From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 13 Nov 2026 09:41:19 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xRmqU-00AMTE-2s for lore@lore.pengutronix.de; Fri, 13 Nov 2026 09:41:19 +0100 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xRmqT-00065v-Mq; Fri, 13 Nov 2026 09:41:17 +0100 Received: from mx1.white.stw.pengutronix.de ([185.203.200.13]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xRmoj-0006RS-4U for ptxdist@pengutronix.de; Fri, 13 Nov 2026 09:39:32 +0100 Received: from dude05.red.stw.pengutronix.de (dude05.red.stw.pengutronix.de [IPv6:2a0a:edc0:0:1101:1d::54]) (Authenticated sender: relay-from-dude05.red.stw.pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id 102062059D7; Fri, 13 Nov 2026 09:39:29 +0100 (CET) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1794559169; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Thh0/TCJymSJPNgqXCZJ2prQb+f5PR/ebe7vOsWWHAA=; b=UNtCcWNNBPzzxg7TVX5CScbdTm8nHlOpDd3dHGm+xsEUAOSgxzksd0bUZr0aZWUvNqPE6i ngSLyigK5PghFeMQrz3EWSAqDusloLY23KNMqNBkZ7amFjP+Qsvp5sT0gcclEqa7fWUh+Z +aLrNDfsln2zwc1um3UaNXX+g6TkBwQUNLNXVZu8AMsI8XEDCzcmFmHjslM5L1tBZ0dsc4 uC5lG5y08thHrPh3m8LS3T4DemF7frNb9yEKa0Qjhhr69n0iuP42ZJSXUpahdbnXkUv3p+ Jo5YtIzuKy3jFaoGEpoz37tjBgytwPJdoUOCcUuWIBJlY6ZSmwjztnE4vE8pZw== ARC-Seal: i=1; s=20260414; d=pengutronix.de; t=1794559169; a=rsa-sha256; cv=none; b=PWrjnnnzkwzF2bWD2qaDeWTgrgE35ruJORs52mEMJLVKeoOPmxALPs2FtG22rK6/JcWj11 yP8M+4tru3Ybn/Pu86SYXC1LVMQln2ZVZkJAw7uAD7Lap9y360S/1NPhufP4xpU3kbUZbh 3nzKxhC09RgyZteXTAvzKwtjCmiQh2LVoTpxYm1cvZ9rHWxyNrVyQuoShLo5sL6Ar4BXDZ bhyHDZ7aeM1YGQCG+cfplrtavtqKFmAsTPPvzyDk3SUvTUXyWIB40lchYtI3sQQWLqpgsL QOfcQd+SekAKLH/dJgSI+Sfc9nMTndMtAwtouQkFzGOSKhQl1jGvhRa51OaEJw== ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=relay-from-dude05.red.stw.pengutronix.de smtp.mailfrom=mol@pengutronix.de Received: by dude05.red.stw.pengutronix.de (Postfix, from userid 1014) id 02123743103; Fri, 13 Nov 2026 09:39:29 +0100 (CET) From: Michael Olbrich To: ptxdist@pengutronix.de Date: Fri, 13 Nov 2026 09:39:28 +0100 Message-ID: <20261113083928.1380642-1-m.olbrich@pengutronix.de> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261028183643.9905-1-bruno.thomsen@gmail.com> References: <20261028183643.9905-1-bruno.thomsen@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU autolearn=ham autolearn_force=no version=3.4.2 Subject: Re: [ptxdist] [APPLIED] openssh: avoid degrading systemd on failed login X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Bruno Thomsen Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Thanks, applied as f1ca5f9188748c2518207eb85220fa2f86a2cd5b. Michael [sent from post-receive hook] On Fri, 13 Nov 2026 09:39:28 +0100, Bruno Thomsen wrote: > Before OpenSSH 9.8 an aborted or rejected session always exited with > 255. OpenSSH 9.8+ uses new exit codes for the PerSourcePenalties > feature, but nothing reads them and they reach systemd. > > See srclimit.h[1]: > > #define EXIT_LOGIN_GRACE 3 /* login grace period exceeded */ > #define EXIT_CHILD_CRASH 4 /* preauth child crashed */ > #define EXIT_AUTH_ATTEMPTED 5 /* at least one auth attempt made */ > #define EXIT_CONFIG_REFUSED 6 /* sshd_config RefuseConnection */ > #define EXIT_INVALID_USER 7 /* invalid user supplied */ > > Systemd reads them as LSB init-script codes. It shows 3, 4, 5, 6 and 7 as > NOTIMPLEMENTED, NOPERMISSION, NOTINSTALLED, NOTCONFIGURED and NOTRUNNING. > > In OpenSSH 10.x, each connection is handled by two server processes: > - sshd-session (privileged) > - sshd-auth (unprivileged) > > When sshd-session sees sshd-auth die from a crash signal, it exits with > code 4, so don't include that code. > > [1] https://github.com/openssh/openssh-portable/blob/master/srclimit.h#L33 > > Signed-off-by: Bruno Thomsen > Message-Id: <20261028183643.9905-1-bruno.thomsen@gmail.com> > Signed-off-by: Michael Olbrich > > diff --git a/projectroot/usr/lib/systemd/system/sshd@.service b/projectroot/usr/lib/systemd/system/sshd@.service > index 269127c8f3ac..4e582227b0d6 100644 > --- a/projectroot/usr/lib/systemd/system/sshd@.service > +++ b/projectroot/usr/lib/systemd/system/sshd@.service > @@ -5,7 +5,7 @@ IgnoreOnIsolate=true > > [Service] > ExecStart=/usr/sbin/sshd -i > -SuccessExitStatus=0 255 > +SuccessExitStatus=0 3 5 6 7 255 > StandardInput=socket > RuntimeDirectory=sshd > RuntimeDirectoryPreserve=yes