ssh: Change shell and exec defaults to disabled

[u3s]

The shell and exec daemon options now default to disabled instead of enabling the Erlang shell and Erlang term evaluation respectively. This improves security by following the "secure by default" principle.

Previously, all authenticated SSH users could execute arbitrary Erlang code via the default shell or exec services. This violated the principle of least privilege and created unnecessary security exposure.

Changes:

• Remove ?DEFAULT_SHELL macro from ssh.hrl
• Change shell default from {shell, start, []} to disabled
• Change exec default from undefined to disabled
• Allow undefined as explicit value for exec (backward compatibility)
• Update ssh_cli.erl exec logic for new defaults
• Update test suites to explicitly enable shell/exec where needed
• Add shell_disabled/1 test case to verify default behavior
• Update documentation (hardening.md, introduction.md, using_ssh.md)

Applications requiring shell or exec functionality must now explicitly enable them:

%% Enable Erlang shell
ssh:daemon(Port, [{shell, {shell, start, []}} | Options])

%% Enable Erlang term evaluation via exec
ssh:daemon(Port, [{exec, undefined} | Options])

SFTP and other subsystems are unaffected by this change.

[github-actions]

CT Test Results

    3 files     92 suites   1h 36m 28s ⏱️
2 190 tests 1 768 ✅ 419 💤 3 ❌
3 641 runs  3 137 ✅ 501 💤 3 ❌

For more details on these failures, see this check.

Results for commit 3dbfc21.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

• Complete CT logs (Download Logs)
• HTML Documentation (Download HTML Docs)
• No Windows Installer found

// Erlang/OTP Github Action Bot

[Mikaka27]

Minor formatting problems and one question.

[Mikaka27]

Besides the added comments change looks ok me. It would be great if the comment in the PR description was updated to reflect the current state of changes before/after this is merged.

[Mikaka27]

Why have this value as default if exec is disabled by default?

[Mikaka27]

This test fails on my machine (line 2114) with following error:

ssh_connection_SUITE:2075 Got unexpected {#Ref<0.1007350121.354418689.14699>,
                                          #{meta =>
                                             #{error_logger =>
                                                #{tag => info_report,
                                                  type => progress,
                                                  report_cb =>
                                                   fun supervisor:format_log/1},
                                               line => 2323,
                                               pid => <0.18567.0>,
                                               time => 1775469388246684,
                                               file => "supervisor.erl",
                                               gl => <0.18564.0>,
                                               domain => [otp,sasl],
                                               logger_formatter =>
                                                #{title => "PROGRESS REPORT"},
                                               mfa =>
                                                {supervisor,report_progress,3},
                                               report_cb =>
                                                fun supervisor:format_log/2},
                                            msg =>
                                             {report,
                                              #{label => {supervisor,progress},
                                                report =>
                                                 [{supervisor,
                                                   {local,sshd_sup}},
                                                  {started,
                                                   [{pid,<0.18568.0>},
                                                    {id,ssh_lsocket_sup},
                                                    {mfargs,
                                                     {ssh_lsocket_sup,
                                                      start_link,[]}},
                                                    {restart_type,permanent},
                                                    {significant,false},
                                                    {shutdown,infinity},
                                                    {child_type,
                                                     supervisor}]}]}},
                                            level => info}}
Expect: {ssh_cm,<0.18575.0>,{data,0,'0|1',<<"Prohibited.">>}}

[u3s]

should be fixed in other PR, once I push

[u3s]

close in favor of PR-10970