Re: [ptxdist] [APPLIED] openssh: avoid degrading systemd on failed login

[Michael Olbrich <m.olbrich@pengutronix.de>]

Thanks, applied as f1ca5f9188748c2518207eb85220fa2f86a2cd5b.

Michael

[sent from post-receive hook]

On Fri, 13 Nov 2026 09:39:28 +0100, Bruno Thomsen <bruno.thomsen@gmail.com> wrote:
> Before OpenSSH 9.8 an aborted or rejected session always exited with
> 255. OpenSSH 9.8+ uses new exit codes for the PerSourcePenalties
> feature, but nothing reads them and they reach systemd.
> 
> See srclimit.h[1]:
> 
>  #define EXIT_LOGIN_GRACE     3  /* login grace period exceeded */
>  #define EXIT_CHILD_CRASH     4  /* preauth child crashed */
>  #define EXIT_AUTH_ATTEMPTED  5  /* at least one auth attempt made */
>  #define EXIT_CONFIG_REFUSED  6  /* sshd_config RefuseConnection */
>  #define EXIT_INVALID_USER    7  /* invalid user supplied */
> 
> Systemd reads them as LSB init-script codes. It shows 3, 4, 5, 6 and 7 as
> NOTIMPLEMENTED, NOPERMISSION, NOTINSTALLED, NOTCONFIGURED and NOTRUNNING.
> 
> In OpenSSH 10.x, each connection is handled by two server processes:
>  - sshd-session (privileged)
>  - sshd-auth (unprivileged)
> 
> When sshd-session sees sshd-auth die from a crash signal, it exits with
> code 4, so don't include that code.
> 
> [1] https://github.com/openssh/openssh-portable/blob/master/srclimit.h#L33
> 
> Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
> Message-Id: <20261028183643.9905-1-bruno.thomsen@gmail.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/projectroot/usr/lib/systemd/system/sshd@.service b/projectroot/usr/lib/systemd/system/sshd@.service
> index 269127c8f3ac..4e582227b0d6 100644
> --- a/projectroot/usr/lib/systemd/system/sshd@.service
> +++ b/projectroot/usr/lib/systemd/system/sshd@.service
> @@ -5,7 +5,7 @@ IgnoreOnIsolate=true
>  
>  [Service]
>  ExecStart=/usr/sbin/sshd -i
> -SuccessExitStatus=0 255
> +SuccessExitStatus=0 3 5 6 7 255
>  StandardInput=socket
>  RuntimeDirectory=sshd
>  RuntimeDirectoryPreserve=yes