Re: [Touch-packages] [Bug 1674330] [NEW] Please consider dropping /etc/network/if-up.d/openssh-server
On Sat, 25 Mar 2017 09:57:26 - Colin Watson
wrote:
> On Mon, Mar 20, 2017 at 05:14:07PM -0000, Perry E. Metzger wrote:
> > And it isn't a "hack", this is exactly what ifup/down scripts are
> > for.
>
> They're useful for giving sysadmins the flexibility to do this sort
> of thing locally without too much work, but doing service restarts
> on if-{up,down} is an awfully big hammer that's generally better
> handled some other way if possible.
So why don't you get a laptop and try it out? Using a virtual machine
will not tell you what the behavior is if the network address is
forcibly changed on the machine, and there are other confounding
circumstances here like loss of network carrier when you change
location etc. (It may be possible to conduct a principled experiment
with virtual machines but it will not be particularly easy.)
You will have to make sure that the daemon continues to permit remote
logins on every new address it acquires.
> Not being the maintainer and not using Ubuntu any more, you might be
> unaware of how much work this hack has been to maintain over the
> years.
Many things are unpleasant to maintain but provide necessary
functionality. Again, what you should do is conduct an actual test.
Perry
--
Perry E. Metzgerpe...@piermont.com
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1674330
Title:
Please consider dropping /etc/network/if-up.d/openssh-server
Status in openssh package in Ubuntu:
New
Bug description:
The /etc/network/if-up.d/openssh-server hack was introduced ten years ago [1]
as a response to bug
103436. At least from today's perspective this isn't justified:
I can't seem to be able to actually reproduce that issue: I can start
a VM with no network interfaces, remove the above hack, then start
sshd, then bring up an ethernet interface, and I can connect to ssh
via ethernet just fine. Also, e. g. Fedora has no counterpart of this
hack, and these days a lot of people would complain if that would
cause problems, as hotpluggable/roaming network devices are
everywhere.
The hack introduces a race: you run into connection errors after
bringing up a new interface as sshd stops listening briefly while
being reloaded. That's the reason why I looked at it, as this
regularly happens in upstream's cockpit integration tests.
Also, /etc/network/if-up.d/ isn't being run when using
networkd/netplan, i. e. in more recent Ubuntnu cloud instances. So far
this doesn't seem to have caused any issues.
I asked the original reporter of bug 103436 for some details, and to
check whether that hack is still necessary. There is actually a
proposed patch upstream [2] to use IP_FREEBIND, which is the modern
solution to listening to all "future" interfaces as well. But at least
for the majority of cases it seems to work fine without that even.
So I wonder if it's time to bury that hack?
[1] https://anonscm.debian.org/cgit/pkg-ssh/openssh.git/commit/?id=ba6b55ed6
[2] https://bugzilla.mindrot.org/show_bug.cgi?id=2512
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1674330/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
Re: [Touch-packages] [Bug 103436] Re: sshd not reconfigured by /etc/network
On Mon, 20 Mar 2017 13:18:54 - Martin Pitt wrote: > Perry, I just revisited this: That bug report was a decade ago. So far as I know, this is still an issue for your users, because sshd does not, on its own, change its network address when one changes networks. I would not remove this because if you remove it you're going to harm anyone who changes addresses frequently. However, I have not used Ubuntu in many years (this is 2017, the bug report was 2007) and I am no longer in a position to help you. Perry -- Perry E. Metzgerpe...@piermont.com -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to openssh in Ubuntu. https://bugs.launchpad.net/bugs/103436 Title: sshd not reconfigured by /etc/network Status in openssh package in Ubuntu: Fix Released Bug description: Binary package hint: openssh-server If you have a device that roams a lot (like a laptop), you want daemons like sshd to be tweaked/restarted by scripts in /etc/network so that they re-open the socket they listen on when the network address changes. (Yes, some of us really do want to be able to remotely log in to our laptops after we bring them home and they roam onto the home WiFi network etc.) Right now there is no sshd script in /etc/network/* but it would be trivial to create one and add it to the package. For sshd, it would be simplest just to restart the daemon. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/103436/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
Re: [Touch-packages] [Bug 1674330] [NEW] Please consider dropping /etc/network/if-up.d/openssh-server
On Mon, 20 Mar 2017 13:26:35 - Launchpad Bug Tracker <1674...@bugs.launchpad.net> wrote: > You have been subscribed to a public bug by Martin Pitt (pitti): > > The /etc/network/if-up.d/openssh-server hack was introduced ten > years ago [1] as a response to bug 103436. At least from today's > perspective this isn't justified: > > I can't seem to be able to actually reproduce that issue: I can > start a VM with no network interfaces, remove the above hack, then > start sshd, then bring up an ethernet interface, and I can connect > to ssh via ethernet just fine. sshd has no internal support to open and close listening addresses on its own, so I suspect you're wrong. Why don't you try the actual use case, which is changing addresses rather than an initial open. However, I haven't used ubuntu in at least eight years and have no way to help you. > Also, e. g. Fedora has no > counterpart of this hack, and these days a lot of people would > complain if that would cause problems, How many people regularly ssh into their laptops on multiple networks? I would guess very few. > The hack introduces a race: you run into connection errors after > bringing up a new interface as sshd stops listening briefly while > being reloaded. Well, yah, but when you change networks you're also not listening to the network. This isn't a race, this is just expected behavior. Even if sshd did this on its own this would happen. And it isn't a "hack", this is exactly what ifup/down scripts are for. Perry -- Perry E. Metzgerpe...@piermont.com -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to openssh in Ubuntu. https://bugs.launchpad.net/bugs/1674330 Title: Please consider dropping /etc/network/if-up.d/openssh-server Status in openssh package in Ubuntu: New Bug description: The /etc/network/if-up.d/openssh-server hack was introduced ten years ago [1] as a response to bug 103436. At least from today's perspective this isn't justified: I can't seem to be able to actually reproduce that issue: I can start a VM with no network interfaces, remove the above hack, then start sshd, then bring up an ethernet interface, and I can connect to ssh via ethernet just fine. Also, e. g. Fedora has no counterpart of this hack, and these days a lot of people would complain if that would cause problems, as hotpluggable/roaming network devices are everywhere. The hack introduces a race: you run into connection errors after bringing up a new interface as sshd stops listening briefly while being reloaded. That's the reason why I looked at it, as this regularly happens in upstream's cockpit integration tests. Also, /etc/network/if-up.d/ isn't being run when using networkd/netplan, i. e. in more recent Ubuntnu cloud instances. So far this doesn't seem to have caused any issues. I asked the original reporter of bug 103436 for some details, and to check whether that hack is still necessary. There is actually a proposed patch upstream [2] to use IP_FREEBIND, which is the modern solution to listening to all "future" interfaces as well. But at least for the majority of cases it seems to work fine without that even. So I wonder if it's time to bury that hack? [1] https://anonscm.debian.org/cgit/pkg-ssh/openssh.git/commit/?id=ba6b55ed6 [2] https://bugzilla.mindrot.org/show_bug.cgi?id=2512 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1674330/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
