[ptxdist] [PATCH] openssh: avoid degrading systemd on failed login

[ptxdist] [PATCH] openssh: avoid degrading systemd on failed login

[Bruno Thomsen]

Before OpenSSH 9.8 an aborted or rejected session always exited with
255. OpenSSH 9.8+ uses new exit codes for the PerSourcePenalties
feature, but nothing reads them and they reach systemd.

See srclimit.h[1]:

 #define EXIT_LOGIN_GRACE     3  /* login grace period exceeded */
 #define EXIT_CHILD_CRASH     4  /* preauth child crashed */
 #define EXIT_AUTH_ATTEMPTED  5  /* at least one auth attempt made */
 #define EXIT_CONFIG_REFUSED  6  /* sshd_config RefuseConnection */
 #define EXIT_INVALID_USER    7  /* invalid user supplied */

Systemd reads them as LSB init-script codes. It shows 3, 4, 5, 6 and 7 as
NOTIMPLEMENTED, NOPERMISSION, NOTINSTALLED, NOTCONFIGURED and NOTRUNNING.

In OpenSSH 10.x, each connection is handled by two server processes:
 - sshd-session (privileged)
 - sshd-auth (unprivileged)

When sshd-session sees sshd-auth die from a crash signal, it exits with
code 4, so don't include that code.

[1] https://github.com/openssh/openssh-portable/blob/master/srclimit.h#L33

Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
---
 projectroot/usr/lib/systemd/system/sshd@.service | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/projectroot/usr/lib/systemd/system/sshd@.service b/projectroot/usr/lib/systemd/system/sshd@.service
index 269127c8f..4e582227b 100644
--- a/projectroot/usr/lib/systemd/system/sshd@.service
+++ b/projectroot/usr/lib/systemd/system/sshd@.service
@@ -5,7 +5,7 @@ IgnoreOnIsolate=true
 
 [Service]
 ExecStart=/usr/sbin/sshd -i
-SuccessExitStatus=0 255
+SuccessExitStatus=0 3 5 6 7 255
 StandardInput=socket
 RuntimeDirectory=sshd
 RuntimeDirectoryPreserve=yes

base-commit: 25578c25031573977db826d12d05156574cc2898
-- 
2.53.0