Есть необходимость запустить сразу два демона sshd на разных портах - 22 и 2022.
Система Ubuntu 20.04.1 LTS
SSH-2.0-OpenSSH_8.2p1
Тк в ubuntu используется systemd, поэтому пробую в systemd это реализовать.
Делал по этой инструкции http://vladimir-stupin.blogspot.com/2013/02/systemd-2-service.html
Скопировал файл sshd с другим именем (sshd_2) , в ту же директорию, где и изначальный sshd находится - /usr/sbin/sshd_2
Создал копии сервис-файла сокет-файла оригиральных sshd в /lib/systemd/system. С изменением sshd на sshd_2 где нужно.
ssh_2.socket и ssh_2@.service скорее всего не нужны для запуска демона, но пусть будут..
/lib/systemd/system/ssh_2.service
[Unit]
Description=OpenBSD Secure Shell server _2
Documentation=man:sshd(8) man:sshd_config(5)
After=network.target auditd.service
ConditionPathExists=!/etc/ssh/sshd_2_not_to_be_run
[Service]
PIDFile=/var/run/sshd_2.pid
EnvironmentFile=-/etc/default/ssh_2
ExecStartPre=/usr/sbin/sshd_2 -t
ExecStart=/usr/sbin/sshd_2 -D $SSHD_2_OPTS
ExecReload=/usr/sbin/sshd_2 -t
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartPreventExitStatus=255
Type=notify
RuntimeDirectory=sshd_2
RuntimeDirectoryMode=0755
[Install]
WantedBy=multi-user.target
Alias=sshd_2.service
/lib/systemd/system/ssh_2.socket
[Unit]
Description=OpenBSD Secure Shell server _2 socket
Before=ssh_2.service
Conflicts=ssh_2.service
ConditionPathExists=!/etc/ssh/sshd_2_not_to_be_run
[Socket]
ListenStream=2022
Accept=yes
[Install]
WantedBy=sockets.target
/lib/systemd/system/ssh_2@.service
[Unit]
Description=OpenBSD Secure Shell server _2 per-connection daemon
Documentation=man:sshd(8) man:sshd_config(5)
After=auditd.service
[Service]
EnvironmentFile=-/etc/default/ssh_2
ExecStart=-/usr/sbin/sshd_2 -i $SSHD_2_OPTS
StandardInput=socket
RuntimeDirectory=sshd_2
RuntimeDirectoryMode=0755
Копия настроек для ssh. Добавил путь к конфигу sshd_config_2
/etc/default/ssh_2
SSHD_2_OPTS=’ -f /etc/ssh/sshd_config_2’
Скопировал текущий конфиг для 22 порта, поменял порт на 2022:
/etc/ssh/sshd_config_2
Port 2022
PidFile /run/sshd_2.pid
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 120
PermitRootLogin prohibit-password
StrictModes yes
PubkeyAuthentication yes
#AuthorizedKeysFile %h/.ssh/authorized_keys
IgnoreRhosts yes
HostbasedAuthentication no
#IgnoreUserKnownHosts yes
PermitEmptyPasswords no
ChallengeResponseAuthentication no
PasswordAuthentication no
X11Forwarding yes
X11DisplayOffset 10
PrintMotd yes
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no
#MaxStartups 10:30:60
#Banner /etc/issue.net
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
UsePAM yes
ClientAliveInterval 60
UseDNS no
Копия настроек аутентификации - без изменений
/etc/pam.d/sshd_2
# PAM configuration for the Secure Shell service
# Standard Un*x authentication.
@include common-auth
# Disallow non-root logins when /etc/nologin exists.
account required pam_nologin.so
# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account required pam_access.so
# Standard Un*x authorization.
@include common-account
# SELinux needs to be the first session rule. This ensures that any
# lingering context has been cleared. Without this it is possible that a
# module could execute code in the wrong domain.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
# Set the loginuid process attribute.
session required pam_loginuid.so
# Create a new session keyring.
session optional pam_keyinit.so force revoke
# Standard Un*x session setup and teardown.
@include common-session
# Print the message of the day upon successful login.
# This includes a dynamically generated part from /run/motd.dynamic
# and a static (admin-editable) part from /etc/motd.
session optional pam_motd.so motd=/run/motd.dynamic
session optional pam_motd.so noupdate
# Print the status of the user's mailbox upon successful login.
session optional pam_mail.so standard noenv # [1]
# Set up user limits from /etc/security/limits.conf.
session required pam_limits.so
# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
session required pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
session required pam_env.so user_readenv=1 envfile=/etc/default/locale
# SELinux needs to intervene at login time to ensure that the process starts
# in the proper default security context. Only sessions which are intended
# to run in the user's context should be run after this.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
# Standard Un*x password updating.
@include common-password
Вроде все файлы, которые добавил .
Дальше стандартно :
systemctl daemon-reload перезагрузили файлы
systemctl enable ssh_2 разрешили демон для автозапуска
@@@@@@@@@@@@
Теперь проблемы ((( Если остановить ssh_2 -
systemctl stop ssh_2
все как и должно быть. ssh_2 останавливается, ssh продолжает работать. К 22 порту подключиться можно, к 2022 нельзя
systemctl status ssh
● ssh.service - OpenBSD Secure Shell server
Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)
Active: active (running) since Wed 2021-01-13 13:15:36 MSK; 8h ago
Docs: man:sshd(8)
man:sshd_config(5)
Process: 1034 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)
Main PID: 1074 (sshd)
Tasks: 1 (limit: 655)
Memory: 5.0M
CGroup: /system.slice/ssh.service
└─1074 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
systemctl status ssh_2
● ssh_2.service - OpenBSD Secure Shell server _2
Loaded: loaded (/lib/systemd/system/ssh_2.service; enabled; vendor preset: enabled)
Active: inactive (dead) since Wed 2021-01-13 22:00:46 MSK; 2min 24s ago
Docs: man:sshd(8)
man:sshd_config(5)
Process: 1035 ExecStartPre=/usr/sbin/sshd_2 -t (code=exited, status=0/SUCCESS)
Process: 1075 ExecStart=/usr/sbin/sshd_2 -D $SSHD_2_OPTS (code=exited, status=0/SUCCESS)
Main PID: 1075 (code=exited, status=0/SUCCESS)
ps -A | grep sshd
1074 ? 00:00:00 sshd
11712 ? 00:00:00 sshd
11786 ? 00:00:00 sshd
Если же остановить ssh,
systemctl stop ssh
то после этого нельзя подключиться к серверу до перезагрузки, что там происходит, посмотреть не могу. Вот вывод статусов до откючения от ssh
systemctl status ssh
● ssh.service - OpenBSD Secure Shell server
Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)
Active: inactive (dead) since Wed 2021-01-13 22:08:49 MSK; 10s ago
Docs: man:sshd(8)
man:sshd_config(5)
Process: 1034 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)
Process: 1074 ExecStart=/usr/sbin/sshd -D $SSHD_OPTS (code=exited, status=0/SUCCESS)
Main PID: 1074 (code=exited, status=0/SUCCESS)
Jan 13 22:08:49 systemd[1]: Stopping OpenBSD Secure Shell server...
Jan 13 22:08:49 sshd[1074]: Received signal 15; terminating.
Jan 13 22:08:49 systemd[1]: ssh.service: Succeeded.
Jan 13 22:08:49 systemd[1]: Stopped OpenBSD Secure Shell server.
systemctl status ssh_2
● ssh_2.service - OpenBSD Secure Shell server _2
Loaded: loaded (/lib/systemd/system/ssh_2.service; enabled; vendor preset: enabled)
Active: active (running) since Wed 2021-01-13 22:08:41 MSK; 2min 12s ago
Docs: man:sshd(8)
man:sshd_config(5)
Process: 11972 ExecStartPre=/usr/sbin/sshd_2 -t (code=exited, status=0/SUCCESS)
Main PID: 11983 (sshd_2)
Tasks: 1 (limit: 655)
Memory: 1.2M
CGroup: /system.slice/ssh_2.service
└─11983 sshd_2: /usr/sbin/sshd_2 -D -f /etc/ssh/sshd_config_2 [listener] 0 of 10-100 >
ps -A | grep sshd в выводе еще есть sshd, потому что я сижу по ssh на сервере
ps -A | grep sshd
11712 ? 00:00:00 sshd
11786 ? 00:00:00 sshd
11983 ? 00:00:00 sshd_2
Все, после завершения текущего сеанса ssh нельзя больше подключиться ни к 22 , ни к 2022 порту...
ssh sss@123.123.123.123 sh: connect to host 123.123.123.123 port 22: Connection refused
ssh sss@123.123.123.123 -p 2022 kex_exchange_identification: read: Connection reset by peer
