* [Buildroot] package/openssh: improve ssh services
@ 2020-06-11 9:14 Norbert Lange
2020-06-11 9:14 ` [Buildroot] [PATCH v2 1/3] package/openssh: improve integration for systemd Norbert Lange
` (2 more replies)
0 siblings, 3 replies; 8+ messages in thread
From: Norbert Lange @ 2020-06-11 9:14 UTC (permalink / raw)
To: buildroot
changes v1->v2:
- rebase, skip upstreamed patch #1
- add comment for #2 regarding the choice of RemainAfterExit
^ permalink raw reply [flat|nested] 8+ messages in thread* [Buildroot] [PATCH v2 1/3] package/openssh: improve integration for systemd 2020-06-11 9:14 [Buildroot] package/openssh: improve ssh services Norbert Lange @ 2020-06-11 9:14 ` Norbert Lange 2020-06-11 9:16 ` Norbert Lange 2020-06-11 9:14 ` [Buildroot] [PATCH v2 2/3] package/openssh: seperate sd service for host key generation Norbert Lange 2020-06-11 9:14 ` [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services Norbert Lange 2 siblings, 1 reply; 8+ messages in thread From: Norbert Lange @ 2020-06-11 9:14 UTC (permalink / raw) To: buildroot the openssh daemon is not suited for systemd's simple service type. dependend services should only start when sshd is ready to accept connections. A patch is added from debian to allow openssh to communicate this state. Restarts are prevented if the reason is a faulty config file (errocode 255). The "user confinement directory" is changed to '/run/sshd' which is automatically managed by systemd. Signed-off-by: Norbert Lange <nolange79@gmail.com> --- package/openssh/00-systemd-readiness.patch | 84 ++++++++++++++++++++++ package/openssh/openssh.mk | 14 +++- package/openssh/sshd-sysusers.conf | 2 +- package/openssh/sshd.service | 13 +++- 4 files changed, 109 insertions(+), 4 deletions(-) create mode 100644 package/openssh/00-systemd-readiness.patch diff --git a/package/openssh/00-systemd-readiness.patch b/package/openssh/00-systemd-readiness.patch new file mode 100644 index 0000000000..be3b6b0074 --- /dev/null +++ b/package/openssh/00-systemd-readiness.patch @@ -0,0 +1,84 @@ +From ab765b2bd55062a704f09da8f8c1c4ad1d6630a7 Mon Sep 17 00:00:00 2001 +From: Michael Biebl <biebl@debian.org> +Date: Mon, 21 Dec 2015 16:08:47 +0000 +Subject: Add systemd readiness notification support + +Bug-Debian: https://bugs.debian.org/778913 +Forwarded: no +Last-Update: 2017-08-22 + +Patch-Name: systemd-readiness.patch +--- + configure.ac | 24 ++++++++++++++++++++++++ + sshd.c | 9 +++++++++ + 2 files changed, 33 insertions(+) + +diff --git a/configure.ac b/configure.ac +index e894db9fc..c119d6fd1 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -4499,6 +4499,29 @@ AC_ARG_WITH([kerberos5], + AC_SUBST([GSSLIBS]) + AC_SUBST([K5LIBS]) + ++# Check whether user wants systemd support ++SYSTEMD_MSG="no" ++AC_ARG_WITH(systemd, ++ [ --with-systemd Enable systemd support], ++ [ if test "x$withval" != "xno" ; then ++ AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no]) ++ if test "$PKGCONFIG" != "no"; then ++ AC_MSG_CHECKING([for libsystemd]) ++ if $PKGCONFIG --exists libsystemd; then ++ SYSTEMD_CFLAGS=`$PKGCONFIG --cflags libsystemd` ++ SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd` ++ CPPFLAGS="$CPPFLAGS $SYSTEMD_CFLAGS" ++ SSHDLIBS="$SSHDLIBS $SYSTEMD_LIBS" ++ AC_MSG_RESULT([yes]) ++ AC_DEFINE(HAVE_SYSTEMD, 1, [Define if you want systemd support.]) ++ SYSTEMD_MSG="yes" ++ else ++ AC_MSG_RESULT([no]) ++ fi ++ fi ++ fi ] ++) ++ + # Looking for programs, paths and files + + PRIVSEP_PATH=/var/empty +@@ -5305,6 +5328,7 @@ echo " libldns support: $LDNS_MSG" + echo " Solaris process contract support: $SPC_MSG" + echo " Solaris project support: $SP_MSG" + echo " Solaris privilege support: $SPP_MSG" ++echo " systemd support: $SYSTEMD_MSG" + echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG" + echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG" + echo " BSD Auth support: $BSD_AUTH_MSG" +diff --git a/sshd.c b/sshd.c +index 4e8ff0662..5e7679a33 100644 +--- a/sshd.c ++++ b/sshd.c +@@ -85,6 +85,10 @@ + #include <prot.h> + #endif + ++#ifdef HAVE_SYSTEMD ++#include <systemd/sd-daemon.h> ++#endif ++ + #include "xmalloc.h" + #include "ssh.h" + #include "ssh2.h" +@@ -1951,6 +1955,11 @@ main(int ac, char **av) + } + } + ++#ifdef HAVE_SYSTEMD ++ /* Signal systemd that we are ready to accept connections */ ++ sd_notify(0, "READY=1"); ++#endif ++ + /* Accept a connection and return in a forked child */ + server_accept_loop(&sock_in, &sock_out, + &newsock, config_s); diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk index 64ac22181b..3e0a85ae2e 100644 --- a/package/openssh/openssh.mk +++ b/package/openssh/openssh.mk @@ -12,6 +12,7 @@ OPENSSH_CONF_ENV = \ LD="$(TARGET_CC)" \ LDFLAGS="$(TARGET_CFLAGS)" \ LIBS=`$(PKG_CONFIG_HOST_BINARY) --libs openssl` +OPENSSH_AUTORECONF = YES OPENSSH_CONF_OPTS = \ --sysconfdir=/etc/ssh \ --with-default-path=$(BR2_SYSTEM_DEFAULT_PATH) \ @@ -22,9 +23,20 @@ OPENSSH_CONF_OPTS = \ --disable-wtmpx \ --disable-strip +ifeq ($(BR2_PACKAGE_SYSTEMD),y) +OPENSSH_DEPENDENCIES = systemd + +OPENSSH_CONF_OPTS += \ + --with-privsep-path=/run/sshd \ + --with-pid-dir=/run \ + --with-systemd + +else + define OPENSSH_PERMISSIONS /var/empty d 755 root root - - - - - endef +endif ifeq ($(BR2_TOOLCHAIN_SUPPORTS_PIE),) OPENSSH_CONF_OPTS += --without-pie @@ -74,7 +86,7 @@ define OPENSSH_INSTALL_SYSTEMD_SYSUSERS endef else define OPENSSH_USERS - sshd -1 sshd -1 * /var/empty - - SSH drop priv user + sshd -1 sshd -1 * $(if $(BR2_PACKAGE_SYSTEMD),/run/sshd,/var/empty) - - SSH drop priv user endef endif diff --git a/package/openssh/sshd-sysusers.conf b/package/openssh/sshd-sysusers.conf index ac77aec065..303d0dbb63 100644 --- a/package/openssh/sshd-sysusers.conf +++ b/package/openssh/sshd-sysusers.conf @@ -1 +1 @@ -u sshd - "SSH drop priv user" /var/empty +u sshd - "SSH drop priv user" /run/sshd diff --git a/package/openssh/sshd.service b/package/openssh/sshd.service index b5e96b3a25..715bd3f7eb 100644 --- a/package/openssh/sshd.service +++ b/package/openssh/sshd.service @@ -1,11 +1,20 @@ [Unit] Description=OpenSSH server daemon -After=syslog.target network.target auditd.service +Documentation=man:sshd(8) man:sshd_config(5) +After=network.target auditd.service [Service] ExecStartPre=/usr/bin/ssh-keygen -A -ExecStart=/usr/sbin/sshd -D -e +ExecStartPre=/usr/sbin/sshd -t +ExecStart=/usr/sbin/sshd -D +ExecReload=/usr/sbin/sshd -t ExecReload=/bin/kill -HUP $MAINPID +KillMode=process +Restart=on-failure +RestartPreventExitStatus=255 +Type=notify +RuntimeDirectory=sshd +RuntimeDirectoryMode=0755 [Install] WantedBy=multi-user.target -- 2.26.2 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH v2 1/3] package/openssh: improve integration for systemd 2020-06-11 9:14 ` [Buildroot] [PATCH v2 1/3] package/openssh: improve integration for systemd Norbert Lange @ 2020-06-11 9:16 ` Norbert Lange 0 siblings, 0 replies; 8+ messages in thread From: Norbert Lange @ 2020-06-11 9:16 UTC (permalink / raw) To: buildroot This one is missing from v1 (was not changed): Reviewed-by: J?r?my ROSEN <jeremy.rosen@smile.fr> Am Do., 11. Juni 2020 um 11:14 Uhr schrieb Norbert Lange <nolange79@gmail.com>: > > the openssh daemon is not suited for systemd's simple > service type. dependend services should only start > when sshd is ready to accept connections. > > A patch is added from debian to allow openssh > to communicate this state. > > Restarts are prevented if the reason is a faulty > config file (errocode 255). > > The "user confinement directory" is changed to > '/run/sshd' which is automatically managed by systemd. > > Signed-off-by: Norbert Lange <nolange79@gmail.com> > --- > package/openssh/00-systemd-readiness.patch | 84 ++++++++++++++++++++++ > package/openssh/openssh.mk | 14 +++- > package/openssh/sshd-sysusers.conf | 2 +- > package/openssh/sshd.service | 13 +++- > 4 files changed, 109 insertions(+), 4 deletions(-) > create mode 100644 package/openssh/00-systemd-readiness.patch > > diff --git a/package/openssh/00-systemd-readiness.patch b/package/openssh/00-systemd-readiness.patch > new file mode 100644 > index 0000000000..be3b6b0074 > --- /dev/null > +++ b/package/openssh/00-systemd-readiness.patch > @@ -0,0 +1,84 @@ > +From ab765b2bd55062a704f09da8f8c1c4ad1d6630a7 Mon Sep 17 00:00:00 2001 > +From: Michael Biebl <biebl@debian.org> > +Date: Mon, 21 Dec 2015 16:08:47 +0000 > +Subject: Add systemd readiness notification support > + > +Bug-Debian: https://bugs.debian.org/778913 > +Forwarded: no > +Last-Update: 2017-08-22 > + > +Patch-Name: systemd-readiness.patch > +--- > + configure.ac | 24 ++++++++++++++++++++++++ > + sshd.c | 9 +++++++++ > + 2 files changed, 33 insertions(+) > + > +diff --git a/configure.ac b/configure.ac > +index e894db9fc..c119d6fd1 100644 > +--- a/configure.ac > ++++ b/configure.ac > +@@ -4499,6 +4499,29 @@ AC_ARG_WITH([kerberos5], > + AC_SUBST([GSSLIBS]) > + AC_SUBST([K5LIBS]) > + > ++# Check whether user wants systemd support > ++SYSTEMD_MSG="no" > ++AC_ARG_WITH(systemd, > ++ [ --with-systemd Enable systemd support], > ++ [ if test "x$withval" != "xno" ; then > ++ AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no]) > ++ if test "$PKGCONFIG" != "no"; then > ++ AC_MSG_CHECKING([for libsystemd]) > ++ if $PKGCONFIG --exists libsystemd; then > ++ SYSTEMD_CFLAGS=`$PKGCONFIG --cflags libsystemd` > ++ SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd` > ++ CPPFLAGS="$CPPFLAGS $SYSTEMD_CFLAGS" > ++ SSHDLIBS="$SSHDLIBS $SYSTEMD_LIBS" > ++ AC_MSG_RESULT([yes]) > ++ AC_DEFINE(HAVE_SYSTEMD, 1, [Define if you want systemd support.]) > ++ SYSTEMD_MSG="yes" > ++ else > ++ AC_MSG_RESULT([no]) > ++ fi > ++ fi > ++ fi ] > ++) > ++ > + # Looking for programs, paths and files > + > + PRIVSEP_PATH=/var/empty > +@@ -5305,6 +5328,7 @@ echo " libldns support: $LDNS_MSG" > + echo " Solaris process contract support: $SPC_MSG" > + echo " Solaris project support: $SP_MSG" > + echo " Solaris privilege support: $SPP_MSG" > ++echo " systemd support: $SYSTEMD_MSG" > + echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG" > + echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG" > + echo " BSD Auth support: $BSD_AUTH_MSG" > +diff --git a/sshd.c b/sshd.c > +index 4e8ff0662..5e7679a33 100644 > +--- a/sshd.c > ++++ b/sshd.c > +@@ -85,6 +85,10 @@ > + #include <prot.h> > + #endif > + > ++#ifdef HAVE_SYSTEMD > ++#include <systemd/sd-daemon.h> > ++#endif > ++ > + #include "xmalloc.h" > + #include "ssh.h" > + #include "ssh2.h" > +@@ -1951,6 +1955,11 @@ main(int ac, char **av) > + } > + } > + > ++#ifdef HAVE_SYSTEMD > ++ /* Signal systemd that we are ready to accept connections */ > ++ sd_notify(0, "READY=1"); > ++#endif > ++ > + /* Accept a connection and return in a forked child */ > + server_accept_loop(&sock_in, &sock_out, > + &newsock, config_s); > diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk > index 64ac22181b..3e0a85ae2e 100644 > --- a/package/openssh/openssh.mk > +++ b/package/openssh/openssh.mk > @@ -12,6 +12,7 @@ OPENSSH_CONF_ENV = \ > LD="$(TARGET_CC)" \ > LDFLAGS="$(TARGET_CFLAGS)" \ > LIBS=`$(PKG_CONFIG_HOST_BINARY) --libs openssl` > +OPENSSH_AUTORECONF = YES > OPENSSH_CONF_OPTS = \ > --sysconfdir=/etc/ssh \ > --with-default-path=$(BR2_SYSTEM_DEFAULT_PATH) \ > @@ -22,9 +23,20 @@ OPENSSH_CONF_OPTS = \ > --disable-wtmpx \ > --disable-strip > > +ifeq ($(BR2_PACKAGE_SYSTEMD),y) > +OPENSSH_DEPENDENCIES = systemd > + > +OPENSSH_CONF_OPTS += \ > + --with-privsep-path=/run/sshd \ > + --with-pid-dir=/run \ > + --with-systemd > + > +else > + > define OPENSSH_PERMISSIONS > /var/empty d 755 root root - - - - - > endef > +endif > > ifeq ($(BR2_TOOLCHAIN_SUPPORTS_PIE),) > OPENSSH_CONF_OPTS += --without-pie > @@ -74,7 +86,7 @@ define OPENSSH_INSTALL_SYSTEMD_SYSUSERS > endef > else > define OPENSSH_USERS > - sshd -1 sshd -1 * /var/empty - - SSH drop priv user > + sshd -1 sshd -1 * $(if $(BR2_PACKAGE_SYSTEMD),/run/sshd,/var/empty) - - SSH drop priv user > endef > endif > > diff --git a/package/openssh/sshd-sysusers.conf b/package/openssh/sshd-sysusers.conf > index ac77aec065..303d0dbb63 100644 > --- a/package/openssh/sshd-sysusers.conf > +++ b/package/openssh/sshd-sysusers.conf > @@ -1 +1 @@ > -u sshd - "SSH drop priv user" /var/empty > +u sshd - "SSH drop priv user" /run/sshd > diff --git a/package/openssh/sshd.service b/package/openssh/sshd.service > index b5e96b3a25..715bd3f7eb 100644 > --- a/package/openssh/sshd.service > +++ b/package/openssh/sshd.service > @@ -1,11 +1,20 @@ > [Unit] > Description=OpenSSH server daemon > -After=syslog.target network.target auditd.service > +Documentation=man:sshd(8) man:sshd_config(5) > +After=network.target auditd.service > > [Service] > ExecStartPre=/usr/bin/ssh-keygen -A > -ExecStart=/usr/sbin/sshd -D -e > +ExecStartPre=/usr/sbin/sshd -t > +ExecStart=/usr/sbin/sshd -D > +ExecReload=/usr/sbin/sshd -t > ExecReload=/bin/kill -HUP $MAINPID > +KillMode=process > +Restart=on-failure > +RestartPreventExitStatus=255 > +Type=notify > +RuntimeDirectory=sshd > +RuntimeDirectoryMode=0755 > > [Install] > WantedBy=multi-user.target > -- > 2.26.2 > ^ permalink raw reply [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH v2 2/3] package/openssh: seperate sd service for host key generation 2020-06-11 9:14 [Buildroot] package/openssh: improve ssh services Norbert Lange 2020-06-11 9:14 ` [Buildroot] [PATCH v2 1/3] package/openssh: improve integration for systemd Norbert Lange @ 2020-06-11 9:14 ` Norbert Lange 2020-06-11 9:14 ` [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services Norbert Lange 2 siblings, 0 replies; 8+ messages in thread From: Norbert Lange @ 2020-06-11 9:14 UTC (permalink / raw) To: buildroot split out generation of host keys into an optional service that can easily be removed or deactivated. Signed-off-by: Norbert Lange <nolange79@gmail.com> Reviewed-by: J?r?my ROSEN <jeremy.rosen@smile.fr> --- package/openssh/openssh.mk | 5 +++-- package/openssh/sshd-host-keygen.service | 23 +++++++++++++++++++++++ package/openssh/sshd.service | 1 - 3 files changed, 26 insertions(+), 3 deletions(-) create mode 100644 package/openssh/sshd-host-keygen.service diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk index 3e0a85ae2e..1fcd957299 100644 --- a/package/openssh/openssh.mk +++ b/package/openssh/openssh.mk @@ -116,8 +116,9 @@ endef OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_SERVER_PROGRAMS define OPENSSH_INSTALL_INIT_SYSTEMD - $(INSTALL) -D -m 644 package/openssh/sshd.service \ - $(TARGET_DIR)/usr/lib/systemd/system/sshd.service + mkdir $(TARGET_DIR)/usr/lib/systemd/system + $(INSTALL) -m 644 package/openssh/sshd*.service \ + $(TARGET_DIR)/usr/lib/systemd/system/ $(OPENSSH_INSTALL_SYSTEMD_SYSUSERS) endef diff --git a/package/openssh/sshd-host-keygen.service b/package/openssh/sshd-host-keygen.service new file mode 100644 index 0000000000..2db1be16c4 --- /dev/null +++ b/package/openssh/sshd-host-keygen.service @@ -0,0 +1,23 @@ +[Unit] +Description=SSH Key Generation +Before=sshd.service + +ConditionPathExists=|!/etc/ssh/ssh_host_dsa_key +ConditionPathExists=|!/etc/ssh/ssh_host_dsa_key.pub +ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key +ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key.pub +ConditionPathExists=|!/etc/ssh/ssh_host_ed25519_key +ConditionPathExists=|!/etc/ssh/ssh_host_ed25519_key.pub +ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key +ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key.pub + +[Service] +ExecStart=/usr/bin/ssh-keygen -A +Type=oneshot +# systemd changed behaviour in v245 leading to various drawbacks, +# seems like every one-shot service should use RemainAfterExit +# https://github.com/systemd/systemd/issues/15091 +RemainAfterExit=yes + +[Install] +WantedBy=sshd.service diff --git a/package/openssh/sshd.service b/package/openssh/sshd.service index 715bd3f7eb..797e249d8d 100644 --- a/package/openssh/sshd.service +++ b/package/openssh/sshd.service @@ -4,7 +4,6 @@ Documentation=man:sshd(8) man:sshd_config(5) After=network.target auditd.service [Service] -ExecStartPre=/usr/bin/ssh-keygen -A ExecStartPre=/usr/sbin/sshd -t ExecStart=/usr/sbin/sshd -D ExecReload=/usr/sbin/sshd -t -- 2.26.2 