From 74c292f3412371ace2e9881a5eae7fbaeed2c313 Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Sun, 14 Jun 2026 09:15:37 +0000 Subject: [PATCH] setup.sh: move socket-activated sshd (Ubuntu 24.04) to the admin port MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On Ubuntu 22.10+/24.04 sshd is socket-activated via ssh.socket, which owns the listen port and ignores sshd_config's Port — so the admin-port move silently failed (safety check aborted before freeing :22). Override ssh.socket's ListenStream to ADMIN_SSH_PORT when present; fall back to restarting the service on classic setups. Co-Authored-By: Claude Opus 4.8 --- setup.sh | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/setup.sh b/setup.sh index ea337b4..5a4fe52 100755 --- a/setup.sh +++ b/setup.sh @@ -343,13 +343,26 @@ Port ${ADMIN_SSH_PORT} SSHD # Open the new admin port FIRST so the upcoming firewall enable can't lock us out. ufw allow "${ADMIN_SSH_PORT}/tcp" >/dev/null -if sshd -t; then - systemctl restart ssh 2>/dev/null || systemctl restart sshd +sshd -t || die "sshd config test failed; not restarting (you are not locked out)" + +# Ubuntu 22.10+/24.04 socket-activate sshd via ssh.socket, which OWNS the listen +# port and ignores sshd_config's Port. Override the socket's ListenStream so the +# admin port actually moves; otherwise (classic sshd) just restart the service. +if systemctl cat ssh.socket >/dev/null 2>&1; then + log "ssh is socket-activated (Ubuntu 24.04) — moving the socket to :${ADMIN_SSH_PORT}" + install -d -m 0755 /etc/systemd/system/ssh.socket.d + cat > /etc/systemd/system/ssh.socket.d/10-agentbbs-port.conf </dev/null || systemctl restart sshd fi # Verify the admin port is actually listening before we free :22. -for _ in 1 2 3 4 5; do +for _ in 1 2 3 4 5 6 7 8; do ss -tlnp 2>/dev/null | grep -q ":${ADMIN_SSH_PORT} " && break sleep 1 done