![ubuntu 16 上自定义构建 openssh-hpn-sshd 的无限激活状态](https://linux22.com/image/95455/ubuntu%2016%20%E4%B8%8A%E8%87%AA%E5%AE%9A%E4%B9%89%E6%9E%84%E5%BB%BA%20openssh-hpn-sshd%20%E7%9A%84%E6%97%A0%E9%99%90%E6%BF%80%E6%B4%BB%E7%8A%B6%E6%80%81.png)
我已经编译了hpn版本的openssh(OpenSSH_7.2p2-hpn14v11),sshd本身工作得很好。问题是 systemd 每 2-3 分钟就会重新启动 sshd,因为它无法正确启动该服务。当我替换为相同版本的 Ubuntu 软件包时,它可以正常工作。我什至在虚拟机上进行了全新安装的测试 - 同样的事情。我究竟做错了什么?
● ssh.service - OpenBSD Secure Shell server Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled) Active: activating (start) since Wed 2016-09-28 20:18:49 EDT; 42s ago Main PID: 24279 (sshd) Tasks: 9 Memory: 6.8M CPU: 164ms CGroup: /system.slice/ssh.service ├─20041 sshd: root@pts/0 ├─20047 -bash ├─24279 /usr/sbin/sshd -D ├─24628 └─24629 pager Sep 28 20:18:49 hostname systemd[1]: Starting OpenBSD Secure Shell server... Sep 28 20:18:49 hostname sshd[24279]: Server listening on 0.0.0.0 port 22
cat /lib/systemd/system/ssh.service
[Unit]
Description=OpenBSD Secure Shell server
After=network.target auditd.service
ConditionPathExists=!/etc/ssh/sshd_not_to_be_run
[Service]
EnvironmentFile=-/etc/default/ssh
ExecStart=/usr/sbin/sshd -D $SSHD_OPTS
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartPreventExitStatus=255
Type=notify
[Install]
WantedBy=multi-user.target
Alias=sshd.service
Logs:
Sep 29 02:22:03 xxx sshd[15007]: Server listening on 0.0.0.0 port 22.
Sep 29 02:22:03 xxx sshd[15007]: Server listening on :: port 22.
Sep 29 02:23:33 xxx systemd[1]: ssh.service: Start operation timed out. Terminating.
Sep 29 02:23:33 xxx systemd[1]: Failed to start OpenBSD Secure Shell server.
Sep 29 02:23:33 xxx systemd[1]: ssh.service: Unit entered failed state.
Sep 29 02:23:33 xxx systemd[1]: ssh.service: Failed with result 'timeout'.
Sep 29 02:23:33 xxx systemd[1]: ssh.service: Service hold-off time over, scheduling restart.
Sep 29 02:23:33 xxx systemd[1]: Stopped OpenBSD Secure Shell server.
Sep 29 02:23:33 xxx systemd[1]: Starting OpenBSD Secure Shell server...
Sep 29 02:23:33 xxx sshd[15775]: Server listening on 0.0.0.0 port 22.
Sep 29 02:23:33 xxx sshd[15775]: Server listening on :: port 22.
