Why does init have port 22 open? [Solved]

[a_freed_man]

I'm running the most recent respin by dolphin_oracle (systemd only based on mx-23) and couldn't ssh in. It was working last week but not now. I use a custom sshd_config to disable password auth, no root login and login with pub/priv keys only. I've done this on my systems, very straightforward.

On investigation the sshd_config looks correct, but there are no listeners on the configured port. When I stop the service (systemctl stop sshd) I still see port 22 open for ipv6:

Code: Select all

# netstat -tulpn | grep 22
tcp6       0      0 :::22                   :::*                    LISTEN      1/init              
udp        0      0 224.0.0.251:5353        0.0.0.0:*                           2516/chromium --typ 
udp        0      0 224.0.0.251:5353        0.0.0.0:*                           2460/chromium --sho 

After doing a systemctl reload sshd I now see the correct port active but there is still a listener on port 22:

Code: Select all

# systemctl status sshd
● ssh.service - OpenBSD Secure Shell server
     Loaded: loaded (/lib/systemd/system/ssh.service; enabled; preset: enabled)
     Active: active (running) since Mon 2023-10-30 15:10:28 CDT; 18s ago
TriggeredBy: ● ssh.socket
       Docs: man:sshd(8)
             man:sshd_config(5)
    Process: 3759 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)
    Process: 3768 ExecReload=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)
    Process: 3769 ExecReload=/bin/kill -HUP $MAINPID (code=exited, status=0/SUCCESS)
   Main PID: 3760 (sshd)
      Tasks: 1 (limit: 18811)
     Memory: 1.4M
        CPU: 42ms
     CGroup: /system.slice/ssh.service
             └─3760 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"

Oct 30 15:10:28 arniie-002 systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Oct 30 15:10:28 arniie-002 sshd[3760]: Server listening on :: port 22.
Oct 30 15:10:28 arniie-002 systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Oct 30 15:10:34 arniie-002 systemd[1]: Reloading ssh.service - OpenBSD Secure Shell server...
Oct 30 15:10:34 arniie-002 sshd[3760]: Received SIGHUP; restarting.
Oct 30 15:10:34 arniie-002 systemd[1]: Reloaded ssh.service - OpenBSD Secure Shell server.
Oct 30 15:10:34 arniie-002 sshd[3760]: Server listening on 0.0.0.0 port 16202.
Oct 30 15:10:34 arniie-002 sshd[3760]: Server listening on :: port 16202.

Although I have a deny firewall rule for tcp4 & tcp6 on port 22, I'd like to eliminate whatever is opening it. According to netstat, it's opened by init. How can I resolve this? Is it set by some config file I can change?

[Adrian]

What does

Code: Select all

systemctl list-sockets

show on port 22?

[a_freed_man]

# systemctl list-sockets | grep 22

Code: Select all

[::]:22                      ssh.socket                      ssh.service

Code: Select all

# systemctl stop sshd
Warning: Stopping sshd.service, but it can still be activated by:
  ssh.socket
root@arniie-002:/etc# systemctl status sshd
○ ssh.service - OpenBSD Secure Shell server
     Loaded: loaded (/lib/systemd/system/ssh.service; enabled; preset: enabled)
     Active: inactive (dead) since Mon 2023-10-30 20:10:20 CDT; 11s ago
   Duration: 4h 59min 51.713s
TriggeredBy: ● ssh.socket
       Docs: man:sshd(8)
             man:sshd_config(5)
    Process: 3760 ExecStart=/usr/sbin/sshd -D $SSHD_OPTS (code=exited, status=0/SUCCESS)
   Main PID: 3760 (code=exited, status=0/SUCCESS)
        CPU: 43ms

Oct 30 15:10:28 arniie-002 systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Oct 30 15:10:34 arniie-002 systemd[1]: Reloading ssh.service - OpenBSD Secure Shell server...
Oct 30 15:10:34 arniie-002 sshd[3760]: Received SIGHUP; restarting.
Oct 30 15:10:34 arniie-002 systemd[1]: Reloaded ssh.service - OpenBSD Secure Shell server.
Oct 30 15:10:34 arniie-002 sshd[3760]: Server listening on 0.0.0.0 port 16202.
Oct 30 15:10:34 arniie-002 sshd[3760]: Server listening on :: port 16202.
Oct 30 20:10:20 arniie-002 sshd[3760]: Received signal 15; terminating.
Oct 30 20:10:20 arniie-002 systemd[1]: Stopping ssh.service - OpenBSD Secure Shell server...
Oct 30 20:10:20 arniie-002 systemd[1]: ssh.service: Deactivated successfully.
Oct 30 20:10:20 arniie-002 systemd[1]: Stopped ssh.service - OpenBSD Secure Shell server.

If I run the systemctl list-sockets after systemctl stop sshd I see the same listener on port 22.

What is this warning about ssh-socket anyway? I've never run into this before.

[Adrian]

sudo systemctl disable sshd.socket

You can read a bit about sshd socket based activation:
https://discourse.ubuntu.com/t/sshd-now ... ater/30189

[a_freed_man]

Thx @Adrian for the link about sshd socket activation. Although the 2 "rm -rf" lines that info provided in their disable sshd.socket activation didn't exist, the procedure worked to restore the previous sshd_config.

I understand the rationale, but IMO they should have made sshd.socket activation opt-in rather than opt-out. 3MB per sshd connection isn't important to me, although it could be for many. I'm sure I'm not the only one surprised by the new default.

I verified I have the correct ISO, sha256sum == 93e947ce888f6e5a79ab131d812ba5c92c82f0c77bdaa2bb91238c086f32eded.
I often use dd to create the USB, but I used MX Live USB Maker this last time. Any reason that won't work?