[ptxdist] [PATCH] openssh: avoid degrading systemd on failed login

[ptxdist] [PATCH] openssh: avoid degrading systemd on failed login

[Bruno Thomsen]

Before OpenSSH 9.8 an aborted or rejected session always exited with
255. OpenSSH 9.8+ uses new exit codes for the PerSourcePenalties
feature, but nothing reads them and they reach systemd.

See srclimit.h[1]:

 #define EXIT_LOGIN_GRACE     3  /* login grace period exceeded */
 #define EXIT_CHILD_CRASH     4  /* preauth child crashed */
 #define EXIT_AUTH_ATTEMPTED  5  /* at least one auth attempt made */
 #define EXIT_CONFIG_REFUSED  6  /* sshd_config RefuseConnection */
 #define EXIT_INVALID_USER    7  /* invalid user supplied */

Systemd reads them as LSB init-script codes. It shows 3, 4, 5, 6 and 7 as
NOTIMPLEMENTED, NOPERMISSION, NOTINSTALLED, NOTCONFIGURED and NOTRUNNING.

In OpenSSH 10.x, each connection is handled by two server processes:
 - sshd-session (privileged)
 - sshd-auth (unprivileged)

When sshd-session sees sshd-auth die from a crash signal, it exits with
code 4, so don't include that code.

[1] https://github.com/openssh/openssh-portable/blob/master/srclimit.h#L33

Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
---
 projectroot/usr/lib/systemd/system/sshd@.service | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/projectroot/usr/lib/systemd/system/sshd@.service b/projectroot/usr/lib/systemd/system/sshd@.service
index 269127c8f..4e582227b 100644
--- a/projectroot/usr/lib/systemd/system/sshd@.service
+++ b/projectroot/usr/lib/systemd/system/sshd@.service
@@ -5,7 +5,7 @@ IgnoreOnIsolate=true
 
 [Service]
 ExecStart=/usr/sbin/sshd -i
-SuccessExitStatus=0 255
+SuccessExitStatus=0 3 5 6 7 255
 StandardInput=socket
 RuntimeDirectory=sshd
 RuntimeDirectoryPreserve=yes

base-commit: 25578c25031573977db826d12d05156574cc2898
-- 
2.53.0

Re: [ptxdist] [APPLIED] openssh: avoid degrading systemd on failed login

[Michael Olbrich]

Thanks, applied as f1ca5f9188748c2518207eb85220fa2f86a2cd5b.

Michael

[sent from post-receive hook]

On Fri, 13 Nov 2026 09:39:28 +0100, Bruno Thomsen <bruno.thomsen@gmail.com> wrote:
> Before OpenSSH 9.8 an aborted or rejected session always exited with
> 255. OpenSSH 9.8+ uses new exit codes for the PerSourcePenalties
> feature, but nothing reads them and they reach systemd.
> 
> See srclimit.h[1]:
> 
>  #define EXIT_LOGIN_GRACE     3  /* login grace period exceeded */
>  #define EXIT_CHILD_CRASH     4  /* preauth child crashed */
>  #define EXIT_AUTH_ATTEMPTED  5  /* at least one auth attempt made */
>  #define EXIT_CONFIG_REFUSED  6  /* sshd_config RefuseConnection */
>  #define EXIT_INVALID_USER    7  /* invalid user supplied */
> 
> Systemd reads them as LSB init-script codes. It shows 3, 4, 5, 6 and 7 as
> NOTIMPLEMENTED, NOPERMISSION, NOTINSTALLED, NOTCONFIGURED and NOTRUNNING.
> 
> In OpenSSH 10.x, each connection is handled by two server processes:
>  - sshd-session (privileged)
>  - sshd-auth (unprivileged)
> 
> When sshd-session sees sshd-auth die from a crash signal, it exits with
> code 4, so don't include that code.
> 
> [1] https://github.com/openssh/openssh-portable/blob/master/srclimit.h#L33
> 
> Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
> Message-Id: <20261028183643.9905-1-bruno.thomsen@gmail.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/projectroot/usr/lib/systemd/system/sshd@.service b/projectroot/usr/lib/systemd/system/sshd@.service
> index 269127c8f3ac..4e582227b0d6 100644
> --- a/projectroot/usr/lib/systemd/system/sshd@.service
> +++ b/projectroot/usr/lib/systemd/system/sshd@.service
> @@ -5,7 +5,7 @@ IgnoreOnIsolate=true
>  
>  [Service]
>  ExecStart=/usr/sbin/sshd -i
> -SuccessExitStatus=0 255
> +SuccessExitStatus=0 3 5 6 7 255
>  StandardInput=socket
>  RuntimeDirectory=sshd
>  RuntimeDirectoryPreserve=yes