From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: bug#37309: [PATCH] services: openssh: Restrict to IPv4. Date: Tue, 3 Dec 2019 15:12:51 -0500 Message-ID: <180aa2dee4e1da7fe915c85b90b1f60edd04f23d.1575403967.git.leo@famulari.name> References: <87ef0u2867.fsf@roquette.mug.biscuolo.net> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Return-path: Received: from eggs.gnu.org ([2001:470:142:3::10]:58521) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1icEal-0007jL-3B for bug-guix@gnu.org; Tue, 03 Dec 2019 15:16:22 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1icEae-0005oO-CX for bug-guix@gnu.org; Tue, 03 Dec 2019 15:16:10 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:35135) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1icEab-0005ez-9p for bug-guix@gnu.org; Tue, 03 Dec 2019 15:16:06 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1icEaY-0005SU-3f for bug-guix@gnu.org; Tue, 03 Dec 2019 15:16:02 -0500 In-Reply-To: <87ef0u2867.fsf@roquette.mug.biscuolo.net> Sender: "Debbugs-submit" Resent-Message-ID: List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: 37309@debbugs.gnu.org This works around . * gnu/services/ssh.scm ()[address-family]: New field. (openssh-config-file): Use it. * doc/guix.texi: Document it. --- doc/guix.texi | 10 ++++++++++ gnu/services/ssh.scm | 16 +++++++++++++++- 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/doc/guix.texi b/doc/guix.texi index 39eb25385c..cf0e141baf 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -13913,6 +13913,16 @@ This is a symbol specifying the logging level: @code{quiet}, @code{fatal}, @code{error}, @code{info}, @code{verbose}, @code{debug}, etc. See the man page for @file{sshd_config} for the full list of level names. +@item @code{address-family} (default: @code{'inet}) +This is a symbol specifying which type of internet addresses should be +handled by @command{sshd}. The options are @code{inet} (IPv4), +@code{inet6} (IPv6), or @code{any}, which selects both @code{inet} and +@code{inet6}. The upstream default in @code{any}. However, we +currently default to @code{inet} due to a nondeterministic +@command{sshd} startup failure when using IPv6 on Guix. See +@uref{https://issues.guix.info/issue/30993, the bug report} for more +information on this temporary limitation. + @item @code{extra-content} (default: @code{""}) This field can be used to append arbitrary text to the configuration file. It is especially useful for elaborate configurations that cannot be expressed diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm index d2dbb8f80d..7e25810eff 100644 --- a/gnu/services/ssh.scm +++ b/gnu/services/ssh.scm @@ -4,6 +4,7 @@ ;;; Copyright © 2016 Julien Lepiller ;;; Copyright © 2017 Clément Lassieur ;;; Copyright © 2019 Ricardo Wurmus +;;; Copyright © 2019 Leo Famulari ;;; ;;; This file is part of GNU Guix. ;;; @@ -340,7 +341,16 @@ The other options should be self-descriptive." ;; proposed in . Keep it internal/undocumented ;; for now. (%auto-start? openssh-auto-start? - (default #t))) + (default #t)) + + ;; Symbol + ;; XXX: This shouldn't be required, but due to limitations with IPv6 + ;; on Guix, sshd often fails to start when it attempts to bind to both + ;; 0.0.0.0 and ::, because the IPv6 interface is not ready in time. + ;; Accepted options are inet (IPv4), inet6 (IPv6), or any (both). + ;; + (address-family openssh-configuration-address-family + (default 'inet))) (define %openssh-accounts (list (user-group (name "sshd") (system? #t)) @@ -468,6 +478,10 @@ of user-name/file-like tuples." (symbol->string (openssh-configuration-log-level config)))) + (format port "AddressFamily ~a\n" + #$(symbol->string + (openssh-configuration-address-family config))) + ;; Add '/etc/authorized_keys.d/%u', which we populate. (format port "AuthorizedKeysFile \ .ssh/authorized_keys .ssh/authorized_keys2 /etc/ssh/authorized_keys.d/%u\n") -- 2.24.0