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services 2020-06-11 9:14 [Buildroot] package/openssh: improve ssh services Norbert Lange 2020-06-11 9:14 ` [Buildroot] [PATCH v2 1/3] package/openssh: improve integration for systemd Norbert Lange 2020-06-11 9:14 ` [Buildroot] [PATCH v2 2/3] package/openssh: seperate sd service for host key generation Norbert Lange @ 2020-06-11 9:14 ` Norbert Lange 2020-06-11 9:35 ` Jérémy ROSEN 2 siblings, 1 reply; 8+ messages in thread From: Norbert Lange @ 2020-06-11 9:14 UTC (permalink / raw) To: buildroot Signed-off-by: Norbert Lange <nolange79@gmail.com> --- package/openssh/openssh.mk | 6 +++--- package/openssh/sshd-host-keygen.service | 2 +- package/openssh/sshd.socket | 11 +++++++++++ package/openssh/sshd at .service | 10 ++++++++++ 4 files changed, 25 insertions(+), 4 deletions(-) create mode 100644 package/openssh/sshd.socket create mode 100644 package/openssh/sshd at .service diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk index 1fcd957299..cbfe8f6f7d 100644 --- a/package/openssh/openssh.mk +++ b/package/openssh/openssh.mk @@ -116,9 +116,9 @@ endef OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_SERVER_PROGRAMS define OPENSSH_INSTALL_INIT_SYSTEMD - mkdir $(TARGET_DIR)/usr/lib/systemd/system - $(INSTALL) -m 644 package/openssh/sshd*.service \ - $(TARGET_DIR)/usr/lib/systemd/system/ + mkdir -p $(TARGET_DIR)/usr/lib/systemd/system + $(INSTALL) -m 644 package/openssh/sshd*.service package/openssh/sshd.socket \ + $(TARGET_DIR)/usr/lib/systemd/system/. $(OPENSSH_INSTALL_SYSTEMD_SYSUSERS) endef diff --git a/package/openssh/sshd-host-keygen.service b/package/openssh/sshd-host-keygen.service index 2db1be16c4..0e071c9d8c 100644 --- a/package/openssh/sshd-host-keygen.service +++ b/package/openssh/sshd-host-keygen.service @@ -20,4 +20,4 @@ Type=oneshot RemainAfterExit=yes [Install] -WantedBy=sshd.service +WantedBy=sshd.service sshd.socket diff --git a/package/openssh/sshd.socket b/package/openssh/sshd.socket new file mode 100644 index 0000000000..bbae9ed7aa --- /dev/null +++ b/package/openssh/sshd.socket @@ -0,0 +1,11 @@ +[Unit] +Description=OpenBSD Secure Shell server socket +Before=sshd.service +Conflicts=sshd.service + +[Socket] +ListenStream=22 +Accept=yes + +[Install] +WantedBy=sockets.target diff --git a/package/openssh/sshd at .service b/package/openssh/sshd at .service new file mode 100644 index 0000000000..b3a590d9a3 --- /dev/null +++ b/package/openssh/sshd at .service @@ -0,0 +1,10 @@ +[Unit] +Description=OpenBSD Secure Shell server per-connection daemon +Documentation=man:sshd(8) man:sshd_config(5) +After=auditd.service + +[Service] +ExecStart=-/usr/sbin/sshd -i +StandardInput=socket +RuntimeDirectory=sshd +RuntimeDirectoryMode=0755 -- 2.26.2 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services 2020-06-11 9:14 ` [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services Norbert Lange @ 2020-06-11 9:35 ` Jérémy ROSEN 2020-06-11 9:54 ` Norbert Lange 0 siblings, 1 reply; 8+ messages in thread From: Jérémy ROSEN @ 2020-06-11 9:35 UTC (permalink / raw) To: buildroot Reviewed-By J?r?my Rosen <jeremy.rosen@smile.fr> (I think I didn't add my RB for that one..) Le jeu. 11 juin 2020 ? 11:14, Norbert Lange <nolange79@gmail.com> a ?crit : > Signed-off-by: Norbert Lange <nolange79@gmail.com> > --- > package/openssh/openssh.mk | 6 +++--- > package/openssh/sshd-host-keygen.service | 2 +- > package/openssh/sshd.socket | 11 +++++++++++ > package/openssh/sshd at .service | 10 ++++++++++ > 4 files changed, 25 insertions(+), 4 deletions(-) > create mode 100644 package/openssh/sshd.socket > create mode 100644 package/openssh/sshd at .service > > diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk > index 1fcd957299..cbfe8f6f7d 100644 > --- a/package/openssh/openssh.mk > +++ b/package/openssh/openssh.mk > @@ -116,9 +116,9 @@ endef > OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_SERVER_PROGRAMS > > define OPENSSH_INSTALL_INIT_SYSTEMD > - mkdir $(TARGET_DIR)/usr/lib/systemd/system > - $(INSTALL) -m 