Bug 1768712

Summary:	sshd service starts before network is fully up
Product:	Red Hat Enterprise Linux 8	Reporter:	Akshay Jain <akjain>
Component:	openssh	Assignee:	Jakub Jelen <jjelen>
Status:	CLOSED NOTABUG	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	8.0	CC:	mjahoda, tmraz
Target Milestone:	rc
Target Release:	8.0
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-11-05 10:02:22 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 1 Jakub Jelen 2019-11-05 09:03:26 UTC

If I understand it right, this behavior is consistent with what was in RHEL7 -- if you configure SSHD to listen on non-default address, you need to modify also the service file (by providing a drop-in configuration) to reflect this.

We certainly do not want to have this by default, since it would needlessly delay the sshd startup (and slow down boot time) on all the other systems, which use defaults.

The correct solution is to add the network-online.target to your service file as described in bug#1352214#c11. This particular solution is described in the RHEL7 docs:

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/s1-ssh-configuration

I tried to find the same reference in the RHEL8 docs, but I did not find it so I think this needs to be added, as this still applies. Mirek?

Comment 2 Mirek Jahoda 2019-11-05 09:46:47 UTC

(In reply to Jakub Jelen from comment #1)
> The correct solution is to add the network-online.target to your service
> file as described in bug#1352214#c11. This particular solution is described
> in the RHEL7 docs:
> 
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/
> html/system_administrators_guide/s1-ssh-configuration
> 
> I tried to find the same reference in the RHEL8 docs, but I did not find it
> so I think this needs to be added, as this still applies. Mirek?

This should be the section you are looking for:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/securing_networks/assembly_using-secure-communications-with-openssh-securing-networks#Starting-OpenSSH-server_configuring-and-managing-security

Comment 3 Jakub Jelen 2019-11-05 10:02:22 UTC

Thank you for the pointer. Then it is non-bug, but documented behavior of the customer configuration.