Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add note about socket-based SSH in "Securing the SSH service" #1052

Merged
merged 2 commits into from
Jan 23, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 55 additions & 0 deletions tutorials/securing-ssh/01.de.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,61 @@ Dabei werden die folgenden Punkte genauer erläutert:

**Voraussetzungen**
+ SSH Dienst basierend auf OpenSSH
+ Traditionelles SSH

Dieses Tutorial erklärt, wie man die Datei `/etc/ssh/sshd_config` bearbeitet, die vom traditionellen SSH verwendet wird.

Wenn Ihr System Socket-basiertes SSH verwendet (Ubuntu 22.10 und höher) und Sie trotzdem diesem Tutorial folgen möchten, müssen Sie `ssh.socket` deaktivieren und `ssh.service` manuel aktivieren.

<blockquote>
<details>
<summary>Hier klicken für Beispiel-Befehle, um <kbd>ssh.socket</kbd> zu deaktivieren und <kbd>ssh.service</kbd> zu aktivieren</summary>

```bash
sudo systemctl stop ssh.socket
sudo systemctl disable ssh.socket

sudo systemctl start ssh.service
sudo systemctl enable ssh.service

sudo systemctl restart ssh
```

</details>
</blockquote>

### Prüfen ob traditionelles SSH oder Socket-basiertes SSH verwendet wird

Führen Sie folgenden Befehl aus und prüfen Sie den Output:

```bash
sudo systemctl status ssh
```

* **Traditional SSH**

Der SSH Service (`ssh.service`) wird automatisch beim Systemboot von systemd gestartet.
```shellsession
holu@example-server:~# sudo systemctl status ssh
● ssh.service - OpenBSD Secure Shell server
Loaded: loaded (/usr/lib/systemd/system/ssh.service; enabled; preset: enabled)
Active: active (running)
```
In `Loaded:` steht "enabled".

<br>

* **Socket-Based SSH**

Der SSH Service (`ssh.service`) wird von `ssh.socket` erst gestartet, wenn die erste Verbindungsanfrage reinkommt.
```shellsession
holu@example-server:~# sudo systemctl status ssh
● ssh.service - OpenBSD Secure Shell server
Loaded: loaded (/usr/lib/systemd/system/ssh.service; disabled; preset: enabled)
Active: active (running)
TriggeredBy: ● ssh.socket
```
In `Loaded:` steht "disabled" und der Output enthält die zusätzliche Zeile `TriggeredBy: ssh.socket`.

## Schritt 1 - Absicherung des SSH Dienstes

Expand Down
55 changes: 55 additions & 0 deletions tutorials/securing-ssh/01.en.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,61 @@ The following points are explained in more detail:

**Prerequisites**
+ SSH service based on OpenSSH
+ Traditional SSH

This tutorial explains how to edit `/etc/ssh/sshd_config`, which is used by traditional SSH.

If your system uses socket-based SSH (Ubuntu 22.10 and higher) and you still want to follow this tutorial, you will need to disable `ssh.socket` and manually enable `ssh.service`.

<blockquote>
<details>
<summary>Click here for commands to disable <kbd>ssh.socket</kbd> and enable <kbd>ssh.service</kbd></summary>

```bash
sudo systemctl stop ssh.socket
sudo systemctl disable ssh.socket

sudo systemctl start ssh.service
sudo systemctl enable ssh.service

sudo systemctl restart ssh
```

</details>
</blockquote>

### Check if your system uses traditional SSH or socket-based SSH

Run the following command and check the output:

```bash
sudo systemctl status ssh
```

* **Traditional SSH**

The SSH service (`ssh.service`) is automatically started during system boot by systemd.
```shellsession
holu@example-server:~# sudo systemctl status ssh
● ssh.service - OpenBSD Secure Shell server
Loaded: loaded (/usr/lib/systemd/system/ssh.service; enabled; preset: enabled)
Active: active (running)
```
In `Loaded:`, it will say "enabled".

<br>

* **Socket-Based SSH**

The SSH service (`ssh.service`) is started by `ssh.socket` when the first connection request comes in.
```shellsession
holu@example-server:~# sudo systemctl status ssh
● ssh.service - OpenBSD Secure Shell server
Loaded: loaded (/usr/lib/systemd/system/ssh.service; disabled; preset: enabled)
Active: active (running)
TriggeredBy: ● ssh.socket
```
In `Loaded:`, it will say "disabled", and the output will also include the line triggered by `ssh.socket`.

## Step 1 - Securing the SSH service

Expand Down
Loading