fesco

#3062 Unannounced F39 change: Dropping sshd.socket unit from openssh package
Closed: Rejected by ngompa. Opened by siosm.

Closed: Rejected
Reopen Issue

A while ago, I suggested dropping the sshd.socket from the openssh package in BZ#2025716 as there are several shortcomings with this approach that could lead to situations where users would loose access to a system while under DoS or memory pressure.

This change was implemented in recently in rawhide & f39 and discussed on the devel list in a thread.

The change as implemented does not include a migration path for existing users of the sshd.socket unit to the sshd.service unit.

This means that systems updating from 38 to 39 and relying on sshd.socket for openssh access to the system will end up unreachable via SSH.

This is notably important for Fedora CoreOS where we will automatically update systems to the next Fedora version shortly after the release: https://github.com/coreos/fedora-coreos-tracker/issues/1558

We think this change needs to get more visibility and should go through the change process and be evaluated for inclusion in Fedora 40.

We would like this to be discussed in the next FESCo meeting if possible.

CC @dbelyavs

Sure. When and where?

Looks like it will be next week: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3IW7U5UAZCHZX7L5C4XPD6H27HDRHFLH/

Meeting usually happen on Thursday at 17:00UTC in #fedora-meeting-2 on
irc.libera.chat.

https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/C3VV6QKH3SJTMKONHWNDCB5N43W3QAVQ/

@dbelyavs ++
@siosm ++

Yup, we cancelled today's meeting because the agenda was empty (until this ticket was filed).

FWIW, I don't think dropping the socket without a migration mechanism in place for upgrades is acceptable, but that's just one FESCo member's opinion ...

I agree. The most reasonable solution would be to have a scriptlet which on upgrade enables sshd.service if sshd.socket was enabled and sshd.service was not. This is about 5 lines of spec.

I will be happy to accept this PR

Can someone add the meeting label to this ticket?

I agree. The most reasonable solution would be to have a scriptlet which on upgrade enables sshd.service if sshd.socket was enabled and sshd.service was not. This is about 5 lines of spec.

Unfortunately, this kind of workaround will not apply to all rpm-ostree based systems (Fedora CoreOS, etc.) and they will need another migration process.

Metadata Update from @churchyard:
- Issue tagged with: meeting

This was discussed in today's meeting:

* #3062 Unannounced F39 change: Dropping sshd.socket unit from openssh
  package   (Son_Goku, 17:07:39)
  * AGREED: The Change to drop sshd.socket needs to be reverted before
    Fedora Linux 39 Beta release. If it is desired to drop this, then
    FESCo requests a full Change proposal for Fedora Linux 40 so all
    stakeholders can work on implementing it properly. (+6, 1, -0)
    (Son_Goku, 17:17:56)

Metadata Update from @ngompa:
- Issue untagged with: meeting
- Issue close_status updated to: Rejected
- Issue status updated to: Closed (was: Open)

FTR: https://fedoraproject.org/wiki/Changes/Drop_Sshd_Socket
The change was reverted in F39.

Thanks!

The revert for F39 is in https://src.fedoraproject.org/rpms/openssh/c/743c17bbc1825867d3a2e96c9c3892dc6650922e?branch=f39.

Could you revert that in Rawhide as well? The change has to be discussed and approved by FESCo before being (re-)implemented (with migration logic, etc. if we decide to do it). Thanks.

Yes, if this is going through the Change process for Fedora 40, it should be reverted in Rawhide as well until the change is approved.

https://src.fedoraproject.org/rpms/openssh/pull-request/60
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.