* [Buildroot] package/openssh: improve ssh services
@ 2020-06-11 9:14 Norbert Lange
2020-06-11 9:14 ` [Buildroot] [PATCH v2 1/3] package/openssh: improve integration for systemd Norbert Lange
` (2 more replies)
0 siblings, 3 replies; 8+ messages in thread
From: Norbert Lange @ 2020-06-11 9:14 UTC (permalink / raw)
To: buildroot
changes v1->v2:
- rebase, skip upstreamed patch #1
- add comment for #2 regarding the choice of RemainAfterExit
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH v2 1/3] package/openssh: improve integration for systemd
2020-06-11 9:14 [Buildroot] package/openssh: improve ssh services Norbert Lange
@ 2020-06-11 9:14 ` Norbert Lange
2020-06-11 9:16 ` Norbert Lange
2020-06-11 9:14 ` [Buildroot] [PATCH v2 2/3] package/openssh: seperate sd service for host key generation Norbert Lange
2020-06-11 9:14 ` [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services Norbert Lange
2 siblings, 1 reply; 8+ messages in thread
From: Norbert Lange @ 2020-06-11 9:14 UTC (permalink / raw)
To: buildroot
the openssh daemon is not suited for systemd's simple
service type. dependend services should only start
when sshd is ready to accept connections.
A patch is added from debian to allow openssh
to communicate this state.
Restarts are prevented if the reason is a faulty
config file (errocode 255).
The "user confinement directory" is changed to
'/run/sshd' which is automatically managed by systemd.
Signed-off-by: Norbert Lange <nolange79@gmail.com>
---
package/openssh/00-systemd-readiness.patch | 84 ++++++++++++++++++++++
package/openssh/openssh.mk | 14 +++-
package/openssh/sshd-sysusers.conf | 2 +-
package/openssh/sshd.service | 13 +++-
4 files changed, 109 insertions(+), 4 deletions(-)
create mode 100644 package/openssh/00-systemd-readiness.patch
diff --git a/package/openssh/00-systemd-readiness.patch b/package/openssh/00-systemd-readiness.patch
new file mode 100644
index 0000000000..be3b6b0074
--- /dev/null
+++ b/package/openssh/00-systemd-readiness.patch
@@ -0,0 +1,84 @@
+From ab765b2bd55062a704f09da8f8c1c4ad1d6630a7 Mon Sep 17 00:00:00 2001
+From: Michael Biebl <biebl@debian.org>
+Date: Mon, 21 Dec 2015 16:08:47 +0000
+Subject: Add systemd readiness notification support
+
+Bug-Debian: https://bugs.debian.org/778913
+Forwarded: no
+Last-Update: 2017-08-22
+
+Patch-Name: systemd-readiness.patch
+---
+ configure.ac | 24 ++++++++++++++++++++++++
+ sshd.c | 9 +++++++++
+ 2 files changed, 33 insertions(+)
+
+diff --git a/configure.ac b/configure.ac
+index e894db9fc..c119d6fd1 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -4499,6 +4499,29 @@ AC_ARG_WITH([kerberos5],
+ AC_SUBST([GSSLIBS])
+ AC_SUBST([K5LIBS])
+
++# Check whether user wants systemd support
++SYSTEMD_MSG="no"
++AC_ARG_WITH(systemd,
++ [ --with-systemd Enable systemd support],
++ [ if test "x$withval" != "xno" ; then
++ AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
++ if test "$PKGCONFIG" != "no"; then
++ AC_MSG_CHECKING([for libsystemd])
++ if $PKGCONFIG --exists libsystemd; then
++ SYSTEMD_CFLAGS=`$PKGCONFIG --cflags libsystemd`
++ SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd`
++ CPPFLAGS="$CPPFLAGS $SYSTEMD_CFLAGS"
++ SSHDLIBS="$SSHDLIBS $SYSTEMD_LIBS"
++ AC_MSG_RESULT([yes])
++ AC_DEFINE(HAVE_SYSTEMD, 1, [Define if you want systemd support.])
++ SYSTEMD_MSG="yes"
++ else
++ AC_MSG_RESULT([no])
++ fi
++ fi
++ fi ]
++)
++
+ # Looking for programs, paths and files
+
+ PRIVSEP_PATH=/var/empty
+@@ -5305,6 +5328,7 @@ echo " libldns support: $LDNS_MSG"
+ echo " Solaris process contract support: $SPC_MSG"
+ echo " Solaris project support: $SP_MSG"
+ echo " Solaris privilege support: $SPP_MSG"
++echo " systemd support: $SYSTEMD_MSG"
+ echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
+ echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
+ echo " BSD Auth support: $BSD_AUTH_MSG"
+diff --git a/sshd.c b/sshd.c
+index 4e8ff0662..5e7679a33 100644
+--- a/sshd.c
++++ b/sshd.c
+@@ -85,6 +85,10 @@
+ #include <prot.h>
+ #endif
+
++#ifdef HAVE_SYSTEMD
++#include <systemd/sd-daemon.h>
++#endif
++
+ #include "xmalloc.h"
+ #include "ssh.h"
+ #include "ssh2.h"
+@@ -1951,6 +1955,11 @@ main(int ac, char **av)
+ }
+ }
+
++#ifdef HAVE_SYSTEMD
++ /* Signal systemd that we are ready to accept connections */
++ sd_notify(0, "READY=1");
++#endif
++
+ /* Accept a connection and return in a forked child */
+ server_accept_loop(&sock_in, &sock_out,
+ &newsock, config_s);
diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
index 64ac22181b..3e0a85ae2e 100644
--- a/package/openssh/openssh.mk
+++ b/package/openssh/openssh.mk
@@ -12,6 +12,7 @@ OPENSSH_CONF_ENV = \
LD="$(TARGET_CC)" \
LDFLAGS="$(TARGET_CFLAGS)" \
LIBS=`$(PKG_CONFIG_HOST_BINARY) --libs openssl`
+OPENSSH_AUTORECONF = YES
OPENSSH_CONF_OPTS = \
--sysconfdir=/etc/ssh \
--with-default-path=$(BR2_SYSTEM_DEFAULT_PATH) \
@@ -22,9 +23,20 @@ OPENSSH_CONF_OPTS = \
--disable-wtmpx \
--disable-strip
+ifeq ($(BR2_PACKAGE_SYSTEMD),y)
+OPENSSH_DEPENDENCIES = systemd
+
+OPENSSH_CONF_OPTS += \
+ --with-privsep-path=/run/sshd \
+ --with-pid-dir=/run \
+ --with-systemd
+
+else
+
define OPENSSH_PERMISSIONS
/var/empty d 755 root root - - - - -
endef
+endif
ifeq ($(BR2_TOOLCHAIN_SUPPORTS_PIE),)
OPENSSH_CONF_OPTS += --without-pie
@@ -74,7 +86,7 @@ define OPENSSH_INSTALL_SYSTEMD_SYSUSERS
endef
else
define OPENSSH_USERS
- sshd -1 sshd -1 * /var/empty - - SSH drop priv user
+ sshd -1 sshd -1 * $(if $(BR2_PACKAGE_SYSTEMD),/run/sshd,/var/empty) - - SSH drop priv user
endef
endif
diff --git a/package/openssh/sshd-sysusers.conf b/package/openssh/sshd-sysusers.conf
index ac77aec065..303d0dbb63 100644
--- a/package/openssh/sshd-sysusers.conf
+++ b/package/openssh/sshd-sysusers.conf
@@ -1 +1 @@
-u sshd - "SSH drop priv user" /var/empty
+u sshd - "SSH drop priv user" /run/sshd
diff --git a/package/openssh/sshd.service b/package/openssh/sshd.service
index b5e96b3a25..715bd3f7eb 100644
--- a/package/openssh/sshd.service
+++ b/package/openssh/sshd.service
@@ -1,11 +1,20 @@
[Unit]
Description=OpenSSH server daemon
-After=syslog.target network.target auditd.service
+Documentation=man:sshd(8) man:sshd_config(5)
+After=network.target auditd.service
[Service]
ExecStartPre=/usr/bin/ssh-keygen -A
-ExecStart=/usr/sbin/sshd -D -e
+ExecStartPre=/usr/sbin/sshd -t
+ExecStart=/usr/sbin/sshd -D
+ExecReload=/usr/sbin/sshd -t
ExecReload=/bin/kill -HUP $MAINPID
+KillMode=process
+Restart=on-failure
+RestartPreventExitStatus=255
+Type=notify
+RuntimeDirectory=sshd
+RuntimeDirectoryMode=0755
[Install]
WantedBy=multi-user.target
--
2.26.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH v2 2/3] package/openssh: seperate sd service for host key generation
2020-06-11 9:14 [Buildroot] package/openssh: improve ssh services Norbert Lange
2020-06-11 9:14 ` [Buildroot] [PATCH v2 1/3] package/openssh: improve integration for systemd Norbert Lange
@ 2020-06-11 9:14 ` Norbert Lange
2020-06-11 9:14 ` [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services Norbert Lange
2 siblings, 0 replies; 8+ messages in thread
From: Norbert Lange @ 2020-06-11 9:14 UTC (permalink / raw)
To: buildroot
split out generation of host keys into an optional service
that can easily be removed or deactivated.