644 package/openssh/sshd*.service \ > - $(TARGET_DIR)/usr/lib/systemd/system/ > + mkdir -p $(TARGET_DIR)/usr/lib/systemd/system > + $(INSTALL) -m 644 package/openssh/sshd*.service > package/openssh/sshd.socket \ > + $(TARGET_DIR)/usr/lib/systemd/system/. > $(OPENSSH_INSTALL_SYSTEMD_SYSUSERS) > endef > > diff --git a/package/openssh/sshd-host-keygen.service > b/package/openssh/sshd-host-keygen.service > index 2db1be16c4..0e071c9d8c 100644 > --- a/package/openssh/sshd-host-keygen.service > +++ b/package/openssh/sshd-host-keygen.service > @@ -20,4 +20,4 @@ Type=oneshot > RemainAfterExit=yes > > [Install] > -WantedBy=sshd.service > +WantedBy=sshd.service sshd.socket > diff --git a/package/openssh/sshd.socket b/package/openssh/sshd.socket > new file mode 100644 > index 0000000000..bbae9ed7aa > --- /dev/null > +++ b/package/openssh/sshd.socket > @@ -0,0 +1,11 @@ > +[Unit] > +Description=OpenBSD Secure Shell server socket > +Before=sshd.service > +Conflicts=sshd.service > + > +[Socket] > +ListenStream=22 > +Accept=yes > + > +[Install] > +WantedBy=sockets.target > diff --git a/package/openssh/sshd at .service b/package/openssh/sshd at .service > new file mode 100644 > index 0000000000..b3a590d9a3 > --- /dev/null > +++ b/package/openssh/sshd at .service > @@ -0,0 +1,10 @@ > +[Unit] > +Description=OpenBSD Secure Shell server per-connection daemon > +Documentation=man:sshd(8) man:sshd_config(5) > +After=auditd.service > + > +[Service] > +ExecStart=-/usr/sbin/sshd -i > +StandardInput=socket > +RuntimeDirectory=sshd > +RuntimeDirectoryMode=0755 > -- > 2.26.2 > > -- [image: SMILE] <http://www.smile.eu/> 20 rue des Jardins 92600 Asni?res-sur-Seine *J?r?my ROSEN* Architecte technique [image: email] jeremy.rosen at smile.fr [image: phone] +33 6 88 25 87 42 [image: url] http://www.smile.eu [image: Twitter] <https://twitter.com/GroupeSmile> [image: Facebook] <https://www.facebook.com/smileopensource> [image: LinkedIn] <https://www.linkedin.com/company/smile> [image: Github] <https://github.com/Smile-SA> [image: D?couvrez l?univers Smile, rendez-vous sur smile.eu] <https://www.smile.eu/fr/publications/livres-blancs/yocto?utm_source=signature&utm_medium=email&utm_campaign=signature> -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20200611/13580769/attachment.html> ^ permalink raw reply [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services 2020-06-11 9:35 ` Jérémy ROSEN @ 2020-06-11 9:54 ` Norbert Lange 2020-06-11 13:39 ` Jérémy ROSEN 0 siblings, 1 reply; 8+ messages in thread From: Norbert Lange @ 2020-06-11 9:54 UTC (permalink / raw) To: buildroot J?r?my ROSEN <jeremy.rosen@smile.fr> schrieb am Do., 11. Juni 2020, 11:35: > Reviewed-By J?r?my Rosen <jeremy.rosen@smile.fr> > > (I think I didn't add my RB for that one..) > > Le jeu. 11 juin 2020 ? 11:14, Norbert Lange <nolange79@gmail.com> a > ?crit : > >> Signed-off-by: Norbert Lange <nolange79@gmail.com> >> --- >> package/openssh/openssh.mk | 6 +++--- >> package/openssh/sshd-host-keygen.service | 2 +- >> package/openssh/sshd.socket | 11 +++++++++++ >> package/openssh/sshd at .service | 10 ++++++++++ >> 4 files changed, 25 insertions(+), 4 deletions(-) >> create mode 100644 package/openssh/sshd.socket >> create mode 100644 package/openssh/sshd at .service >> >> diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk >> index 1fcd957299..cbfe8f6f7d 100644 >> --- a/package/openssh/openssh.mk >> +++ b/package/openssh/openssh.mk >> @@ -116,9 +116,9 @@ endef >> OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_SERVER_PROGRAMS >> >> define OPENSSH_INSTALL_INIT_SYSTEMD >> - mkdir $(TARGET_DIR)/usr/lib/systemd/system >> - $(INSTALL) -m 644 package/openssh/sshd*.service \ >> - $(TARGET_DIR)/usr/lib/systemd/system/ >> + mkdir -p $(TARGET_DIR)/usr/lib/systemd/system >> + $(INSTALL) -m 644 package/openssh/sshd*.service >> package/openssh/sshd.socket \ >> + $(TARGET_DIR)/usr/lib/systemd/system/. >> $(OPENSSH_INSTALL_SYSTEMD_SYSUSERS) >> endef >> >> diff --git a/package/openssh/sshd-host-keygen.service >> b/package/openssh/sshd-host-keygen.service >> index 2db1be16c4..0e071c9d8c 100644 >> --- a/package/openssh/sshd-host-keygen.service >> +++ b/package/openssh/sshd-host-keygen.service >> @@ -20,4 +20,4 @@ Type=oneshot >> RemainAfterExit=yes >> >> [Install] >> -WantedBy=sshd.service >> +WantedBy=sshd.service sshd.socket >> diff --git a/package/openssh/sshd.socket b/package/openssh/sshd.socket >> new file mode 100644 >> index 0000000000..bbae9ed7aa >> --- /dev/null >> +++ b/package/openssh/sshd.socket >> @@ -0,0 +1,11 @@ >> +[Unit] >> +Description=OpenBSD Secure Shell server socket >> +Before=sshd.service >> +Conflicts=sshd.service >> + >> +[Socket] >> +ListenStream=22 >> +Accept=yes >> + >> +[Install] >> +WantedBy=sockets.target >> diff --git a/package/openssh/sshd at .service b/package/openssh/sshd@ >> .service >> new file mode 100644 >> index 0000000000..b3a590d9a3 >> --- /dev/null >> +++ b/package/openssh/sshd at .service >> @@ -0,0 +1,10 @@ >> +[Unit] >> +Description=OpenBSD Secure Shell server per-connection daemon >> +Documentation=man:sshd(8) man:sshd_config(5) >> +After=auditd.service >> + >> +[Service] >> +ExecStart=-/usr/sbin/sshd -i >> +StandardInput=socket >> +RuntimeDirectory=sshd >> +RuntimeDirectoryMode=0755 >> -- >> 2.26.2 >> >> > > -- > [image: SMILE] <http://www.smile.eu/> > > 20 rue des Jardins > 92600 Asni?res-sur-Seine > *J?r?my ROSEN* > Architecte technique > > [image: email] jeremy.rosen at smile.fr > [image: phone] +33 6 88 25 87 42 > [image: url] http://www.smile.eu > > [image: Twitter] <https://twitter.com/GroupeSmile> [image: Facebook] > <https://www.facebook.com/smileopensource> [image: LinkedIn] > <https://www.linkedin.com/company/smile> [image: Github] > <https://github.com/Smile-SA> > > [image: D?couvrez l?univers Smile, rendez-vous sur smile.eu] > <https://www.smile.eu/fr/publications/livres-blancs/yocto?utm_source=signature&utm_medium=email&utm_campaign=signature> > No, but I thought that was intentional, as this patch doesn't have an option to chose between singular sever and the socket activation mode. Norbert > > <https://www.smile.eu/fr/publications/livres-blancs/yocto?utm_source=signature&utm_medium=email&utm_campaign=signature> > -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20200611/092b3972/attachment.html> ^ permalink raw reply [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services 2020-06-11 9:54 ` Norbert Lange @ 2020-06-11 13:39 ` Jérémy ROSEN 0 siblings, 0 replies; 8+ messages in thread From: Jérémy ROSEN @ 2020-06-11 13:39 UTC (permalink / raw) To: buildroot Urgh Thx for pointing that out. That's why I don't like mail-based workflows... Anyway, I won't block the patch on that particular point, though I'd like it addressed if possible.... Cheers Jeremy Le jeu. 11 juin 2020 ? 11:54, Norbert Lange <nolange79@gmail.com> a ?crit : > > > J?r?my ROSEN <jeremy.rosen@smile.fr> schrieb am Do., 11. Juni 2020, 11:35: > >> Reviewed-By J?r?my Rosen <jeremy.rosen@smile.fr> >> >> (I think I didn't add my RB for that one..) >> >> Le jeu. 11 juin 2020 ? 11:14, Norbert Lange <nolange79@gmail.com> a >> ?crit : >> >>> Signed-off-by: Norbert Lange <nolange79@gmail.com> >>> --- >>> package/openssh/openssh.mk | 6 +++--- >>> package/openssh/sshd-host-keygen.service | 2 +- >>> package/openssh/sshd.socket | 11 +++++++++++ >>> package/openssh/sshd at .service | 10 ++++++++++ >>> 4 files changed, 25 insertions(+), 4 deletions(-) >>> create mode 100644 package/openssh/sshd.socket >>> create mode 100644 package/openssh/sshd at .service >>> >>> diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk >>> index 1fcd957299..cbfe8f6f7d 100644 >>> --- a/package/openssh/openssh.mk >>> +++ b/package/openssh/openssh.mk >>> @@ -116,9 +116,9 @@ endef >>> OPENSSH_POST_INSTALL_TARGET_HOOKS += OPENSSH_INSTALL_SERVER_PROGRAMS >>> >>> define OPENSSH_INSTALL_INIT_SYSTEMD >>> - mkdir $(TARGET_DIR)/usr/lib/systemd/system >>> - $(INSTALL) -m 644 package/openssh/sshd*.service \ >>> - $(TARGET_DIR)/usr/lib/systemd/system/ >>> + mkdir -p $(TARGET_DIR)/usr/lib/systemd/system >>> + $(INSTALL) -m 644 package/openssh/sshd*.service >>> package/openssh/sshd.socket \ >>> + $(TARGET_DIR)/usr/lib/systemd/system/. >>> $(OPENSSH_INSTALL_SYSTEMD_SYSUSERS) >>> endef >>> >>> diff --git a/package/openssh/sshd-host-keygen.service >>> b/package/openssh/sshd-host-keygen.service >>> index 2db1be16c4..0e071c9d8c 100644 >>> --- a/package/openssh/sshd-host-keygen.service >>> +++ b/package/openssh/sshd-host-keygen.service >>> @@ -20,4 +20,4 @@ Type=oneshot >>> RemainAfterExit=yes >>> >>> [Install] >>> -WantedBy=sshd.service >>> +WantedBy=sshd.service sshd.socket >>> diff --git a/package/openssh/sshd.socket b/package/openssh/sshd.socket >>> new file mode 100644 >>> index 0000000000..bbae9ed7aa >>> --- /dev/null >>> +++ b/package/openssh/sshd.socket >>> @@ -0,0 +1,11 @@ >>> +[Unit] >>> +Description=OpenBSD Secure Shell server socket >>> +Before=sshd.service >>> +Conflicts=sshd.service >>> + >>> +[Socket] >>> +ListenStream=22 >>> +Accept=yes >>> + >>> +[Install] >>> +WantedBy=sockets.target >>> diff --git a/package/openssh/sshd at .service b/package/openssh/sshd@ >>> .service >>> new file mode 100644 >>> index 0000000000..b3a590d9a3 >>> --- /dev/null >>> +++ b/package/openssh/sshd at .service >>> @@ -0,0 +1,10 @@ >>> +[Unit] >>> +Description=OpenBSD Secure Shell server per-connection daemon >>> +Documentation=man:sshd(8) man:sshd_config(5) >>> +After=auditd.service >>> + >>> +[Service] >>> +ExecStart=-/usr/sbin/sshd -i >>> +StandardInput=socket >>> +RuntimeDirectory=sshd >>> +RuntimeDirectoryMode=0755 >>> -- >>> 2.26.2 >>> >>> >> >> -- >> [image: SMILE] <http://www.smile.eu/> >> >> 20 rue des Jardins >> 92600 Asni?res-sur-Seine >> *J?r?my ROSEN* >> Architecte technique >> >> [image: email] jeremy.rosen at smile.fr >> [image: phone] +33 6 88 25 87 42 >> [image: url] http://www.smile.eu >> >> [image: Twitter] <https://twitter.com/GroupeSmile> [image: Facebook] >> <https://www.facebook.com/smileopensource> [image: LinkedIn] >> <https://www.linkedin.com/company/smile> [image: Github] >> <https://github.com/Smile-SA> >> >> [image: D?couvrez l?univers Smile, rendez-vous sur smile.eu] >> <https://www.smile.eu/fr/publications/livres-blancs/yocto?utm_source=signature&utm_medium=email&utm_campaign=signature> >> > > No, but I thought that was intentional, as this patch doesn't have an > option to chose between singular sever and the socket activation mode. > > Norbert > >> >> <https://www.smile.eu/fr/publications/livres-blancs/yocto?utm_source=signature&utm_medium=email&utm_campaign=signature> >> > -- [image: SMILE] <http://www.smile.eu/> 20 rue des Jardins 92600 Asni?res-sur-Seine *J?r?my ROSEN* Architecte technique [image: email] jeremy.rosen at smile.fr [image: phone] +33 6 88 25 87 42 [image: url] http://www.smile.eu [image: Twitter] <https://twitter.com/GroupeSmile> [image: Facebook] <https://www.facebook.com/smileopensource> [image: LinkedIn] <https://www.linkedin.com/company/smile> [image: Github] <https://github.com/Smile-SA> [image: D?couvrez l?univers Smile, rendez-vous sur smile.eu] <https://www.smile.eu/fr/publications/livres-blancs/yocto?utm_source=signature&utm_medium=email&utm_campaign=signature> -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20200611/0874979c/attachment.html> ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2020-06-11 13:39 UTC | newest] Thread overview: 8+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2020-06-11 9:14 [Buildroot] package/openssh: improve ssh services Norbert Lange 2020-06-11 9:14 ` [Buildroot] [PATCH v2 1/3] package/openssh: improve integration for systemd Norbert Lange 2020-06-11 9:16 ` Norbert Lange 2020-06-11 9:14 ` [Buildroot] [PATCH v2 2/3] package/openssh: seperate sd service for host key generation Norbert Lange 2020-06-11 9:14 ` [Buildroot] [PATCH v2 3/3] package/openssh: add sd socket-activated ssh daemon services Norbert Lange 2020-06-11 9:35 ` Jérémy ROSEN 2020-06-11 9:54 ` Norbert Lange 2020-06-11 13:39 ` Jérémy ROSEN
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox