[BUG] SSH service is not restarted in ubuntu 24.04

[GauthierPLM]

Describe the bug
During setup, the ssh service is not properly restarted at the end of the setup process.
If SSH port has been changed, we are locked outside the machine as ufw only allows the new port but sshd is still listening on the old port.

The service name is now ssh and no more sshd, maybe this causes the issue?

To Reproduce

1. Setup a fresh ubuntu 24.04 machine.
2. Change SSH port to 12322 (or any other port)
3. use any as FW_ADMIN value.
4. run ubuntu.sh
5. once completed, try to SSH into the machine -> connection is refused.

Expected behavior

ssh.service should be properly restarted.

System (lsb_release -a):

No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 24.04.1 LTS
Release: 24.04
Codename: noble

[konstruktoid]

Thanks for creating the issue @GauthierPLM, I believe it's fixed now.

[GauthierPLM]

Hi @konstruktoid

I tested again today and while there was no warning about sshd service not being found, the service wasn't restarted and I had to restart it manually.

[konstruktoid]

So the fix didn't work?

[GauthierPLM]

It does not indeed.

[konstruktoid]

Can you try this diff?

diff --git a/scripts/sshdconfig b/scripts/sshdconfig
index 8a971b7..01a22bf 100644
--- a/scripts/sshdconfig
+++ b/scripts/sshdconfig
@@ -170,7 +170,7 @@ function f_sshdconfig {
   chown root:root "$SSHDCONF"
   chmod 0600 "$SSHDCONF"

-  systemctl restart ssh.service
+  bash -it -c 'systemctl restart ssh.service'

   if [[ $VERBOSE == "Y" ]]; then
     systemctl status ssh.service --no-pager

[GauthierPLM]

Tried today at 12h30 on an existing machine (not yet hardened), and the fix didn't solve the issue. The service still listen on port 22:

# ss -tulpn | grep -e 'ssh\|12322'
tcp   LISTEN 0      4096                     *:22              *:*    users:(("sshd",pid=65406,fd=3))

I had to restart the service myself.

[konstruktoid]

don't really have an idea why this is happening, will continue to test

[GauthierPLM]

I don't know if it will help, but the machines are ARN cloud servers from Hetzner, running Ubuntu 24.04.

This is my cloud-init.yaml file:

#cloud-config
users:
  - name: ...
    groups: users, sudo
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    ssh_authorized_keys:
      - ...
package_update: true
package_upgrade: true
write_files:
  - path: /etc/ssh/sshd_config.d/99-custom.conf
    content: |
      PermitRootLogin no
      PasswordAuthentication no
      KbdInteractiveAuthentication no
      ChallengeResponseAuthentication no
      MaxAuthTries 2
      AllowTcpForwarding no
      X11Forwarding no
      AllowAgentForwarding no
      AuthorizedKeysFile .ssh/authorized_keys
      AllowUsers ...
    owner: root:root
    permissions: '0644'
runcmd:
  - reboot

[filisko]

same here... crazy that this is hapenning, i had to restart my server and had downtime on an important service :/

[GauthierPLM]

@filisko until it's fixed, you can restart the SSH service immediately after running the hardening script:

̀ sudo bash ubuntu.sh && sudo systemctl restart ssh.service`

[konstruktoid]

@filisko unless there's an kernel update, you probably don't need to restart your server at all.

@GauthierPLM yeah, I'll see if I can add that some how, haven't really seen another workaround