247] SendEnv exclusion doesn't work as documented

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=3247

--- Comment #4 from Damien Miller <djm at mindrot.org> ---
I see what is happening.

With "SendEnv LC_CTYPE" in /etc/ssh/ssh_config and "Match
final\nSendEnv -*" in ~/.ssh/config:

[djm at tiresias ~]$ ssh -vvv charon
OpenSSH_8.4, LibreSSL 3.3.1
debug1: Reading configuration data /home/djm/.ssh/config
debug2: checking match for 'final' host charon originally charon
debug3: /home/djm/.ssh/config line 117: not matched 'final'
debug2: match not found
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: configuration requests final Match pass
debug1: re-parsing configuration
debug1: Reading configuration data /home/djm/.ssh/config
debug2: checking match for 'final' host charon originally charon
debug3: /home/djm/.ssh/config line 117: matched 'final'
debug2: match found
debug3: /home/djm/.ssh/config line 118: removing environment LC_CTYPE
debug1: Reading configuration data /etc/ssh/ssh_config

The configuration in ~/.ssh/config is working but, because
/etc/ssh/ssh_config is reparsed after it, the "SendEnv LC_CTYPE" gets
re-added.

A workaround for this would be to change /etc/ssh/ssh_config to wrap
all SendEnv in "Match !final"

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.