Thank you Simon and Seth, for your quick response. I have looked into
this further by installing a virgin Ubuntu Server 20.04 with SSH.
Changing the 'Port' in /etc/ssh/sshd_config to 7722 starts sshd on port
7722 and NOT on port 22, just like you said, Simon. BUT:
Rename sshd_config to something_else and replace sshd_config with two
lines to include the original config (now called something_else) and set
the Port to 7722:
systemctl stop ssh
mv /etc/ssh/sshd_config /etc/ssh/something_else
cat > /etc/ssh/sshd_config <<EOF
Include /etc/ssh/something_else
Port 7722
EOF
systemctl start ssh
systemctl status ssh
# restore the original config:
mv /etc/ssh/something_else /etc/ssh/sshd_config
Which will show:
● ssh.service - OpenBSD Secure Shell server
Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset:
enabled)
Active: active (running) since Sat 2020-05-02 15:31:37 UTC; 13s ago
Docs: man:sshd(8)
man:sshd_config(5)
Process: 45261 ExecStartPre=/usr/sbin/sshd -t (code=exited,
status=0/SUCCESS)
Main PID: 45271 (sshd)
Tasks: 1 (limit: 18457)
Memory: 1.3M
CGroup: /system.slice/ssh.service
└─45271 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
May 02 15:31:37 cabernet systemd[1]: Starting OpenBSD Secure Shell server...
May 02 15:31:37 cabernet sshd[45271]: Server listening on 0.0.0.0 port 7722.
May 02 15:31:37 cabernet sshd[45271]: Server listening on :: port 7722.
May 02 15:31:37 cabernet sshd[45271]: Server listening on 0.0.0.0 port 22.
May 02 15:31:37 cabernet sshd[45271]: Server listening on :: port 22.
May 02 15:31:37 cabernet systemd[1]: Started OpenBSD Secure Shell server.
So, NOW it will have ports 22 AND 7722 open!
If one sets debug level 3 in /etc/default/ssh (SSHD_OPTS="-d -d -d"),
syslog will show that 'something_else' is read from line 1 in
sshd_config and that the Port is set afterwards (and not anywhere in
/etc/ssh/something_else).
May 2 15:34:01 cabernet systemd[1]: Stopping OpenBSD Secure Shell server...
May 2 15:34:01 cabernet systemd[1]: ssh.service: Succeeded.
May 2 15:34:01 cabernet systemd[1]: Stopped OpenBSD Secure Shell server.
May 2 15:34:01 cabernet systemd[1]: Starting OpenBSD Secure Shell server...
May 2 15:34:01 cabernet sshd[45345]: debug2: load_server_config: filename
/etc/ssh/sshd_config
May 2 15:34:01 cabernet sshd[45345]: debug2: load_server_config: done config
len = 43
May 2 15:34:01 cabernet sshd[45345]: debug2: parse_server_config_depth: config
/etc/ssh/sshd_config len 43
May 2 15:34:01 cabernet sshd[45345]: debug2: /etc/ssh/sshd_config line 1: new
include /etc/ssh/something_else
May 2 15:34:01 cabernet sshd[45345]: debug2: /etc/ssh/sshd_config line 1:
including /etc/ssh/something_else
May 2 15:34:01 cabernet sshd[45345]: debug2: load_server_config: filename
/etc/ssh/something_else
May 2 15:34:01 cabernet sshd[45345]: debug2: load_server_config: done config
len = 296
May 2 15:34:01 cabernet sshd[45345]: debug2: parse_server_config_depth: config
/etc/ssh/something_else len 296
May 2 15:34:01 cabernet sshd[45345]: debug2: /etc/ssh/something_else line 13:
new include /etc/ssh/sshd_config.d/*.conf
May 2 15:34:01 cabernet sshd[45345]: debug2: /etc/ssh/something_else line 13:
no match for /etc/ssh/sshd_config.d/*.conf
May 2 15:34:01 cabernet sshd[45345]: debug3: /etc/ssh/something_else:63
setting ChallengeResponseAuthentication no
May 2 15:34:01 cabernet sshd[45345]: debug3: /etc/ssh/something_else:86
setting UsePAM yes
May 2 15:34:01 cabernet sshd[45345]: debug3: /etc/ssh/something_else:91
setting X11Forwarding yes
May 2 15:34:01 cabernet sshd[45345]: debug3: /etc/ssh/something_else:95
setting PrintMotd no
May 2 15:34:01 cabernet sshd[45345]: debug3: /etc/ssh/something_else:113
setting AcceptEnv LANG LC_*
May 2 15:34:01 cabernet sshd[45345]: debug3: /etc/ssh/something_else:116
setting Subsystem sftp#011/usr/lib/openssh/sftp-server
May 2 15:34:01 cabernet sshd[45345]: debug3: /etc/ssh/sshd_config:2 setting
Port 7722
May 2 15:34:01 cabernet sshd[45345]: debug1: sshd version OpenSSH_8.2, OpenSSL
1.1.1f 31 Mar 2020
May 2 15:34:01 cabernet sshd[45345]: debug1: private host key #0: ssh-rsa
SHA256:wiRec7mI3CIkcHIwvlEC137Ak+aZzEPocrwYHZtEn7M
