Skip to content

Keep harden_ssh working when sshd is socket-activated #860

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
antobinary wants to merge 1 commit into
base: v4.0.x-release
Choose a base branch
from
Draft

Keep harden_ssh working when sshd is socket-activated #860

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 9 additions & 6 deletions bbb-install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2018,14 +2018,17 @@ KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-grou
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
HERE

# sshd -t refuses to run without the privilege-separation directory, and
# systemd removes it whenever socket-activated ssh.service is stopped
install -d -m 0755 -o root -g root /run/sshd

# Validate config before applying (binary is still sshd)
if sshd -t; then
# Ubuntu 24.04 uses ssh.service, older Ubuntu used sshd.service
if systemctl is-active --quiet ssh 2>/dev/null; then
systemctl restart ssh
else
systemctl restart sshd
fi
# The unit is ssh.service on every supported Ubuntu; sshd.service is an
# alias that only exists while ssh.service itself is enabled. try-restart
# is a no-op when sshd is socket-activated and idle: the next connection
# starts it with the new config.
systemctl try-restart ssh.service
say "SSH hardening applied successfully"
else
say "SSH config validation failed - removing hardening file"
Expand Down
Loading