Signed-off-by: Norbert Lange <nolange79@gmail.com>
Reviewed-by: J?r?my ROSEN <jeremy.rosen@smile.fr>
---
package/openssh/openssh.mk | 5 +++--
package/openssh/sshd-host-keygen.service | 23 +++++++++++++++++++++++
package/openssh/sshd.service | 1 -
3 files changed, 26 insertions(+), 3 deletions(-)
create mode 100644 package/openssh/sshd-host-keygen.service
diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
index 3e0a85ae2e..1fcd957299 100644
--- a/package/openssh/openssh.mk
+++ b/package/openssh/openssh.mk
@@ -116,8 +116,9 @@ endef
OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_SERVER_PROGRAMS
define OPENSSH_INSTALL_INIT_SYSTEMD
- $(INSTALL) -D -m 644 package/openssh/sshd.service \
- $(TARGET_DIR)/usr/lib/systemd/system/sshd.service
+ mkdir $(TARGET_DIR)/usr/lib/systemd/system
+ $(INSTALL) -m 644 package/openssh/sshd*.service \
+ $(TARGET_DIR)/usr/lib/systemd/system/
$(OPENSSH_INSTALL_SYSTEMD_SYSUSERS)
endef
diff --git a/package/openssh/sshd-host-keygen.service b/package/openssh/sshd-host-keygen.service
new file mode 100644
index 0000000000..2db1be16c4
--- /dev/null
+++ b/package/openssh/sshd-host-keygen.service
@@ -0,0 +1,23 @@
+[Unit]
+Description=SSH Key Generation
+Before=sshd.service
+
+ConditionPathExists=|!/etc/ssh/ssh_host_dsa_key
+ConditionPathExists=|!/etc/ssh/ssh_host_dsa_key.pub
+ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key
+ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key.pub
+ConditionPathExists=|!/etc/ssh/ssh_host_ed25519_key
+ConditionPathExists=|!/etc/ssh/ssh_host_ed25519_key.pub
+ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key
+ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key.pub
+
+[Service]
+ExecStart=/usr/bin/ssh-keygen -A
+Type=oneshot
+# systemd changed behaviour in v245 leading to various drawbacks,
+# seems like every one-shot service should use RemainAfterExit
+# https://github.com/systemd/systemd/issues/15091
+RemainAfterExit=yes
+
+[Install]
+WantedBy=sshd.service
diff --git a/package/openssh/sshd.service b/package/openssh/sshd.service
index 715bd3f7eb..797e249d8d 100644
--- a/package/openssh/sshd.service
+++ b/package/openssh/sshd.service
@@ -4,7 +4,6 @@ Documentation=man:sshd(8) man:sshd_config(5)
After=network.target auditd.service
[Service]
-ExecStartPre=/usr/bin/ssh-keygen -A
ExecStartPre=/usr/sbin/sshd -t
ExecStart=/usr/sbin/sshd -D
ExecReload=/usr/sbin/sshd -t
--
2.26.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services
2020-06-11 9:14 [Buildroot] package/openssh: improve ssh services Norbert Lange
2020-06-11 9:14 ` [Buildroot] [PATCH v2 1/3] package/openssh: improve integration for systemd Norbert Lange
2020-06-11 9:14 ` [Buildroot] [PATCH v2 2/3] package/openssh: seperate sd service for host key generation Norbert Lange
@ 2020-06-11 9:14 ` Norbert Lange
2020-06-11 9:35 ` Jérémy ROSEN
2 siblings, 1 reply; 8+ messages in thread
From: Norbert Lange @ 2020-06-11 9:14 UTC (permalink / raw)
To: buildroot
Signed-off-by: Norbert Lange <nolange79@gmail.com>
---
package/openssh/openssh.mk | 6 +++---
package/openssh/sshd-host-keygen.service | 2 +-
package/openssh/sshd.socket | 11 +++++++++++
package/openssh/sshd at .service | 10 ++++++++++
4 files changed, 25 insertions(+), 4 deletions(-)
create mode 100644 package/openssh/sshd.socket
create mode 100644 package/openssh/sshd at .service
diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
index 1fcd957299..cbfe8f6f7d 100644
--- a/package/openssh/openssh.mk
+++ b/package/openssh/openssh.mk
@@ -116,9 +116,9 @@ endef
OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_SERVER_PROGRAMS
define OPENSSH_INSTALL_INIT_SYSTEMD
- mkdir $(TARGET_DIR)/usr/lib/systemd/system
- $(INSTALL) -m 644 package/openssh/sshd*.service \
- $(TARGET_DIR)/usr/lib/systemd/system/
+ mkdir -p $(TARGET_DIR)/usr/lib/systemd/system
+ $(INSTALL) -m 644 package/openssh/sshd*.service package/openssh/sshd.socket \
+ $(TARGET_DIR)/usr/lib/systemd/system/.
$(OPENSSH_INSTALL_SYSTEMD_SYSUSERS)
endef
diff --git a/package/openssh/sshd-host-keygen.service b/package/openssh/sshd-host-keygen.service
index 2db1be16c4..0e071c9d8c 100644
--- a/package/openssh/sshd-host-keygen.service
+++ b/package/openssh/sshd-host-keygen.service
@@ -20,4 +20,4 @@ Type=oneshot
RemainAfterExit=yes
[Install]
-WantedBy=sshd.service
+WantedBy=sshd.service sshd.socket
diff --git a/package/openssh/sshd.socket b/package/openssh/sshd.socket
new file mode 100644
index 0000000000..bbae9ed7aa
--- /dev/null
+++ b/package/openssh/sshd.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=OpenBSD Secure Shell server socket
+Before=sshd.service
+Conflicts=sshd.service
+
+[Socket]
+ListenStream=22
+Accept=yes
+
+[Install]
+WantedBy=sockets.target
diff --git a/package/openssh/sshd at .service b/package/openssh/sshd at .service
new file mode 100644
index 0000000000..b3a590d9a3
--- /dev/null
+++ b/package/openssh/sshd at .service
@@ -0,0 +1,10 @@
+[Unit]
+Description=OpenBSD Secure Shell server per-connection daemon
+Documentation=man:sshd(8) man:sshd_config(5)
+After=auditd.service
+
+[Service]
+ExecStart=-/usr/sbin/sshd -i
+StandardInput=socket
+RuntimeDirectory=sshd
+RuntimeDirectoryMode=0755
--
2.26.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH v2 1/3] package/openssh: improve integration for systemd
2020-06-11 9:14 ` [Buildroot] [PATCH v2 1/3] package/openssh: improve integration for systemd Norbert Lange
@ 2020-06-11 9:16 ` Norbert Lange
0 siblings, 0 replies; 8+ messages in thread
From: Norbert Lange @ 2020-06-11 9:16 UTC (permalink / raw)
To: buildroot
This one is missing from v1 (was not changed):
Reviewed-by: J?r?my ROSEN <jeremy.rosen@smile.fr>
Am Do., 11. Juni 2020 um 11:14 Uhr schrieb Norbert Lange <nolange79@gmail.com>:
>
> the openssh daemon is not suited for systemd's simple
> service type. dependend services should only start
> when sshd is ready to accept connections.
>
> A patch is added from debian to allow openssh
> to communicate this state.
>
> Restarts are prevented if the reason is a faulty
> config file (errocode 255).
>
> The "user confinement directory" is changed to
> '/run/sshd' which is automatically managed by systemd.
>
> Signed-off-by: Norbert Lange <nolange79@gmail.com>
> ---
> package/openssh/00-systemd-readiness.patch | 84 ++++++++++++++++++++++
> package/openssh/openssh.mk | 14 +++-
> package/openssh/sshd-sysusers.conf | 2 +-
> package/openssh/sshd.service | 13 +++-
> 4 files changed, 109 insertions(+), 4 deletions(-)
> create mode 100644 package/openssh/00-systemd-readiness.patch
>
> diff --git a/package/openssh/00-systemd-readiness.patch b/package/openssh/00-systemd-readiness.patch
> new file mode 100644
> index 0000000000..be3b6b0074
> --- /dev/null
> +++ b/package/openssh/00-systemd-readiness.patch
> @@ -0,0 +1,84 @@
> +From ab765b2bd55062a704f09da8f8c1c4ad1d6630a7 Mon Sep 17 00:00:00 2001
> +From: Michael Biebl <biebl@debian.org>
> +Date: Mon, 21 Dec 2015 16:08:47 +0000
> +Subject: Add systemd readiness notification support
> +
> +Bug-Debian: https://bugs.debian.org/778913
> +Forwarded: no
> +Last-Update: 2017-08-22
> +
> +Patch-Name: systemd-readiness.patch
> +---
> + configure.ac | 24 ++++++++++++++++++++++++
> + sshd.c | 9 +++++++++
> + 2 files changed, 33 insertions(+)
> +
> +diff --git a/configure.ac b/configure.ac
> +index e894db9fc..c119d6fd1 100644
> +--- a/configure.ac
> ++++ b/configure.ac
> +@@ -4499,6 +4499,29 @@ AC_ARG_WITH([kerberos5],
> + AC_SUBST([GSSLIBS])
> + AC_SUBST([K5LIBS])
> +
> ++# Check whether user wants systemd support
> ++SYSTEMD_MSG="no"
> ++AC_ARG_WITH(systemd,
> ++ [ --with-systemd Enable systemd support],
> ++ [ if test "x$withval" != "xno" ; then
> ++ AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
> ++ if test "$PKGCONFIG" != "no"; then
> ++ AC_MSG_CHECKING([for libsystemd])
> ++ if $PKGCONFIG --exists libsystemd; then
> ++ SYSTEMD_CFLAGS=`$PKGCONFIG --cflags libsystemd`
> ++ SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd`
> ++ CPPFLAGS="$CPPFLAGS $SYSTEMD_CFLAGS"
> ++ SSHDLIBS="$SSHDLIBS $SYSTEMD_LIBS"
> ++ AC_MSG_RESULT([yes])
> ++ AC_DEFINE(HAVE_SYSTEMD, 1, [Define if you want systemd support.])
