From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Wed, 28 Oct 2026 19:37:19 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xM8WU-004QxD-1u for lore@lore.pengutronix.de; Wed, 28 Oct 2026 19:37:19 +0100 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xM8WU-0004GK-5y; Wed, 28 Oct 2026 19:37:18 +0100 Received: from mx1.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::107]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xM8W9-0004GD-0u for ptxdist@pengutronix.de; Wed, 28 Oct 2026 19:36:57 +0100 Received: from mail-ej1-x633.google.com (mail-ej1-x633.google.com [IPv6:2a00:1450:4864:20::633]) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPS id C18A2201CE0 for ; Wed, 28 Oct 2026 19:36:52 +0100 (CET) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1793212612; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding:dkim-signature; bh=1/C8q5szkSOmGJFN7CJ+1naJZaUll2yFXPc0iwO0BHk=; b=BQylNPLouLZFhXVPiFPcnZJc/eDT8pDvBV+8jKpv+craL9j6oEcN7kpryp2WL2ngN8zr09 t4gbMSiZRiRhijSzx6CLzx/MPPFot7o/HGRlVbxqHMHsdRFIVLMfPkLnWjxorioCR8h35Z O9mqLT9pzUDqGuXUScrxSfFFdsVrKQwL8QsCLgsg0pv9tN3na0vCQejU13lHG9GEZxAhgQ AyU3iEWLHVlLeXyRGchFxlcG7wShbGqb35+60tdXfzg3kc3Qo08D8mNs63Y9tpz23FcyL5 qdY6j+n3KsmpobYNQ5oEWquD6BtO6pvfhNOny/6EXOGOo9LiHuuGPihPQHYStA== ARC-Authentication-Results: i=1; mx1.white.stw.pengutronix.de; dkim=pass header.d=gmail.com header.s=20260707 header.b=cOClp53Q; spf=pass (mx1.white.stw.pengutronix.de: domain of bruno.thomsen@gmail.com designates 2a00:1450:4864:20::633 as permitted sender) smtp.mailfrom=bruno.thomsen@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Seal: i=1; s=20260414; d=pengutronix.de; t=1793212612; a=rsa-sha256; cv=none; b=JxAEaI5pzCsAPqtLK/OvW3IKa8wg+8cDVmAxy0VxJwfdBTJbpkYT4KcMTPfbZ66EsqqrFo gxBDwCG4VF7iecBT6efXzGKVb5KQWYEtxsMqIGhD4X/SsM8kb/sD+VgbuJkDuUiiRM1geE J9IBaL9UBatsoGJEpP9xjkOJ5nwOB24AC4968YBJFJHtjqygIYHYjUp1lGB6Lo1kk+BYS+ ExZ3Udc/AxyYzQTsIQk9eB4f6uCZluvEdeepdwkXCk+J3TKNpH+WL2A4V8a1/w1E90ze7l I0PAopZIG1r8ao2cHKxytEL931AixPbrcaiDQxQMrXeqzziVgSjQ/hTUStKu9g== Received: by mail-ej1-x633.google.com with SMTP id a640c23a62f3a-c34bff61551so198842366b.2 for ; Wed, 28 Oct 2026 11:36:52 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793212612; x=1793817412; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=1/C8q5szkSOmGJFN7CJ+1naJZaUll2yFXPc0iwO0BHk=; b=RYW6iVBzHTVKl0LHEfTfvQV70pp7YNFG9+4ZWZGJHEY6Qq9WnGu51+oPd1sdeXTS61 8uVu1oaCvpnENE21GsD6F8FtDe+YwU5F2akWNmDci5aaZOeVR1UoGjlh8c4ZNTPLr0kH bQSnRnQACvm5wVJWMzTTc6tUE1X8phhkS16c08QsYS3Nc3hdFvGBvmWM/WOSq5CxcVj8 kuxmzgKCrC8PmG42CzXxV0DVryHoLanpXqsQnyAXoO9VZAS61Jx9F1equ4cGKqdoiLca IcTiUWxFZYIsIHTRUzI4tD0mZX/gxiAOusCEiFauyVfME9dAJ4e96y7XUxeou0i7kqvd xT5w== X-Gm-Message-State: AFq9FYLftzwSoSjlCX/hmo5wTAOB+dqCSJTX13VEaiF1D+QXObPutdRj i6vU/7aFahcrT4ctBBrf+othgmm2Yop6KS/VzjQ2HAJ/IJxR5AN59lZLDeWMzg== X-Gm-Gg: AYBFou0LDO46ZlGihjCeyMLr6murLKvO1HL31HDsTxm1NSN9H9Cc3frySVeWE+OCSir F8t3q/p/C9pD6H8G2oAmF2ffdeVXQ2mAZSyO1jrY1y5kuqW9cDFgiq5S5qW4a/jwkgtyzumyzwh yrurEQA4b890rceMC9yTcYke29ibr+OTv+AEZI9AxfaUhRqd8j3HNefvSS/yMLQJh26QqQXUIzX 7JLNle6Jq3moIZn43P2Vc8Et37KyOJNYAA+vyiVBpWfnSPWTWDKY11SHdsHv5BeR/x+PtqzRc4g zst4iaBtNutrbDL1wRhxySsP4Wq1AzbN8DL1lDOW4KMCDllVT4Iq+wv1nOHH5NjNBm/FPLRqawo bbzSDrPxvE3dlLXiO+mCGjx4wqDHbQRGcQxLPOOvylJeGotHlqTgKFzoC/hIqXVB0x2hlY18gAq AGFUuscbOw1EZfrHJPFRypuoWfkdHJ2gAevQ79MiRAbD2TougN76N0oceKKWJLdvdCvqzDqJQ1Q jEwI3LjMBem8tiT5a84cnSQPC7dPzrNJLleo6ub3KCTHj0psNfXU7TjojSpqO4vTm14bQsYJep5 U4ShvPw2Zdld8JgUrrW5Bxc70qFMP10YUNz+e5JtroSD/4hvrewd6BqDO61Veye/nzQo9YzVcud ubgKcZ2+t954= X-Received: by 2002:a17:907:9805:b0:c40:a4f8:e036 with SMTP id a640c23a62f3a-c49bdf783famr280180166b.43.1793212611714; Wed, 28 Oct 2026 11:36:51 -0700 (PDT) Received: from fedora.tux.internal (85.191.71.118.dynamic.dhcp.aura-net.dk. [85.191.71.118]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c46bd7ac041sm637490366b.82.2026.10.28.11.36.