Unix socket support for sshd

[Mantas Mikulėnas]

Note that the daemon management service (what systemd's pid 1 provides)
needs some way to communicate to the spawned daemon which file
descriptors it has inherited should be treated as listeners. for
systemd, this is a contiguious block of file descriptors starting at fd
3 (SD_LISTEN_FDS_START), and the enviornment variable LISTEN_FDS is a
decimal number indicating how many file descriptors to use for listening
(see sd_listen_fds(3) from libsystemd for more detail).
A reasonable approach that would avoid linking in libsystemd might be to
just specify something like ListenFDs N:M (meaning file descriptors N
through M are sockets you should listen on). (perhaps -L N:M on the
command line, so that the config file could stay static and the spawning
daemon manager could dynamically adjust the invocation as sockets were
added or removed)
--dkg

FWIW, for single-socket configurations, systemd also supports the
inetd-compatible style of assigning the socket directly to fd's 0-2 (stdio).

I've tested it with both `sshd -i` in Accept=yes ("nowait") mode, and
with Exim4 in Accept=no ("wait") mode. It works fine with `sshd -i`.

Also, I assume the scary key generation warning in sshd's manpage only
applies to protocol 1?

[Darren Tucker]

On Fri, Feb 19, 2016 at 7:35 PM, Mantas Mikulėnas <***@gmail.com> wrote:
[...]

Post by Mantas Mikulėnas
Also, I assume the scary key generation warning in sshd's manpage only
applies to protocol 1?

Yes. Protocol 2 uses Diffie-Hellman to create the session key and
does not need an ephemeral server key. Damien added some text about 6
months ago to clarify, it currently reads "If SSH protocol 1 is
enabled, sshd should not normally be run from inetd..."