> ++ SYSTEMD_MSG="yes"
> ++ else
> ++ AC_MSG_RESULT([no])
> ++ fi
> ++ fi
> ++ fi ]
> ++)
> ++
> + # Looking for programs, paths and files
> +
> + PRIVSEP_PATH=/var/empty
> +@@ -5305,6 +5328,7 @@ echo " libldns support: $LDNS_MSG"
> + echo " Solaris process contract support: $SPC_MSG"
> + echo " Solaris project support: $SP_MSG"
> + echo " Solaris privilege support: $SPP_MSG"
> ++echo " systemd support: $SYSTEMD_MSG"
> + echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
> + echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
> + echo " BSD Auth support: $BSD_AUTH_MSG"
> +diff --git a/sshd.c b/sshd.c
> +index 4e8ff0662..5e7679a33 100644
> +--- a/sshd.c
> ++++ b/sshd.c
> +@@ -85,6 +85,10 @@
> + #include <prot.h>
> + #endif
> +
> ++#ifdef HAVE_SYSTEMD
> ++#include <systemd/sd-daemon.h>
> ++#endif
> ++
> + #include "xmalloc.h"
> + #include "ssh.h"
> + #include "ssh2.h"
> +@@ -1951,6 +1955,11 @@ main(int ac, char **av)
> + }
> + }
> +
> ++#ifdef HAVE_SYSTEMD
> ++ /* Signal systemd that we are ready to accept connections */
> ++ sd_notify(0, "READY=1");
> ++#endif
> ++
> + /* Accept a connection and return in a forked child */
> + server_accept_loop(&sock_in, &sock_out,
> + &newsock, config_s);
> diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
> index 64ac22181b..3e0a85ae2e 100644
> --- a/package/openssh/openssh.mk
> +++ b/package/openssh/openssh.mk
> @@ -12,6 +12,7 @@ OPENSSH_CONF_ENV = \
> LD="$(TARGET_CC)" \
> LDFLAGS="$(TARGET_CFLAGS)" \
> LIBS=`$(PKG_CONFIG_HOST_BINARY) --libs openssl`
> +OPENSSH_AUTORECONF = YES
> OPENSSH_CONF_OPTS = \
> --sysconfdir=/etc/ssh \
> --with-default-path=$(BR2_SYSTEM_DEFAULT_PATH) \
> @@ -22,9 +23,20 @@ OPENSSH_CONF_OPTS = \
> --disable-wtmpx \
> --disable-strip
>
> +ifeq ($(BR2_PACKAGE_SYSTEMD),y)
> +OPENSSH_DEPENDENCIES = systemd
> +
> +OPENSSH_CONF_OPTS += \
> + --with-privsep-path=/run/sshd \
> + --with-pid-dir=/run \
> + --with-systemd
> +
> +else
> +
> define OPENSSH_PERMISSIONS
> /var/empty d 755 root root - - - - -
> endef
> +endif
>
> ifeq ($(BR2_TOOLCHAIN_SUPPORTS_PIE),)
> OPENSSH_CONF_OPTS += --without-pie
> @@ -74,7 +86,7 @@ define OPENSSH_INSTALL_SYSTEMD_SYSUSERS
> endef
> else
> define OPENSSH_USERS
> - sshd -1 sshd -1 * /var/empty - - SSH drop priv user
> + sshd -1 sshd -1 * $(if $(BR2_PACKAGE_SYSTEMD),/run/sshd,/var/empty) - - SSH drop priv user
> endef
> endif
>
> diff --git a/package/openssh/sshd-sysusers.conf b/package/openssh/sshd-sysusers.conf
> index ac77aec065..303d0dbb63 100644
> --- a/package/openssh/sshd-sysusers.conf
> +++ b/package/openssh/sshd-sysusers.conf
> @@ -1 +1 @@
> -u sshd - "SSH drop priv user" /var/empty
> +u sshd - "SSH drop priv user" /run/sshd
> diff --git a/package/openssh/sshd.service b/package/openssh/sshd.service
> index b5e96b3a25..715bd3f7eb 100644
> --- a/package/openssh/sshd.service
> +++ b/package/openssh/sshd.service
> @@ -1,11 +1,20 @@
> [Unit]
> Description=OpenSSH server daemon
> -After=syslog.target network.target auditd.service
> +Documentation=man:sshd(8) man:sshd_config(5)
> +After=network.target auditd.service
>
> [Service]
> ExecStartPre=/usr/bin/ssh-keygen -A
> -ExecStart=/usr/sbin/sshd -D -e
> +ExecStartPre=/usr/sbin/sshd -t
> +ExecStart=/usr/sbin/sshd -D
> +ExecReload=/usr/sbin/sshd -t
> ExecReload=/bin/kill -HUP $MAINPID
> +KillMode=process
> +Restart=on-failure
> +RestartPreventExitStatus=255
> +Type=notify
> +RuntimeDirectory=sshd
> +RuntimeDirectoryMode=0755
>
> [Install]
> WantedBy=multi-user.target
> --
> 2.26.2
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services
2020-06-11 9:14 ` [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services Norbert Lange
@ 2020-06-11 9:35 ` Jérémy ROSEN
2020-06-11 9:54 ` Norbert Lange
0 siblings, 1 reply; 8+ messages in thread
From: Jérémy ROSEN @ 2020-06-11 9:35 UTC (permalink / raw)
To: buildroot
Reviewed-By J?r?my Rosen <jeremy.rosen@smile.fr>
(I think I didn't add my RB for that one..)
Le jeu. 11 juin 2020 ? 11:14, Norbert Lange <nolange79@gmail.com> a ?crit :
> Signed-off-by: Norbert Lange <nolange79@gmail.com>
> ---
> package/openssh/openssh.mk | 6 +++---
> package/openssh/sshd-host-keygen.service | 2 +-
> package/openssh/sshd.socket | 11 +++++++++++
> package/openssh/sshd at .service | 10 ++++++++++
> 4 files changed, 25 insertions(+), 4 deletions(-)
> create mode 100644 package/openssh/sshd.socket
> create mode 100644 package/openssh/sshd at .service
>
> diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
> index 1fcd957299..cbfe8f6f7d 100644
> --- a/package/openssh/openssh.mk
> +++ b/package/openssh/openssh.mk
> @@ -116,9 +116,9 @@ endef
> OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_SERVER_PROGRAMS
>
> define OPENSSH_INSTALL_INIT_SYSTEMD
> - mkdir $(TARGET_DIR)/usr/lib/systemd/system
> - $(INSTALL) -m 644 package/openssh/sshd*.service \
> - $(TARGET_DIR)/usr/lib/systemd/system/
> + mkdir -p $(TARGET_DIR)/usr/lib/systemd/system
> + $(INSTALL) -m 644 package/openssh/sshd*.service
> package/openssh/sshd.socket \
> + $(TARGET_DIR)/usr/lib/systemd/system/.