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Oct 2026 11:36:51 -0700 (PDT) From: Bruno Thomsen To: ptxdist@pengutronix.de Date: Wed, 28 Oct 2026 19:36:43 +0100 Message-ID: <20261028183643.9905-1-bruno.thomsen@gmail.com> X-Mailer: git-send-email 2.56.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spamd-Result: default: False [-3.50 / 15.00]; BAYES_HAM(-3.00)[99.99%]; R_MISSING_CHARSET(0.50)[]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; R_SPF_ALLOW(-0.20)[+ip6:2a00:1450:4864::/56]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20260707]; MIME_GOOD(-0.10)[text/plain]; ARC_NA(0.00)[]; RCVD_TLS_LAST(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; MIME_TRACE(0.00)[0:+]; TO_MATCH_ENVRCPT_SOME(0.00)[]; TO_DN_SOME(0.00)[]; DWL_DNSWL_NONE(0.00)[gmail.com:dkim]; TAGGED_FROM(0.00)[]; FREEMAIL_ENVFROM(0.00)[gmail.com]; FREEMAIL_FROM(0.00)[gmail.com]; FROM_EQ_ENVFROM(0.00)[]; FREEMAIL_CC(0.00)[gmail.com]; RCVD_IN_DNSWL_NONE(0.00)[2a00:1450:4864:20::633:from]; MID_RHS_MATCH_FROM(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[ptxdist@pengutronix.de]; ARC_SIGNED(0.00)[pengutronix.de:s=20260414:i=1]; RCVD_COUNT_TWO(0.00)[2]; TAGGED_RCPT(0.00)[]; ASN(0.00)[asn:15169, ipnet:2a00:1450::/32, country:US]; RCVD_VIA_SMTP_AUTH(0.00)[]; DKIM_TRACE(0.00)[gmail.com:+]; NEURAL_SPAM(0.00)[0.601]; FROM_HAS_DN(0.00)[] X-Rspamd-Action: no action X-Rspamd-Server: mx1 X-Stat-Signature: ehuyfj67m3cjwmwtj4s3scw5nfq75xze X-Rspamd-Queue-Id: C18A2201CE0 Subject: [ptxdist] [PATCH] openssh: avoid degrading systemd on failed login X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Bruno Thomsen Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Before OpenSSH 9.8 an aborted or rejected session always exited with 255. OpenSSH 9.8+ uses new exit codes for the PerSourcePenalties feature, but nothing reads them and they reach systemd. See srclimit.h[1]: #define EXIT_LOGIN_GRACE 3 /* login grace period exceeded */ #define EXIT_CHILD_CRASH 4 /* preauth child crashed */ #define EXIT_AUTH_ATTEMPTED 5 /* at least one auth attempt made */ #define EXIT_CONFIG_REFUSED 6 /* sshd_config RefuseConnection */ #define EXIT_INVALID_USER 7 /* invalid user supplied */ Systemd reads them as LSB init-script codes. It shows 3, 4, 5, 6 and 7 as NOTIMPLEMENTED, NOPERMISSION, NOTINSTALLED, NOTCONFIGURED and NOTRUNNING. In OpenSSH 10.x, each connection is handled by two server processes: - sshd-session (privileged) - sshd-auth (unprivileged) When sshd-session sees sshd-auth die from a crash signal, it exits with code 4, so don't include that code. [1] https://github.com/openssh/openssh-portable/blob/master/srclimit.h#L33 Signed-off-by: Bruno Thomsen --- projectroot/usr/lib/systemd/system/sshd@.service | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projectroot/usr/lib/systemd/system/sshd@.service b/projectroot/usr/lib/systemd/system/sshd@.service index 269127c8f..4e582227b 100644 --- a/projectroot/usr/lib/systemd/system/sshd@.service +++ b/projectroot/usr/lib/systemd/system/sshd@.service @@ -5,7 +5,7 @@ IgnoreOnIsolate=true [Service] ExecStart=/usr/sbin/sshd -i -SuccessExitStatus=0 255 +SuccessExitStatus=0 3 5 6 7 255 StandardInput=socket RuntimeDirectory=sshd RuntimeDirectoryPreserve=yes base-commit: 25578c25031573977db826d12d05156574cc2898 -- 2.53.0