This bug was fixed in the package openssh - 1:9.7p1-7ubuntu4
---------------
openssh (1:9.7p1-7ubuntu4) oracular; urgency=medium
* Explicitly listen on IPv4 by default, with socket-activated sshd
(LP: #2080216)
- d/systemd/ssh.socket: explicitly listen on ipv4 by default
- d/t/sshd-socket-generator: update for new defaults and AddressFamily
- sshd-socket-generator: handle new ssh.socket default settings
* d/p/systemd-socket-activation.patch: always close newsock fd before re-exec
-- Nick Rosbrook <en...@ubuntu.com> Tue, 01 Oct 2024 14:45:28 -0400
** Changed in: openssh (Ubuntu)
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/2080216
Title:
sshd cannot bind to IPv4 interfaces
Status in openssh package in Ubuntu:
Fix Released
Status in openssh source package in Noble:
In Progress
Bug description:
[Impact]
The default listening sockets for sshd are different depending on
whether socket activation is used or not, even when
/etc/ssh/sshd_config is the default. E.g.:
# Socket-activated
root@n2:~# systemctl status ssh.socket
● ssh.socket - OpenBSD Secure Shell server socket
Loaded: loaded (/usr/lib/systemd/system/ssh.socket; enabled; preset:
enabled)
Active: active (listening) since Tue 2024-10-01 20:36:15 UTC; 12min ago
Triggers: ● ssh.service
Listen: [::]:22 (Stream)
CGroup: /system.slice/ssh.socket
Oct 01 20:36:15 n2 systemd[1]: Listening on ssh.socket - OpenBSD Secure Shell
server socket.
root@n2:~# lsof -i :22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd 1 root 47u IPv6 2781411 0t0 TCP *:ssh (LISTEN)
# Non-socket-activated
root@n2:~# systemctl disable --now ssh.socket
Removed "/etc/systemd/system/ssh.service.requires/ssh.socket".
Removed "/etc/systemd/system/sockets.target.wants/ssh.socket".
root@n2:~# ln -s /dev/null
/etc/systemd/system-generators/sshd-socket-generator
root@n2:~# systemctl enable --now ssh.service
Synchronizing state of ssh.service with SysV service script with
/usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable ssh
Created symlink /etc/systemd/system/sshd.service →
/usr/lib/systemd/system/ssh.service.
Created symlink /etc/systemd/system/multi-user.target.wants/ssh.service →
/usr/lib/systemd/system/ssh.service.
root@n2:~# lsof -i :22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 798 root 3u IPv4 2793622 0t0 TCP *:ssh (LISTEN)
sshd 798 root 4u IPv6 2793624 0t0 TCP *:ssh (LISTEN)
By default, we have net.ipv6.bindv6only=0 sysctl, and
BindIPv6Only=both on ssh.socket, which means usually users can connect
over IPv4 regardless. However, the fact remains that the resulting
listening sockets are different in these two cases, and socket-
activated ssh does not accurately reflect the settings in
/etc/ssh/sshd_config.
[Test Plan]
1. Check that on a noble system, without custom sshd_config, sshd is
listening on both IPv4 and IPv6 on port 22:
$ lsof -i :22
2. Check that setting AddressFamily to e.g. inet results in only an
IPv4 socket:
$ echo "AddressFamily inet" >> /etc/ssh/sshd_config.d/custom.conf
$ systemctl daemon-reload
$ systemctl restart ssh.socket
$ lsof -i :22
There should only be one listener now.
3. Check the same thing with inet6, and a custom port for good
measure:
$ echo "AddressFamily inet6" >> /etc/ssh/sshd_config.d/custom.conf
$ echo "Port 1234" >> /etc/ssh/sshd_config.d/custom.conf
$ systemctl daemon-reload
$ systemctl restart ssh.socket
$ lsof -i :1234
4. The new tests in debian/tests/sshd-socket-generator should all pass
in autopkgtest.
[Where problems could occur]
The fix requires new default settings in the [Socket] section of
ssh.socket, and handling for new defaults in sshd-socket-generator. It
would be more likely to see problems with the generator as opposed to
the changes in ssh.socket. However, new subtests were added to
debian/tests/sshd-socket-generator to help avoid this.
[Original Description]
After upgrading from 22.04 to 24.04 I noticed that my sshd only
listening on IPv6 interface (::), while previously it was listening
both IPv4 (0.0.0.0) and IPv6 (::). I tried to explicitly specify
ListenAddress 0.0.0.0 (assuming it would bind to IPv4 only) but after
restart sshd was still listening on IPv6 only.
This problem affects other packages as well, for example, openvpn.
Rebuilding applications from sources seems to fix the issue.
Setting net.ipv6.bindv6only=0 also helps, but that's not a solution.
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: openssh-server 1:9.6p1-3ubuntu13.5
ProcVersionSignature: Ubuntu 6.8.0-41.41-generic 6.8.12
Uname: Linux 6.8.0-41-generic x86_64
ApportVersion: 2.28.1-0ubuntu3.1
Architecture: amd64
CasperMD5CheckResult: unknown
Date: Tue Sep 10 16:45:54 2024
ProcEnviron:
LANG=C.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=screen.xterm-256color
SourcePackage: openssh
UpgradeStatus: Upgraded to noble on 2024-09-10 (0 days ago)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2080216/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