May 2 15:34:01 cabernet sshd[45345]: debug1: private host key #1:
ecdsa-sha2-nistp256 SHA256:qdlfKdKcW/T2Rm13DFa6KqHRxCwZNxPZPV/0nu1/uDM
May 2 15:34:01 cabernet sshd[45345]: debug1: private host key #2: ssh-ed25519
SHA256:RqHjOSrBKft8jayVulIKh/y7EGkmFE+acxTLOPd4HOc
May 2 15:34:01 cabernet sshd[45345]: debug1: rexec_argv[0]='/usr/sbin/sshd'
May 2 15:34:01 cabernet sshd[45345]: debug1: rexec_argv[1]='-D'
May 2 15:34:01 cabernet sshd[45345]: debug1: rexec_argv[2]='-d'
May 2 15:34:01 cabernet sshd[45345]: debug1: rexec_argv[3]='-d'
May 2 15:34:01 cabernet sshd[45345]: debug1: rexec_argv[4]='-d'
May 2 15:34:01 cabernet sshd[45345]: debug3: already daemonized
May 2 15:34:01 cabernet sshd[45345]: debug3: oom_adjust_setup
May 2 15:34:01 cabernet sshd[45345]: debug1: Set /proc/self/oom_score_adj from
0 to -1000
May 2 15:34:01 cabernet sshd[45345]: debug2: fd 3 setting O_NONBLOCK
May 2 15:34:01 cabernet sshd[45345]: debug1: Bind to port 7722 on 0.0.0.0.
May 2 15:34:01 cabernet sshd[45345]: Server listening on 0.0.0.0 port 7722.
May 2 15:34:01 cabernet sshd[45345]: debug2: fd 4 setting O_NONBLOCK
May 2 15:34:01 cabernet sshd[45345]: debug3: sock_set_v6only: set socket 4
IPV6_V6ONLY
May 2 15:34:01 cabernet sshd[45345]: debug1: Bind to port 7722 on ::.
May 2 15:34:01 cabernet sshd[45345]: Server listening on :: port 7722.
May 2 15:34:01 cabernet sshd[45345]: debug2: fd 5 setting O_NONBLOCK
May 2 15:34:01 cabernet sshd[45345]: debug1: Bind to port 22 on 0.0.0.0.
May 2 15:34:01 cabernet sshd[45345]: Server listening on 0.0.0.0 port 22.
May 2 15:34:01 cabernet sshd[45345]: debug2: fd 6 setting O_NONBLOCK
May 2 15:34:01 cabernet sshd[45345]: debug3: sock_set_v6only: set socket 6
IPV6_V6ONLY
May 2 15:34:01 cabernet sshd[45345]: debug1: Bind to port 22 on ::.
May 2 15:34:01 cabernet sshd[45345]: Server listening on :: port 22.
May 2 15:34:01 cabernet systemd[1]: Started OpenBSD Secure Shell server.
I have read the source code for sshd, but I cannot find the 'obvious'
place where this goes wrong, although the juggling of the options
structure in process_config_line_depth() (in readconf.c) may have
something to do with it.
This bug probably won't affect too many people. Given that I have
already found a work-around and that I will now look into the 'Match'
keyword (which I was not aware of) to avoid running two daemons, I
suggest handling this issue at a low priority.
(Yes, my private keys are visible. This temporary install is not
accessible from the internet and will be scrapped in a few hours
anyway.)
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1876320
Title:
Port parameter sshd_config is 22 AND whatever you specify
Status in openssh package in Ubuntu:
New
Bug description:
On my Ubuntu Server 20.04 LTS with OpenSSH 1:8.2p1-4, I have TWO sshd
deamons. One (on port 22) is for internal use, accepts passwords etc.
The second (on port 7722) does not allow PAM use and no passwords,
allows only one user(name) and uses an alternative autorized_keys file
(that only root can edit).
Any parameter FIRST encountered in sshd_config is the one that is
accepted; others do not override (like in many other config files).
There is one exception: 'Port', which is accumulative. To make life
easier, I set the more restrictive parameters for port 7722 first and
next include the system-default /etc/ssh/sshd_config.
The /etc/ssh/sshd_config file(s) in Ubuntu Server 20.04 DO NOT specify
'Port' anywhere - the default is 22. But: it is obviously still
accumulative: Setting 'Port' to 7722 makes sshd listen on port 7722
AND 22. This is unwanted.
Proposed solution: Remove the accumulative behavior for 'Port' and
REQUIRE the 'Port' parameter like before (and maybe have second and
later parameters override the earlier ones, like 'everyone else').
Regards,
Adriaan
PS Searching for solutions, I found that specifying 'ListenAddress
0.0.0.0:7722' stops sshd from listening to port 22. This, however, is
not documented in 'man 5 sshd_config' and may be an unreliable side-
effect.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1876320/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
