From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp12.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms5.migadu.com with LMTPS id 4M85NOBofmKwmAAAbAwnHQ (envelope-from ) for ; Fri, 13 May 2022 16:19:12 +0200 Received: from aspmx1.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp12.migadu.com with LMTPS id KGAgNOBofmLyBQEAauVa8A (envelope-from ) for ; Fri, 13 May 2022 16:19:12 +0200 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 8541D3644B for ; Fri, 13 May 2022 16:19:11 +0200 (CEST) Received: from localhost ([::1]:50974 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1npW8M-0001Ed-7P for larch@yhetil.org; Fri, 13 May 2022 10:19:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:53320) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1npW8E-0001E6-LU for bug-guix@gnu.org; Fri, 13 May 2022 10:19:02 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:50563) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1npW8E-0002HO-2M for bug-guix@gnu.org; Fri, 13 May 2022 10:19:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1npW8D-0006iY-Uc for bug-guix@gnu.org; Fri, 13 May 2022 10:19:01 -0400 X-Loop: help-debbugs@gnu.org Subject: bug#55335: openssh-service no longer listens on IPv6 Resent-From: Christopher Baines Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Fri, 13 May 2022 14:19:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 55335 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: 55335@debbugs.gnu.org Received: via spool by 55335-submit@debbugs.gnu.org id=B55335.165245150325729 (code B ref 55335); Fri, 13 May 2022 14:19:01 +0000 Received: (at 55335) by debbugs.gnu.org; 13 May 2022 14:18:23 +0000 Received: from localhost ([127.0.0.1]:44449 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1npW7L-0006gX-UW for submit@debbugs.gnu.org; Fri, 13 May 2022 10:18:22 -0400 Received: from mira.cbaines.net ([212.71.252.8]:41294) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1npW7K-0006gQ-VY for 55335@debbugs.gnu.org; Fri, 13 May 2022 10:18:07 -0400 Received: from localhost (unknown [IPv6:2a02:8010:68c1:0:54d1:d5d4:280e:f699]) by mira.cbaines.net (Postfix) with ESMTPSA id D905D27BBE9 for <55335@debbugs.gnu.org>; Fri, 13 May 2022 15:18:05 +0100 (BST) Received: from felis (localhost [127.0.0.1]) by localhost (OpenSMTPD) with ESMTP id a95c4463 for <55335@debbugs.gnu.org>; Fri, 13 May 2022 14:18:03 +0000 (UTC) References: <87r153q913.fsf@cbaines.net> User-agent: mu4e 1.6.10; emacs 27.2 From: Christopher Baines Date: Fri, 13 May 2022 13:21:47 +0100 In-reply-to: <87r153q913.fsf@cbaines.net> Message-ID: <87ilq9qzxg.fsf@cbaines.net> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-guix@gnu.org List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+larch=yhetil.org@gnu.org Sender: "bug-Guix" X-Migadu-Flow: FLOW_IN X-Migadu-To: larch@yhetil.org X-Migadu-Country: US ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1652451551; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type:resent-cc:resent-from:resent-sender: resent-message-id:in-reply-to:in-reply-to:references:references: list-id:list-help:list-unsubscribe:list-subscribe:list-post; bh=NKEVcWQ5C2G6LM/FAGnGzMF96MgOcVOkI72nU/mw4+w=; b=UhvlqkFIUKo4R+FVUvAfDIZULh9OeEbDBv1QTIc6UmTQe5LZqWUgmw1Z5Wq1/mweMPtems f+1Kecp2bkGDwAqhdpfKVrpDzQJJ9ZT0QgAnVmaJ8HuZG73rrKaER+9zAxBZYCnKjf2O0r hXfCzwUwB3aJZvY/rxGWQZ3Lw+GhYovTTOq4bWPLL+SFMrgBkuJ3kg6N+e/PRGiAbDzyBT ErDP6QmTiBgh7ybuPrdLsqQ3NHWjNBCJuHmxK9Vvlyh6YlzSaNqyV7u242/WOfJnzzHDbu U1g9GMZpc5L04D4UwFlOdhfLzhFM6ZKT6rxjhxD90PtyQjuDyMtd7eKti3fGYg== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1652451551; a=rsa-sha256; cv=none; b=hypOORkw2gGAkIADVAFL7y2jbIBkF2d4GyQrOQoyQWh6HKOrSJgv1LL/QYbtbAhMp4KcAU 6ZZ4X1shmDeKgY1+wOIUJvWhGsGfWnFQTRus9ebE/10DmdD/HwjVygSHVsNF967IwcNhaR ThwWkBLT6iyUXiWnWZfHh1phNbIGEWhr7nDpFpiZgeLnWEPD45bpP2EZI1sQYjJuIMiRAm 32afjIw7b3rB2i4/5m04WzjyLu+/jS7iU546/9ttp3aY6/DZ+IUFBn5x/DJ9t5po+kE4W+ Z2ucClPMQ9ZZgPbQwsuRAZG9cixdUAYScGzlWnD6/oivVyAsG7egjA1tfu7fXw== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=none; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "bug-guix-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="bug-guix-bounces+larch=yhetil.org@gnu.org" X-Migadu-Spam-Score: -5.13 Authentication-Results: aspmx1.migadu.com; dkim=none; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "bug-guix-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="bug-guix-bounces+larch=yhetil.org@gnu.org" X-Migadu-Queue-Id: 8541D3644B X-Spam-Score: -5.13 X-Migadu-Scanner: scn1.migadu.com X-TUID: jBDnAZegCvRF --=-=-= Content-Type: text/plain Christopher Baines writes: > This looks to be a recent regression, probably connected with the > shepherd now doing the listening, rather than sshd itself. > > Previously, you could use both IPv4 and IPv6. > > netstat -tlnp | grep sshd > tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 26683/sshd: /gnu/st > tcp6 0 0 :::22 :::* LISTEN 26683/sshd: /gnu/st > > Now though, it looks like with shepherd doing the listening, you can > only use IPv4. > > netstat -tlnp | grep 22 > tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1/guile > > > On an affected machine, you can reproduce this by trying to SSH over v6. > > cbaines@lakeside ~$ ssh 127.0.0.1 > The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established. > ED25519 key fingerprint is SHA256:1wV7w84awrGv5ilP5e8k5ygIvSkXSJ6LIy3MnqZG2Jw. > This key is not known by any other names > Are you sure you want to continue connecting (yes/no/[fingerprint])? ^C > > cbaines@lakeside ~$ ssh ::1 > ssh: connect to host ::1 port 22: Connection refused > > > This isn't an issue if you're not using IPv6, but if you have a machine > only accessible via IPv6, then you can't ssh in. The main workaround > I've found is getting access via other means, then starting sshd > listening on a different port (as the shepherd is using 22). I've had another look at how this might be fixed. One workaround that seems to work is having the service just listen on an IPv6 socket as I believe Linux translates IPv4 connections to IPv6. The openssh system test seems to pass, and I believe this would fix not being able to connect over IPv6, although it seems likely that this would break things relying on IPv4 usage, like configuration based on specific IP addresses. I think the more rigerous approach would be to have shepherd listen on two sockets, one for IPv4 and another for IPv6. That's currently difficult though because of the above behaviour, the IPv6 socket blocks opening the IPv4 one. I've got a patch [1] to Guile that adds the constants needed for the setsockopt call and once that's possible, I believe the setsockopt call would need to happen in make-inetd-constructor. 1: https://lists.gnu.org/archive/html/guile-devel/2022-05/msg00007.html Without reverting to the previous behaviour, maybe the best way forward is to at least allow having the service listen via IPv6. That would mean those affected by the loss of IPv6 support could enable it, and would hopefully avoid breaking anyones configuration where they're relying on native IPv4 connections. I'll send a patch for this shortly. Chris --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQKlBAEBCgCPFiEEPonu50WOcg2XVOCyXiijOwuE9XcFAmJ+aJtfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDNF ODlFRUU3NDU4RTcyMEQ5NzU0RTBCMjVFMjhBMzNCMEI4NEY1NzcRHG1haWxAY2Jh aW5lcy5uZXQACgkQXiijOwuE9XeZZg/+P1lC9/Uv7yOFmkjyydmCWbRp5oCbG1pE HM08CzQWuzflKvmNYHj/yUoCMdEksW1HCbhax7P/63putmmtlE1mWShbH6+uyY5R cX4JJOmVcGfj3zmOXTkqezUBJOvCBt90vrrrvgA4380CP0oNQBwpaKDXBzDYMGCX DVGXmrUE+XEeDr4RQXOG4Jut/uOM6Aq786ebw7yQlxIfTQLYrJfV9TpnX/LX9zdL eoImRPsIxVD+b5PPBGfa2X5yuhViiCHn9DpUQ2chojkGVgUw9WmCrn/EyPR/WhDQ 0j+KrCOowcrP6m7L4Wh56/9OH+5FKGXz+jJa6wrMXAXHR9YqlT4D1fj20TuIAJ/X C7hkJDrCP3jabNYvHQPaY+uuY/BVQnqhEUDA/wVSbGU+FMKl5rKibRfdXFbOxZ7/ tCafzI+u51K1GeWaZuyporme08E7srCWMfRMCAqOj9ZkUdB/eUV6zf2az6wrqovK CxUWYEANYC2kpBKwoIbtfXKxniJoto6U3SISyNBVuvbfCTkkseRprn9TBPxOFBiQ 2FsI4byadec/yPhxGLmaILhyBWmf8B4S9nT96DxanOwtT7r45DshdlxtKOt3XWHx Q5cMn/Vdf/EIk64MHAmwIbKhqdlBjBMSz4TwEveBK8JS+YWlUkJi2CbKgo012wXw 9QkM2tQrOos= =PRe5 -----END PGP SIGNATURE----- --=-=-=--