Dear Maintainer,

I configured SSH with a static IPv6 ListenAddress.
During bootup, SSH tries to start before the IPv6 address has been fully bound to the host (ie during duplicate address detection)
This results in SSH failing to start with "Cannot bind any address" and a return code of 255.
The systemd unit file for ssh contains "RestartPreventExitStatus=255" which causes it to give up when it encounters this error.
In a cloud environment this is a critical failure as it renders the host inaccessible.
The same thing occurs if the static IPv6 address is assigned a different way (eg via SLAAC or DHCPv6)
If you remove this line, systemd tries again and succeeds once the address has been bound to the host. I generally also add "StartSec=15s" to prevent it trying too frequently.
This manual change is not persistent, as it gets overwritten next time you update the package.

I suggest that in such unusual configurations you should use the After=
directive in the [Unit] section to ensure that ssh.service doesn't start
until the relevant other systemd unit has been started.  You can do this
in a way that persists across upgrades using a drop-in unit; see "man
systemd.unit" or use "systemctl edit ssh.service".

However, a simpler solution might well be to remove ListenAddress and
instead use firewall rules to restrict incoming SSH connections to only
the desired address(es), as is recommended in README.Debian.

Hallo Colin Watson,

13.02.24 14:30 Colin Watson:

In some cases sshd just must not listen on wildcard.
Also consider the combination of another service listening on some IP
addresses :22 and sshd on some other addresses :22 with the possibility that
some of those IP addresses just will not come up for some reason and you want
to access the host via already-up addresses to investigate/fix.

Therefore a solution using IP_FREEBIND is preferable IMO.

@Colin: what do you think about merging these two bugs and closing them by
adding ssh@.socket?


Grüße
Timo

Thanks for the info on making a persistent change, this is helpful as a workaround for now.

I had previously tried to make it start after networking or networkmanager, without success. It seems it doesn’t wait for DAD.

It would be better if SSHD didn’t give up in scenarios like this, and kept retrying to start. For hosts without physical access, a lack of SSHD can be a big problem.

Firewall rules are not always desirable, as enabling the firewall (and especially conntrack) can incur a significant performance hit, or introduce other problems. Systems acting as routers, or being used for network scanning for example.

There are also other reasons to bind to specific addresses, for instance if you want to run something else on the same port but a different address.

In any case binding to a specific address is a documented feature of OpenSSH, so it should be usable.