Cannot install sshd (openssh-server) on debian 10.4

Question

This is a fresh install of Debian-10.4. The sources.list file follows:

# deb cdrom:[Debian GNU/Linux 10.4.0 Buster - Official amd64 DVD Binary-1 20200 0509-10:26]/ buster contrib main

deb http://security.debian.org/debian-security buster/updates main contrib
deb-src http://security.debian.org/debian-security buster/updates main contrib

# buster-updates, previously known as 'volatile'
# A network mirror was not selected during install.  The following entries
# are provided as examples, but you should amend them as appropriate
# for your mirror of choice.
#
deb http://deb.debian.org/debian/ buster-updates main contrib
deb-src http://deb.debian.org/debian/ buster-updates main contrib

When I try to install sshd (openssh-serverr) I get this:

[root@smb4-a ~]# apt install -f openssh-server
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 openssh-server : Depends: openssh-client (= 1:7.9p1-10+deb10u1) but 1:7.9p1-10+deb10u2 is to be installed
                  Depends: openssh-sftp-server but it is not going to be installed
E: Unable to correct problems, you have held broken packages.

I am not even going to try to imagine what sort of distribution does not supply a secure remote access as part of the base install. Whatever the reasoning that appears to be the case with Debian and I need such. The problem appears to be this:

 openssh-server : Depends: openssh-client (= 1:7.9p1-10+deb10u1) but 1:7.9p1-10+deb10u2 is to be installed

How is a broken dependency forced to install?

Further info:

[root@smb4-a ~]# apt-get update
Get:1 http://deb.debian.org/debian buster-updates InRelease [49.3 kB]
Hit:2 http://security.debian.org/debian-security buster/updates InRelease
Get:3 http://deb.debian.org/debian buster-updates/main Sources [3,088 B]
Get:4 http://deb.debian.org/debian buster-updates/main amd64 Packages [7,380 B]
Get:5 http://deb.debian.org/debian buster-updates/main Translation-en [5,166 B]
Fetched 64.9 kB in 0s (358 kB/s)           
Reading package lists... Done
[root@smb4-a ~]# apt-get upgrade
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Further information:

# apt policy openssh-*
openssh-sftp-server:
  Installed: (none)
  Candidate: 1:7.9p1-10+deb10u1
  Version table:
     1:7.9p1-10+deb10u1 500
        500 http://security.debian.org/debian-security buster/updates/main amd64 Packages
openssh-tests:
  Installed: (none)
  Candidate: 1:7.9p1-10+deb10u1
  Version table:
     1:7.9p1-10+deb10u1 500
        500 http://security.debian.org/debian-security buster/updates/main amd64 Packages
openssh-server:
  Installed: (none)
  Candidate: 1:7.9p1-10+deb10u1
  Version table:
     1:7.9p1-10+deb10u1 500
        500 http://security.debian.org/debian-security buster/updates/main amd64 Packages
openssh-client:
  Installed: 1:7.9p1-10+deb10u2
  Candidate: 1:7.9p1-10+deb10u2
  Version table:
 *** 1:7.9p1-10+deb10u2 100
        100 /var/lib/dpkg/status
     1:7.9p1-10+deb10u1 500
        500 http://security.debian.org/debian-security buster/updates/main amd64 Packages

Solution

It seems that during the install, you answered "No" to the question "Use a network mirror?", and so your system left configured without a mirror (or maybe you didn't have a network connection during install). This, by the way, is indicated by your sources.list:

# A network mirror was not selected during install.  The following entries
# are provided as examples, but you should amend them as appropriate
# for your mirror of choice.

So now you have an incomplete sources.list, which contains updates and security fixes, but doesn't contain the base system. I don't know how the DVD line got commented out from your sources.list, since the installer does not remove it if there are no network mirrors.

You have to configure a mirror in order to be able to properly install packages. Add this line to your sources.list:

deb http://ftp.us.debian.org/debian/ buster main contrib non-free

and run apt update. After that, you can install openssh-server.

You might want to switch the mirror to something closer to you, this can be done by changing the us part of the URL to correspond to your country, or supplying a different mirror. The list of mirror sites is available here.

Alternatively, you can install the netselect-apt package, which will search for the fastest mirror near you.

As a side note: Debian does supply a secure remote shell, all you have to do is tick "SSH Server" on the "Software selection" page during install (why it is not selected by default is beyond me, but still).

Comments

[Esa Jokinen]

Did you apt-get update and apt-get upgrade first?

[James B. Byrne]

I thought that I had but I re-ran both and the result is the same.

[Piotr P. Karwasz]

Run apt policy openssh-* and add the output. Seems like your system is trying to install the version in buster-security (deb10u1) instead of the more recent one in buster.

[Mike Fiedler]

This line already exists in the original question example. Why would this be any different?

[James B. Byrne]

This install was to a BHyve VM on FreeBSd-12. The virtual IO network was not available. I was expecting to be asked to select available software on startup during the installer but I do not recall seeing this presented as an option. I did go through the procedure twice and I have no recollection of seeing such a choice. This does not mean that option was not there, but if it was then for some reason it did not register with me.

[James B. Byrne]

Your instructions worked. Thank you for your help. I appreciate it. The dvd was disabled by myself because of this:

[James B. Byrne]

E: The repository 'cdrom://[Debian GNU/Linux 10.4.0 _Buster_ - Official amd64 DVD Binary-1 20200509-10:26] buster Release' does not have a Release file. N: Updating from such a repository can't be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details.

[Lacek]

I usually don't use DVDs for installing packages, but they really should work. After a little digging, I found this bug report, originally reported in 2015, which is strangely similar to what is happening right now. For now, you should use repositories from the internet only, or DVDs only, but don't mix the two source types. In the latter case, use apt-cdrom add to scan the DVDs. Use apt update only when you're using repositories from internet. It is more than unfortunate that the installer screws this up.