openssh bugs - Mar 2021 - [Bug 3272] New: sshd systemd service unit launch sshd too early at bootup

https://bugzilla.mindrot.org/show_bug.cgi?id=3272

            Bug ID: 3272
           Summary: sshd systemd service unit launch sshd too early at
                    bootup
           Product: Portable OpenSSH
           Version: 8.5p1
          Hardware: amd64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: sshd
          Assignee: unassigned-bugs at mindrot.org
          Reporter: olivier at trillion01.com

The result being the following:
Mar 04 11:26:05 tau sshd[442]: error: Bind to port 2243 on 10.230.131.4
failed: Cannot assign requested address.
Mar 04 11:26:05 tau systemd[1]: sshd.service: Main process exited,
code=exited, status=255/EXCEPTION
Mar 04 11:26:05 tau sshd[442]: fatal: Cannot bind any address.
Mar 04 11:26:05 tau systemd[1]: sshd.service: Failed with result
'exit-code'.

It attempts to bind to an ip address before it is actually configured
and available.

There is an easy fix for that. It is to use the systemd target
network-online.target instead of the target network.target.

Details are provided here:
https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/

I did fix your service unit file very easily by changing it to:

[Unit]
Description=OpenSSH Daemon
Wants=sshdgenkeys.service network-online.target
After=sshdgenkeys.service network-online.target

[Service]
ExecStart=/usr/bin/sshd -D
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=always

[Install]
WantedBy=multi-user.target

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3272

--- Comment #1 from Olivier Langlois <olivier at trillion01.com> ---
As a side note, I believe that I have stumbled into that bug because I
specify a specific ip address of my multi-homed server in sshd_config
at the field ListenAddress.

as denoted at the bottom of
https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/

servers using the address 0.0.0.0 are unaffected.

Perhaps that an elegant solution to not affect the boot time of systems
that don't have this issue could be to bundle 2 service units with
openssh.

1. The current one that wants network.target
2. A new unit that wants network-online.target for the sshd instances
that listen to specific addresses only available when the network is
online.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3272

--- Comment #2 from Olivier Langlois <olivier at trillion01.com> ---
Here is one last idea. Considering how vital sshd is to admin a
headless system, I think that it could be a good idea to never giveup
attempting to restart it... This could be done with this:

[Service]
ExecStart=/usr/bin/sshd -D
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=always
StartLimitIntervalSec=0
RestartSec=20s

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3272

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at dtucker.net

--- Comment #3 from Darren Tucker <dtucker at dtucker.net> ---
The OpenSSH team does not supply a systemd unit file so there's nothing
we can do about this.  You will need to report this to your OS vendor.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3272

--- Comment #4 from Olivier Langlois <olivier at trillion01.com> ---
sorry about that.

I'll report to the appropriate recipient.

thank you nonetheless for the fast reply.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3272

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |INVALID

--- Comment #5 from Darren Tucker <dtucker at dtucker.net> ---
Good luck!  Feel free to add a link here to the vendor report in case
anyone else is having a similar issue and finds this bug.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.