> $(OPENSSH_INSTALL_SYSTEMD_SYSUSERS)
> endef
>
> diff --git a/package/openssh/sshd-host-keygen.service
> b/package/openssh/sshd-host-keygen.service
> index 2db1be16c4..0e071c9d8c 100644
> --- a/package/openssh/sshd-host-keygen.service
> +++ b/package/openssh/sshd-host-keygen.service
> @@ -20,4 +20,4 @@ Type=oneshot
> RemainAfterExit=yes
>
> [Install]
> -WantedBy=sshd.service
> +WantedBy=sshd.service sshd.socket
> diff --git a/package/openssh/sshd.socket b/package/openssh/sshd.socket
> new file mode 100644
> index 0000000000..bbae9ed7aa
> --- /dev/null
> +++ b/package/openssh/sshd.socket
> @@ -0,0 +1,11 @@
> +[Unit]
> +Description=OpenBSD Secure Shell server socket
> +Before=sshd.service
> +Conflicts=sshd.service
> +
> +[Socket]
> +ListenStream=22
> +Accept=yes
> +
> +[Install]
> +WantedBy=sockets.target
> diff --git a/package/openssh/sshd at .service b/package/openssh/sshd at .service
> new file mode 100644
> index 0000000000..b3a590d9a3
> --- /dev/null
> +++ b/package/openssh/sshd at .service
> @@ -0,0 +1,10 @@
> +[Unit]
> +Description=OpenBSD Secure Shell server per-connection daemon
> +Documentation=man:sshd(8) man:sshd_config(5)
> +After=auditd.service
> +
> +[Service]
> +ExecStart=-/usr/sbin/sshd -i
> +StandardInput=socket
> +RuntimeDirectory=sshd
> +RuntimeDirectoryMode=0755
> --
> 2.26.2
>
>
--
[image: SMILE] <http://www.smile.eu/>
20 rue des Jardins
92600 Asni?res-sur-Seine
*J?r?my ROSEN*
Architecte technique
[image: email] jeremy.rosen at smile.fr
[image: phone] +33 6 88 25 87 42
[image: url] http://www.smile.eu
[image: Twitter] <https://twitter.com/GroupeSmile> [image: Facebook]
<https://www.facebook.com/smileopensource> [image: LinkedIn]
<https://www.linkedin.com/company/smile> [image: Github]
<https://github.com/Smile-SA>
[image: D?couvrez l?univers Smile, rendez-vous sur smile.eu]
<https://www.smile.eu/fr/publications/livres-blancs/yocto?utm_source=signature&utm_medium=email&utm_campaign=signature>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20200611/13580769/attachment.html>
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services
2020-06-11 9:35 ` Jérémy ROSEN
@ 2020-06-11 9:54 ` Norbert Lange
2020-06-11 13:39 ` Jérémy ROSEN
0 siblings, 1 reply; 8+ messages in thread
From: Norbert Lange @ 2020-06-11 9:54 UTC (permalink / raw)
To: buildroot
J?r?my ROSEN <jeremy.rosen@smile.fr> schrieb am Do., 11. Juni 2020, 11:35:
> Reviewed-By J?r?my Rosen <jeremy.rosen@smile.fr>
>
> (I think I didn't add my RB for that one..)
>
> Le jeu. 11 juin 2020 ? 11:14, Norbert Lange <nolange79@gmail.com> a
> ?crit :
>
>> Signed-off-by: Norbert Lange <nolange79@gmail.com>
>> ---
>> package/openssh/openssh.mk | 6 +++---
>> package/openssh/sshd-host-keygen.service | 2 +-
>> package/openssh/sshd.socket | 11 +++++++++++
>> package/openssh/sshd at .service | 10 ++++++++++
>> 4 files changed, 25 insertions(+), 4 deletions(-)
>> create mode 100644 package/openssh/sshd.socket
>> create mode 100644 package/openssh/sshd at .service
>>
>> diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
>> index 1fcd957299..cbfe8f6f7d 100644
>> --- a/package/openssh/openssh.mk
>> +++ b/package/openssh/openssh.mk
>> @@ -116,9 +116,9 @@ endef
>> OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_SERVER_PROGRAMS
>>
>> define OPENSSH_INSTALL_INIT_SYSTEMD
>> - mkdir $(TARGET_DIR)/usr/lib/systemd/system
>> - $(INSTALL) -m 644 package/openssh/sshd*.service \
>> - $(TARGET_DIR)/usr/lib/systemd/system/
>> + mkdir -p $(TARGET_DIR)/usr/lib/systemd/system
>> + $(INSTALL) -m 644 package/openssh/sshd*.service
>> package/openssh/sshd.socket \
>> + $(TARGET_DIR)/usr/lib/systemd/system/.
