4 ms·

I suspect that systemd people are looking at this thread in perplexity, and probably doing their thing (that I've seen over the years) of regarding the world of

by JdeBP 1y ago

I suspect that systemd people are looking at this thread in perplexity, and probably doing their thing (that I've seen over the years) of regarding the world of Debian as being amazingly behind the times in places. The SSH server being a socket unit with systemd doing all of the socket parallelism-limiting and accepting was one of the earliest examples of socket activation ever given in systemd. It was in one of Lennart Poettering's earliest writings on the subject back in 2011. * https://0pointer.de/blog/projects/inetd.html https://0pointer.de/blog/projects/inetd.html And even that wasn't the earliest discussion of this way of running SSH by a long shot, as this was old news even before systemd was invented. One can go back years earlier than even Barrett's, Silverman's, and Byrnes's SSH: The Secure Shell: The Definitive Guide published in 2005, which is one of many places explaining that lots of options in sshd_config get ignored when SSH is started by something else that does all of the socket stuff. Like inetd. This has been the case ever since it has been possible to put an SSH server together with inetd in "nowait" mode. Some enterprising computer historian might one day find out when the earliest mention of this was. It might even be in the original 1990s INSTALL file for SSH.

rodgerd 1y ago
As you say, network programs activating from a master network management is, of course, the history of Unix. It's ironic to see knee-jerk complaints about it.
roryirvine 1y ago
The original SSH server was daemonized by default, but inetd operation was always supported. The INSTALL file said this in 1995: The server is not started using inetd, because it needs to generate the RSA key before serving the connection, and this can take about a minute on slower machines. On a fast machine, and small (breakable) key size (< 512 bits) it may be feasible to start the server from inetd on every connection. The server must be given "-i" flag if started from inetd. And, of course, SSH was designed to replace rlogin and rsh - both of which ran from inetd as standard. As you say, socket-activation of sshd is simply following very long-standing Unix practice: it's not at all novel, and there's no reason to believe that it's any more risky than any other method of running it.

by JdeBP 1y ago

rodgerd 1y ago

As you say, network programs activating from a master network management is, of course, the history of Unix. It's ironic to see knee-jerk complaints about it.

roryirvine 1y ago

The original SSH server was daemonized by default, but inetd operation was always supported. The INSTALL file said this in 1995: The server is not started using inetd, because it needs to generate the RSA key before serving the connection, and this can take about a minute on slower machines. On a fast machine, and small (breakable) key size (< 512 bits) it may be feasible to start the server from inetd on every connection. The server must be given "-i" flag if started from inetd. And, of course, SSH was designed to replace rlogin and rsh - both of which ran from inetd as standard. As you say, socket-activation of sshd is simply following very long-standing Unix practice: it's not at all novel, and there's no reason to believe that it's any more risky than any other method of running it.