Bug#982950: ssh.service starts sshd before network is online: please switch to After=network-online.target instead of just After=network.target

Hallo,

17.02.21 21:42 Chris Hofstaedtler:
> * Thomas Goirand <[email protected]> [210217 20:38]:
> > # cat /etc/systemd/system/ssh.service.d/override.conf
> > [Unit]
> > After=network-online.target auditd.service
> > 
> > But IMO, this is very wrong to mandate doing this, and not having ssh
> > connectivity after a reboot, is kind of a grave problem.
> > 
> > So, could you hard-wire this in the openssh-server package directly, so
> > Debian users can avoid such an override? Indeed After=network.target
> > doesn't tell you that network is ready. After=network-online.target does,
> > and that's IMO what the ssh daemon should be using.
> 
> But if you do this, you'll end up delaying start of sshd for up to
> 120seconds in error cases. And even then, you might not get what you
> want (if you read systemd-networkd-wait-online.service(8)
> carefully).
> 
> Services that use After=network-online.target are generally broken,
> please do not introduce that.

Seconded. Just consider a node where one link is down on boot and you would 
have to wait such a long time until you can examine the problem via ssh.

> As discussed already, IP_FREEBIND is a thing. The system-wide sysctl
> is a common workaround, especially for "bgp-on-the-host" setups, for
> all sorts of servers/daemons.

That should work; systemd-sysctl.service is ordered before ssh.

Another option is in #965132 ([email protected]), but then the fix for #946180 and 
#934663 (RuntimeDirectoryPreserve=yes for ssh*.service) is also needed.


Grüße
Timo

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965132
[2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=946180
[3] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934663

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE87+TxUS8xnavTxo5VO6rSJSm4+0FAmAuVqwACgkQVO6rSJSm
4+1RXhAAhXvJuwAEwciECYGmtdEER9NttV3YilykTYPb3rwT4wfx7ppSvN348QN6
Y+7Ix8hUhhV+si74udYmVZ4ViFh1A9pd2yR49I/sI6LbopGR0elaf0g6iNkpIRuB
LbRv+pamup7dPMnXgO1xsbtaLB2MUQXySm2EOMFOsHDESqsIzdYBYawcCa1eZaSw
VN+Hlhab0oGL0aXei52TDMVXzssQXGpCWIvlGVTbeUdGibR4GXwbkMf+DGl9xnux
o/i6zhqJIxqNA2kLvh3v6D5Qj9Thht+fsqwkInBiErUQvMwQT+BPmBU4AU/tUw+1
m9XPuCbHiQwC+WbK0fHqvicy6Pux3BpzBCyQ8qMAdcDoP31B5ZEAyX7mJmjQdPkm
AODziJwFBrWgfhTSHW2l4pZHpeOwswfJbQ8FJ6KQHOR9JeM6jib/OJUIJf5J7Ynf
WQWUMrrE7jZTc75O8SQFoOZA0jKGzw3WP0fCTNqFTJbGLZNvQaGvcePN6eik3adI
Dd16vUFZP1xqUOF6KCW7Qsc8lq3gb3Vln0Y2+bWxVNp+sp7jdpEzlcwgBnA60O9K
JtAoG8BfMBRVPQdG8Wya6zLZcfRiAD/l+1ziyjn81aNoOr226CUe8syjPUrI41iJ
iutFml/qc0P+M2V3v9a/WINgm+eXWObstBUJKxKyEr5mLnNBubM=
=5Xbb
-----END PGP SIGNATURE-----