答案1
Ubuntu 放弃使用 systemd 方式让 systemd 知道它何时启动。从选项中可以明显看出Type=notify
,没有Systemd补丁就无法使用OpenSSH。有两种可能的解决方案:
将行更改
Type=notify
为Type=forking
并添加一个新行,PIDFile=/var/run/sshd.pid
并且ExecStart
应更改为/usr/sbin/sshd $SSHD_OPTS
:Type=forking PIDFile=/var/run/sshd.pid ExecStart=/usr/sbin/sshd $SSHD_OPTS
使用以下命令构建您的 OpenSSH修补来自 Debian/Ubuntu:
From fe97848e044743f0bac019a491ddf0138f84e14a Mon Sep 17 00:00:00 2001
From: Michael Biebl <[email protected]>
Date: Mon, 21 Dec 2015 16:08:47 +0000
Subject: Add systemd readiness notification support
Bug-Debian: https://bugs.debian.org/778913
Forwarded: no
Last-Update: 2016-01-04
Patch-Name: systemd-readiness.patch
---
configure.ac | 24 ++++++++++++++++++++++++
sshd.c | 9 +++++++++
2 files changed, 33 insertions(+)
diff --git a/configure.ac b/configure.ac
index f822fb3..6cafb15 100644
--- a/configure.ac
+++ b/configure.ac
@@ -4319,6 +4319,29 @@ AC_ARG_WITH([kerberos5],
AC_SUBST([GSSLIBS])
AC_SUBST([K5LIBS])
+# Check whether user wants systemd support
+SYSTEMD_MSG="no"
+AC_ARG_WITH(systemd,
+ [ --with-systemd Enable systemd support],
+ [ if test "x$withval" != "xno" ; then
+ AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
+ if test "$PKGCONFIG" != "no"; then
+ AC_MSG_CHECKING([for libsystemd])
+ if $PKGCONFIG --exists libsystemd; then
+ SYSTEMD_CFLAGS=`$PKGCONFIG --cflags libsystemd`
+ SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd`
+ CPPFLAGS="$CPPFLAGS $SYSTEMD_CFLAGS"
+ SSHDLIBS="$SSHDLIBS $SYSTEMD_LIBS"
+ AC_MSG_RESULT([yes])
+ AC_DEFINE(HAVE_SYSTEMD, 1, [Define if you want systemd support.])
+ SYSTEMD_MSG="yes"
+ else
+ AC_MSG_RESULT([no])
+ fi
+ fi
+ fi ]
+)
+
# Looking for programs, paths and files
PRIVSEP_PATH=/var/empty
@@ -5121,6 +5144,7 @@ echo " libedit support: $LIBEDIT_MSG"
echo " Solaris process contract support: $SPC_MSG"
echo " Solaris project support: $SP_MSG"
echo " Solaris privilege support: $SPP_MSG"
+echo " systemd support: $SYSTEMD_MSG"
echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
echo " BSD Auth support: $BSD_AUTH_MSG"
diff --git a/sshd.c b/sshd.c
index 837409b..868df9e 100644
--- a/sshd.c
+++ b/sshd.c
@@ -85,6 +85,10 @@
#include <prot.h>
#endif
+#ifdef HAVE_SYSTEMD
+#include <systemd/sd-daemon.h>
+#endif
+
#include "xmalloc.h"
#include "ssh.h"
#include "ssh1.h"
@@ -2117,6 +2121,11 @@ main(int ac, char **av)
unsetenv("SSH_SIGSTOP");
}
+#ifdef HAVE_SYSTEMD
+ /* Signal systemd that we are ready to accept connections */
+ sd_notify(0, "READY=1");
+#endif
+
/* Accept a connection and return in a forked child */
server_accept_loop(&sock_in, &sock_out,
&newsock, config_s);
答案2
截至今天,2019-10-28,在 Ubuntu 19.04 上编译 openssh-8.1p1 仍然需要这样做。
您可以在此处找到所需补丁的最新版本:https://salsa.debian.org/ssh-team/openssh/blob/master/debian/patches/systemd-readiness.patch
您还需要安装pkg-config
( apt-get install pkg-config
),否则./configure --with-systemd
将无法识别libsystemd-dev
补丁所需的库。
答案3
sshd
OpenSSH 服务器陷入“激活”状态还有另一个原因。
也就是说,原因可能是“熵耗尽”,它阻止了相关 OpenSSL 模块的初始化。
要验证“熵耗尽”确实是问题所在,请首先停止 OpenSSH 服务,这样它就不再停留在“激活”状态,方法是发出以下命令:
systemctl stop ssh
...停止后sshd
,发出以下命令再次启动它:
/usr/sbin/sshd -ddd
...并观察调试输出是否出现以下消息:
顺便说一句:该-ddd
选项在 OpenSSH 服务启动期间启用详细调试输出。
随机:由于速率限制而错过了 N 个随机警告
如果在发出命令后出现此消息/usr/sbin/sshd -ddd
,则意味着 OpenSSH 服务的 SSL 模块无法初始化,因为熵池已耗尽。
要解决此问题,请发出命令:
apt-get install haveged
..这将安装更快的熵源。您可以阅读更多有关haveged
这里。
这使其成为永久修复。