diff mbox series

openssh: add After dependencies on nss-user-lookup.target

Message ID 20240417114520.78483-1-rasmus.villemoes@prevas.dk
State Accepted, archived
Commit 365b5490f3b12772ed57a6bcfd1e0e8a91185afc
Headers show
Series openssh: add After dependencies on nss-user-lookup.target | expand

Commit Message

Rasmus Villemoes April 17, 2024, 11:45 a.m. UTC 
From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>

Quoting 'man systemd.special':

  nss-user-lookup.target

    A target that should be used as synchronization point for all
    regular UNIX user/group name service lookups. [...] All services
    for which the availability of the full user/group database is
    essential should be ordered after this target, but not pull it
    in. All services which provide parts of the user/group database
    should be ordered before this target, and pull it in.

When no service providing parts of the user/group database exists and
thus pulls in the nss-user-lookup.target, this added dependency is a
no-op.

However, when such a service does exist, and e.g. modifies /etc/shadow
to change password or enable/disable certain accounts, it is essential
that no ssh connections are accepted until those changes are made.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
---
 meta/recipes-connectivity/openssh/openssh/sshd.service | 1 +
 meta/recipes-connectivity/openssh/openssh/sshd.socket  | 1 +
 2 files changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-connectivity/openssh/openssh/sshd.service b/meta/recipes-connectivity/openssh/openssh/sshd.service
index 2a997b656a..3e570ab1e5 100644
--- a/meta/recipes-connectivity/openssh/openssh/sshd.service
+++ b/meta/recipes-connectivity/openssh/openssh/sshd.service
@@ -2,6 +2,7 @@ 
 Description=OpenSSH server daemon
 Wants=sshdgenkeys.service
 After=sshdgenkeys.service
+After=nss-user-lookup.target
 
 [Service]
 Environment="SSHD_OPTS="
diff --git a/meta/recipes-connectivity/openssh/openssh/sshd.socket b/meta/recipes-connectivity/openssh/openssh/sshd.socket
index 8d76d62309..7dd2ed0626 100644
--- a/meta/recipes-connectivity/openssh/openssh/sshd.socket
+++ b/meta/recipes-connectivity/openssh/openssh/sshd.socket
@@ -1,6 +1,7 @@ 
 [Unit]
 Conflicts=sshd.service
 Wants=sshdgenkeys.service
+After=nss-user-lookup.target
 
 [Socket]
 ExecStartPre=@BASE_BINDIR@/mkdir -p /var/run/sshd