3

I need a second openssh server source modified and running on debian.

The modifications I made on the source code are not really relevant, anyway they amplify the logs.

I compiled the modified openssh-7.4p1 with

./configure --prefix=/opt --enable-pam --with-pam
make ; make install 

Then I created /lib/systemd/system/ssh-mod.service :

[Unit]
Description=OpenBSD Secure Shell server modified to log    
After=network.target auditd.service sshd.service
#ConditionPathExists=!/opt/etc/sshd-mod_not_to_be_run
ConditionPathExists=!/etc/ssh/sshd_not_to_be_run

[Service]
EnvironmentFile=-/opt/etc/default/ssh
ExecStart=/opt/sbin/sshd -D -f /opt/etc/sshd_config $SSHD_OPTS
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartPreventExitStatus=255
Type=notify

[Install]
WantedBy=multi-user.target
Alias=sshd-mod.service

And /opt/etc/sshd_config is a standard ssh configuration file with the following lines:

Port 22
LogLevel INFO
ChallengeResponseAuthentication no
UsePAM yes
PrintMotd no
PidFile /var/run/sshd-mod.pid

Now I launched the service with:

$ sudo systemctl start ssh-mod

the command loops indefinetly, so I wait until the error message:

Job for ssh-mod.service failed because a timeout was exceeded.
See "systemctl status ssh-mod.service" and "journalctl -xe" for details.

then I check the status:

$ sudo systemctl status ssh-mod

● ssh-mod.service - OpenBSD Secure Shell server modified to log
    Loaded: loaded (/lib/systemd/system/ssh-mod.service; enabled; vendor preset: enabled)
    Active: activating (start) since Mon 2017-09-04 10:19:50 UTC; 12s ago
  Main PID: 15701 (sshd)
     Tasks: 1 (limit: 4915)
    CGroup: /system.slice/ssh-mod.service
            └─15701 /opt/sbin/sshd -D -f /opt/etc/sshd_config

Sep 04 10:19:50 mymachine systemd[1]: ssh-mod.service: Service hold-off time over, scheduling restart
Sep 04 10:19:50 mymachine systemd[1]: Stopped OpenBSD Secure Shell server modified to log.
Sep 04 10:19:50 mymachine systemd[1]: Starting OpenBSD Secure Shell server modified to log...
Sep 04 10:19:50 mymachine sshd[15701]: Server listening on 0.0.0.0 port 22.
Sep 04 10:19:50 mymachine sshd[15701]: Server listening on :: port 22.


$ journalctl -xe

Sep 04 10:19:50 mymachine systemd[1]: ssh-mod.service: Start operation timed out. Terminating.
Sep 04 10:19:50 mymachine sshd[15549]: Received signal 15; terminating.
Sep 04 10:19:50 mymachine systemd[1]: Failed to start OpenBSD Secure Shell server modified to log.
-- Subject: Unit ssh-mod.service has failed
-- Defined-By: systemd
-- Support: https://www.debian.org/support
-- 
-- Unit ssh-mod.service has failed.
-- 
-- The result is failed.
Sep 04 10:19:50 mymachine systemd[1]: ssh-mod.service: Unit entered failed state.
Sep 04 10:19:50 mymachine systemd[1]: ssh-mod.service: Failed with result 'timeout'.
Sep 04 10:19:50 mymachine systemd[1]: ssh-mod.service: Service hold-off time over, scheduling restart
Sep 04 10:19:50 mymachine systemd[1]: Stopped OpenBSD Secure Shell server modified to log.
-- Subject: Unit ssh-mod.service has finished shutting down
-- Defined-By: systemd
-- Support: https://www.debian.org/support
-- 
-- Unit ssh-mod.service has finished shutting down.
Sep 04 10:19:50 mymachine systemd[1]: Starting OpenBSD Secure Shell server modified to log...
-- Subject: Unit ssh-mod.service has begun start-up
-- Defined-By: systemd
-- Support: https://www.debian.org/support
-- 
-- Unit ssh-mod.service has begun starting up.
Sep 04 10:19:50 mymachine sshd[15701]: Server listening on 0.0.0.0 port 22.
Sep 04 10:19:50 mymachine sshd[15701]: Server listening on :: port 22.

Actually the service results as 'activating' but I can login on port 22 (the other server is listening to another port), so the shell seems working.

I have no clue what is causing this, the logs are not so explicit.

What am I missing? Why is the service hung?

Please tell me if you need more informations.

I followed the steps on the RedHat documentation.

1

1 Answer 1

1

I'm seeing the same behavior on another systemd system (Ubuntu 16.04.3 LTS, but provided by an HPC vendor that may have made modifications.)

From what I can tell, the problem is that Type=notify, and sshd isn't or can't send notification messages using sd_notify(3) or similar to systemd. So systemd never gets the message that it's started.

What I have done for now is to create an override in /etc/systemd/system/ssh.service (as a copy of /lib/systemd/system/ssh.service) and change Type from notify to forking. Then remove the -D from ExecStart, so sshd will fork its daemon.

Then systemctl daemon-reload, and restart ssh to make sure it's working.

The proper fix is to get the ssh service to work with Type=notify again, but I'm out of time for this today. Hope this is helpful to someone.

1
  • I cannot test this today (and maybe nor tomorrow), but as soon as I have the time I will test it! Thanks for your answer!
    – LotoLo
    Oct 27, 2017 at 12:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .