Before OpenSSH 9.8 an aborted or rejected session always exited with 255. OpenSSH 9.8+ uses new exit codes for the PerSourcePenalties feature, but nothing reads them and they reach systemd.
See srclimit.h[1]: #define EXIT_LOGIN_GRACE 3 /* login grace period exceeded */ #define EXIT_CHILD_CRASH 4 /* preauth child crashed */ #define EXIT_AUTH_ATTEMPTED 5 /* at least one auth attempt made */ #define EXIT_CONFIG_REFUSED 6 /* sshd_config RefuseConnection */ #define EXIT_INVALID_USER 7 /* invalid user supplied */ Systemd reads them as LSB init-script codes. It shows 3, 4, 5, 6 and 7 as NOTIMPLEMENTED, NOPERMISSION, NOTINSTALLED, NOTCONFIGURED and NOTRUNNING. In OpenSSH 10.x, each connection is handled by two server processes: - sshd-session (privileged) - sshd-auth (unprivileged) When sshd-session sees sshd-auth die from a crash signal, it exits with code 4, so don't include that code. [1] https://github.com/openssh/openssh-portable/blob/master/srclimit.h#L33 Signed-off-by: Bruno Thomsen <[email protected]> --- projectroot/usr/lib/systemd/system/[email protected] | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projectroot/usr/lib/systemd/system/[email protected] b/projectroot/usr/lib/systemd/system/[email protected] index 269127c8f..4e582227b 100644 --- a/projectroot/usr/lib/systemd/system/[email protected] +++ b/projectroot/usr/lib/systemd/system/[email protected] @@ -5,7 +5,7 @@ IgnoreOnIsolate=true [Service] ExecStart=/usr/sbin/sshd -i -SuccessExitStatus=0 255 +SuccessExitStatus=0 3 5 6 7 255 StandardInput=socket RuntimeDirectory=sshd RuntimeDirectoryPreserve=yes base-commit: 25578c25031573977db826d12d05156574cc2898 -- 2.53.0
