0

By default, ssh binds to 0.0.0.0:22 which obviously works without problem. But now, I added a gitlab docker container to my system (which uses port 22) and so I had to restrict my host ssh service to a single IP:

diff -u /etc/ssh/sshd_config_orig /etc/ssh/sshd_config
--- /etc/ssh/sshd_config_orig   2018-02-10 03:31:46.000000000 +0100
+++ /etc/ssh/sshd_config    2019-04-06 13:39:51.291703794 +0200
@@ -14,6 +14,7 @@
 #AddressFamily any
 #ListenAddress 0.0.0.0
 #ListenAddress ::
+ListenAddress 192.168.1.10

 #HostKey /etc/ssh/ssh_host_rsa_key
 #HostKey /etc/ssh/ssh_host_ecdsa_key

But with this change, my machine doesn't boot properly anymore: netplan (which manages my network configuration as listed below) seems to initialize the network asynchronously while ssh tries to startup but fails because the IP doesn't exist yet in the system.

cat /etc/netplan/01-static-ip.yaml 
network:
  version: 2
  ethernets:
    enp6s0:
      addresses:
        - 192.168.1.10/24
        - 192.168.1.234/24
      gateway4: 192.168.1.1
      nameservers:
        addresses: [192.168.1.223,192.168.1.1]
      dhcp4: no

Now, what's the best approach to add a "network-ready" dependency to the ssh daemon?

My system is a Ubuntu 18.04. As this is a headless server, the sshd is essential.

My current work-around is using a different port, and again using the address 0.0.0.0

0

The standard ssh systemd unit declares:

After=network.target auditd.service

If you need to wait for the network to be up before starting the service, you should change this unit to also be sequenced after network-online.target.

For upgradability, this should be installed as an add-on config file in /etc/systemd/system/ssh.service.d/.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.