Re: [Buildroot] [PATCH v2 1/4] package/openssh: don't kill open sessions on restart

["Yann E. MORIN" <yann.morin.1998@free.fr>]

Fiona, All,

On 2024-07-02 18:57 +0200, Fiona Klute via buildroot spake thusly:
> From: "Fiona Klute (WIWA)" <fiona.klute@gmx.de>
> 
> The previously used "killall sshd" stopped all instances of sshd. With
> OpenSSH before 9.8 that meant not only the listening server, but also
> instances serving currently open sessions, possibly including the one
> used to send the restart command, preventing it from completing the
> "start" part of "restart" and leaving the system unreachable over SSH.
> 
> Instead, use the PID file that sshd creates by default to target only
> the listening server. This leaves any open SSH sessions unaffected.

Rather than play with the PID ourselves, can we use start-stop-daemon
instead? Currently, we run sshd and it daemonises all by itself, but if
we pass -D, then start-stop-daemon will be able to do that, and handle
the PID file automatically for us.

Regards,
Yann E. MORIN.

> With OpenSSH 9.8 open sessions are handled by the separate
> sshd-session binary so killall does not hit them any more, but
> a targeted "kill" command is still desirable.
> 
> Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
> ---
[--SNIP--]
> diff --git a/package/openssh/S50sshd b/package/openssh/S50sshd
> index 22da41d1ca..f1ff9dfec1 100644
> --- a/package/openssh/S50sshd
> +++ b/package/openssh/S50sshd
> @@ -3,6 +3,8 @@
>  # sshd        Starts sshd.
>  #
> 
> +PIDFILE="/var/run/sshd.pid"
> +
>  # Make sure the ssh-keygen progam exists
>  [ -f /usr/bin/ssh-keygen ] || exit 0
> 
> @@ -14,15 +16,25 @@ start() {
> 
>  	printf "Starting sshd: "
>  	/usr/sbin/sshd
> -	touch /var/lock/sshd
>  	echo "OK"
>  }
> +
>  stop() {
>  	printf "Stopping sshd: "
> -	killall sshd
> -	rm -f /var/lock/sshd
> +	pid="$( cat "${PIDFILE}" 2>/dev/null || true )"
> +	if [ -z "${pid}" ]; then
> +		echo "ERROR: not running"
> +		return 1
> +	fi
> +	kill "${pid}"
> +	# SSHD deletes its PID file when exiting, wait for it to
> +	# disappear.
> +	while [ -f "${PIDFILE}" ]; do
> +		sleep 0.1
> +	done
>  	echo "OK"
>  }
> +
>  restart() {
>  	stop
>  	start
> @@ -44,4 +56,3 @@ case "$1" in
>  esac
> 
>  exit $?
> -
> --
> 2.45.2
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot