Support socket activation with non-default ports #257

eliasp · 2023-09-22T06:47:45Z

Enhancement:
Control via the var sshd_socket_activation whether SSH should run as a single permanent service or whether on each incoming connection request, a new instance of sshd@.service should be spawned.

Reason:
This improves security, allows for easier per-connection troubleshooting and eliminates the need to restart the service after config changes.

Result:

sshd.socket is running, sshd.service is not
on each connection, a service instance like sshd@1-10.13.13.5:22-192.168.178.53:44876.service is spawned

Issue Tracker Tickets (Jira or BZ if any): -

mattwillsher

Thank you for the PR. I've added a couple of comments.

Is there anything else that would need to be added to ensure complete managements of socket base instantiation? Ubuntu 22.10 appears to use sockets by default. Do you know if this change will fully support that implementation?

tasks/install_config.yml

README.md

eliasp · 2023-09-22T07:41:16Z

Thank you for the PR. I've added a couple of comments.

Is there anything else that would need to be added to ensure complete managements of socket base instantiation? Ubuntu 22.10 appears to use sockets by default. Do you know if this change will fully support that implementation?

I can give Ubuntu 22.10 a try, but in general, I don't see why this shouldn't work. What should probably be done is to set the OS specific defaults for sshd_socket_activation accordingly.

I have pushed a few more commits to handle non-default SSH ports properly and converted the PR to a Draft for now, since I think a few more changes might be needed:

handle a reset of ansible_port after the service moves to a different port while the play is running (I already have a nice idea how to handle this quite smoothly, but I need to give it a try)
I need to ensure non-standard ports also work as expected with non-socket-activated setups
I discovered some oddities regarding the config path in the service units with sshd_skip_defaults: true on RHEL-based systems.

handlers/main.yml

tasks/install_config.yml

tasks/install_namespace.yml

Control via the var `sshd_socket_activation` whether SSH should run as a single permanent service or whether on each incoming connection request, a new instance of `sshd@.service` should be spawned. This improves security, allows for easier per-connection troubleshooting and eliminates the need to restart the service after config changes. Co-authored-by: Rich Megginson <rmeggins@redhat.com>

Since the .socket unit needs to be rewritten in case of a custom port, a more fine-grained control over which unit is managed is required.

Co-authored-by: Rich Megginson <rmeggins@redhat.com>

Jakuje · 2023-10-01T12:09:23Z

handlers/main.yml


 - name: Reload the SSH service
  ansible.builtin.service:
-    name: "{{ sshd_service }}"
+    name: "{{ sshd_service }}{{ '.socket' if sshd_socket_activation | bool else '' }}"


nit: I would propose to use temporary variable for this as it is not visible on the first sight what is being done. Something like

__sshd_systemd_unit: "{{ sshd_service }}{{ '.socket' if sshd_socket_activation | bool else '' }}"

and then

ansible.builtin.service: name: "{{ __sshd_systemd_unit }}"

The task name no longer matches description either. It should be Reload the SSH unit or something like that.

Jakuje · 2023-10-01T12:13:10Z

handlers/main.yml

@@ -1,8 +1,16 @@
 ---
+- name: Reload systemd units


This reloads the systemd daemon (man systemctl, find daemon-reload for description). Reloading units is only part of the task.

Jakuje · 2023-10-01T12:14:49Z

tasks/install_service.yml


 - name: Service enabled and running
  ansible.builtin.service:
-    name: "{{ sshd_service }}"
+    name: "{{ sshd_service }}{{ '.socket' if sshd_socket_activation | bool else '' }}"


same as in the main.yml -- this should be defined only in one place.

Additionally, when you enable socket activation, you need to make sure the normal service is disabled and vice versa (because they conflict with each other and systemd had in the past huge issues resolving such conflicts resulting in non-accessible systems).

richm · 2024-01-25T18:15:33Z

ping - any update?

mattwillsher reviewed Sep 22, 2023

View reviewed changes

tasks/install_config.yml Outdated Show resolved Hide resolved

README.md Show resolved Hide resolved

eliasp changed the title ~~Support socket activation~~ Support socket activation with non-default ports Sep 22, 2023

eliasp marked this pull request as draft September 22, 2023 07:36