>> $(OPENSSH_INSTALL_SYSTEMD_SYSUSERS)
>> endef
>>
>> diff --git a/package/openssh/sshd-host-keygen.service
>> b/package/openssh/sshd-host-keygen.service
>> index 2db1be16c4..0e071c9d8c 100644
>> --- a/package/openssh/sshd-host-keygen.service
>> +++ b/package/openssh/sshd-host-keygen.service
>> @@ -20,4 +20,4 @@ Type=oneshot
>> RemainAfterExit=yes
>>
>> [Install]
>> -WantedBy=sshd.service
>> +WantedBy=sshd.service sshd.socket
>> diff --git a/package/openssh/sshd.socket b/package/openssh/sshd.socket
>> new file mode 100644
>> index 0000000000..bbae9ed7aa
>> --- /dev/null
>> +++ b/package/openssh/sshd.socket
>> @@ -0,0 +1,11 @@
>> +[Unit]
>> +Description=OpenBSD Secure Shell server socket
>> +Before=sshd.service
>> +Conflicts=sshd.service
>> +
>> +[Socket]
>> +ListenStream=22
>> +Accept=yes
>> +
>> +[Install]
>> +WantedBy=sockets.target
>> diff --git a/package/openssh/sshd at .service b/package/openssh/sshd@
>> .service
>> new file mode 100644
>> index 0000000000..b3a590d9a3
>> --- /dev/null
>> +++ b/package/openssh/sshd at .service
>> @@ -0,0 +1,10 @@
>> +[Unit]
>> +Description=OpenBSD Secure Shell server per-connection daemon
>> +Documentation=man:sshd(8) man:sshd_config(5)
>> +After=auditd.service
>> +
>> +[Service]
>> +ExecStart=-/usr/sbin/sshd -i
>> +StandardInput=socket
>> +RuntimeDirectory=sshd
>> +RuntimeDirectoryMode=0755
>> --
>> 2.26.2
>>
>>
>
> --
> [image: SMILE] <http://www.smile.eu/>
>
> 20 rue des Jardins
> 92600 Asni?res-sur-Seine
> *J?r?my ROSEN*
> Architecte technique
>
> [image: email] jeremy.rosen at smile.fr
> [image: phone] +33 6 88 25 87 42
> [image: url] http://www.smile.eu
>
> [image: Twitter] <https://twitter.com/GroupeSmile> [image: Facebook]
> <https://www.facebook.com/smileopensource> [image: LinkedIn]
> <https://www.linkedin.com/company/smile> [image: Github]
> <https://github.com/Smile-SA>
>
> [image: D?couvrez l?univers Smile, rendez-vous sur smile.eu]
> <https://www.smile.eu/fr/publications/livres-blancs/yocto?utm_source=signature&utm_medium=email&utm_campaign=signature>
>
No, but I thought that was intentional, as this patch doesn't have an
option to chose between singular sever and the socket activation mode.
Norbert
>
> <https://www.smile.eu/fr/publications/livres-blancs/yocto?utm_source=signature&utm_medium=email&utm_campaign=signature>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20200611/092b3972/attachment.html>
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services
2020-06-11 9:54 ` Norbert Lange
@ 2020-06-11 13:39 ` Jérémy ROSEN
0 siblings, 0 replies; 8+ messages in thread
From: Jérémy ROSEN @ 2020-06-11 13:39 UTC (permalink / raw)
To: buildroot
Urgh
Thx for pointing that out. That's why I don't like mail-based workflows...
Anyway, I won't block the patch on that particular point, though I'd like
it addressed if possible....
Cheers
Jeremy
Le jeu. 11 juin 2020 ? 11:54, Norbert Lange <nolange79@gmail.com> a ?crit :
>
>
> J?r?my ROSEN <jeremy.rosen@smile.fr> schrieb am Do., 11. Juni 2020, 11:35:
>
>> Reviewed-By J?r?my Rosen <jeremy.rosen@smile.fr>
>>
>> (I think I didn't add my RB for that one..)
>>
>> Le jeu. 11 juin 2020 ? 11:14, Norbert Lange <nolange79@gmail.com> a
>> ?crit :
>>
>>> Signed-off-by: Norbert Lange <nolange79@gmail.com>
>>> ---
>>> package/openssh/openssh.mk | 6 +++---
>>> package/openssh/sshd-host-keygen.service | 2 +-
>>> package/openssh/sshd.socket | 11 +++++++++++
>>> package/openssh/sshd at .service | 10 ++++++++++
>>> 4 files changed, 25 insertions(+), 4 deletions(-)
>>> create mode 100644 package/openssh/sshd.socket
>>> create mode 100644 package/openssh/sshd at .service
>>>
>>> diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
>>> index 1fcd957299..cbfe8f6f7d 100644
>>> --- a/package/openssh/openssh.mk
>>> +++ b/package/openssh/openssh.mk
>>> @@ -116,9 +116,9 @@ endef
>>> OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_SERVER_PROGRAMS
>>>
>>> define OPENSSH_INSTALL_INIT_SYSTEMD
>>> - mkdir $(TARGET_DIR)/usr/lib/systemd/system
>>> - $(INSTALL) -m 644 package/openssh/sshd*.service \
>>> - $(TARGET_DIR)/usr/lib/systemd/system/
>>> + mkdir -p $(TARGET_DIR)/usr/lib/systemd/system
>>> + $(INSTALL) -m 644 package/openssh/sshd*.service
>>> package/openssh/sshd.socket \
>>> + $(TARGET_DIR)/usr/lib/systemd/system/.
>>> $(OPENSSH_INSTALL_SYSTEMD_SYSUSERS)
>>> endef
>>>
>>> diff --git a/package/openssh/sshd-host-keygen.service
>>> b/package/openssh/sshd-host-keygen.service
>>> index 2db1be16c4..0e071c9d8c 100644
>>> --- a/package/openssh/sshd-host-keygen.service
>>> +++ b/package/openssh/sshd-host-keygen.service
>>> @@ -20,4 +20,4 @@ Type=oneshot
>>> RemainAfterExit=yes
>>>
>>> [Install]
>>> -WantedBy=sshd.service
>>> +WantedBy=sshd.service sshd.socket
>>> diff --git a/package/openssh/sshd.socket b/package/openssh/sshd.socket
>>> new file mode 100644
>>> index 0000000000..bbae9ed7aa
>>> --- /dev/null
>>> +++ b/package/openssh/sshd.socket
>>> @@ -0,0 +1,11 @@
>>> +[Unit]
>>> +Description=OpenBSD Secure Shell server socket
>>> +Before=sshd.service
>>> +Conflicts=sshd.service
>>> +
>>> +[Socket]
>>> +ListenStream=22
>>> +Accept=yes
>>> +
>>> +[Install]
>>> +WantedBy=sockets.target
>>> diff --git a/package/openssh/sshd at .service b/package/openssh/sshd@
>>> .service
>>> new file mode 100644
>>> index 0000000000..b3a590d9a3
>>> --- /dev/null
>>> +++ b/package/openssh/sshd at .service
>>> @@ -0,0 +1,10 @@
>>> +[Unit]
>>> +Description=OpenBSD Secure Shell server per-connection daemon
>>> +Documentation=man:sshd(8) man:sshd_config(5)
>>> +After=auditd.service
>>> +
>>> +[Service]
>>> +ExecStart=-/usr/sbin/sshd -i
>>> +StandardInput=socket
>>> +RuntimeDirectory=sshd
>>> +RuntimeDirectoryMode=0755
>>> --
>>> 2.26.2
>>>
>>>
>>
>> --
>> [image: SMILE] <http://www.smile.eu/>
>>
>> 20 rue des Jardins
>> 92600 Asni?res-sur-Seine
>> *J?r?my ROSEN*
>> Architecte technique
>>
>> [image: email] jeremy.rosen at smile.fr
>> [image: phone] +33 6 88 25 87 42
>> [image: url] http://www.smile.eu
>>
>> [image: Twitter] <https://twitter.com/GroupeSmile> [image: Facebook]
>> <https://www.facebook.com/smileopensource> [image: LinkedIn]
>> <https://www.linkedin.com/company/smile> [image: Github]
>> <https://github.com/Smile-SA>
>>
>> [image: D?couvrez l?univers Smile, rendez-vous sur smile.eu]
>> <https://www.smile.eu/fr/publications/livres-blancs/yocto?utm_source=signature&utm_medium=email&utm_campaign=signature>
>>
>
> No, but I thought that was intentional, as this patch doesn't have an
> option to chose between singular sever and the socket activation mode.
>
> Norbert
>
>>
>> <https://www.smile.eu/fr/publications/livres-blancs/yocto?utm_source=signature&utm_medium=email&utm_campaign=signature>
>>
>
--
[image: SMILE] <http://www.smile.eu/>
20 rue des Jardins
92600 Asni?res-sur-Seine
*J?r?my ROSEN*
Architecte technique
[image: email] jeremy.rosen at smile.fr
[image: phone] +33 6 88 25 87 42
[image: url] http://www.smile.eu
[image: Twitter] <https://twitter.com/GroupeSmile> [image: Facebook]
<https://www.facebook.com/smileopensource> [image: LinkedIn]
<https://www.linkedin.com/company/smile> [image: Github]
<https://github.com/Smile-SA>
[image: D?couvrez l?univers Smile, rendez-vous sur smile.eu]
<https://www.smile.eu/fr/publications/livres-blancs/yocto?utm_source=signature&utm_medium=email&utm_campaign=signature>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20200611/0874979c/attachment.html>
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2020-06-11 13:39 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-06-11 9:14 [Buildroot] package/openssh: improve ssh services Norbert Lange
2020-06-11 9:14 ` [Buildroot] [PATCH v2 1/3] package/openssh: improve integration for systemd Norbert Lange
2020-06-11 9:16 ` Norbert Lange
2020-06-11 9:14 ` [Buildroot] [PATCH v2 2/3] package/openssh: seperate sd service for host key generation Norbert Lange
2020-06-11 9:14 ` [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services Norbert Lange
2020-06-11 9:35 ` Jérémy ROSEN
2020-06-11 9:54 ` Norbert Lange
2020-06-11 13:39 ` Jérémy ROSEN
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox