Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

fosstodon.org

Post reply on HN
Print view View original

31–40 of 62 posts

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#31

Post by TimeBearingDown »

VancouverMan wrote: post #29
HackerThemAll wrote: post #25

Earlier quoted context omitted.

Bravo. On BSD somehow OpenSSH doesn't require systemd, but on Linux it did. Magic.

As a Debian user since the 1990s, this situation has once again made me thankful that I've moved important systems I'm responsible for away from Debian and over to OpenBSD and FreeBSD whenever possible. Even if Debian wasn't perfect before systemd was introduced, at least I knew there was a very high probability that I could trust it to function well. That stopped being the case after systemd was introduced. I've had…

It’s interesting you say that? It runs completely counter to my experience coming from the “BSD-style” rc.d init Arch used to use, and migrating to systemd.

Any specific issues? I didn’t see any. No offense. One factor may be that Arch prioritizes not patching upstream - helped save them from targeting here, and it doesn’t go overboard with default configs, which I’ve long appreciated.

Not to distro-war, I’m very grateful for Debian. My background is finding Linux in the mid-00s and breaking many SuSE, Ubuntu, and one or two Debian systems before finding something I could understand, repair, and maintain in 2008 Arch.

systemd accentuated its ability to stay relevant with enterprise Linux, made it even easier to package for, and has been a useful tool in diagnosing service issues and managing bad software for me.

I’m not sure how often it’s posted here but Benno Rice formerly of FreeBSD Core Team has an excellent and amusing discussion of systemd’s technical merits.

https://youtu.be/o_AIw9bGogo

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#32

Post by vimax »

VancouverMan wrote: post #29
HackerThemAll wrote: post #25

Earlier quoted context omitted.

Bravo. On BSD somehow OpenSSH doesn't require systemd, but on Linux it did. Magic.

As a Debian user since the 1990s, this situation has once again made me thankful that I've moved important systems I'm responsible for away from Debian and over to OpenBSD and FreeBSD whenever possible. Even if Debian wasn't perfect before systemd was introduced, at least I knew there was a very high probability that I could trust it to function well. That stopped being the case after systemd was introduced. I've had…

What problems did you have? I really haven't come across problems that were much different than what I had with init.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#33

Post by bartekpacia »

oftenwrong wrote: post #26
exabrial wrote: post #14

Earlier quoted context omitted.

I like parts of systemd very much: units and their sandboxing/isolation/chroot of processes. Many other parts are terrible beyond measure: journald for example. I think the concept of on-demand processes managed by the end manager is a good idea, but systemd is strong arming the services into accepting its philosophy.

What's wrong with journald? I do not know much about it, aside from having to use journalctl to view logs occasionally.

Logs being stored in binary is the main problem, I think.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#34

Post by vimax »

aborsy wrote: post #6
bdd8f1df777b wrote: post #5

Earlier quoted context omitted.

> A back door in the same library is not likely. But libsystemd is not linked to xz only. By removing it, sshd is free of many other potential risks.

Correct, I misread. Still the question remains: what technology could be implemented to mitigate this type of attack (beyond sshd)? For example, Linux sandboxing is poor, and SeLinux is not usually enforced.

Disable calling functions in transitive dependencies, force them to be direct dependencies.

Why should sshd be allowed to call an xz function directly without xz being an immediate dependency.

I'm not sure what all that would entail with the ifunc stuff, but I remember encountering a glibc linking change moving from Red Hat 6 to RH7 that did something similar and broke the build process for some legacy code.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#35

Post by ikekkdcjkfke »

flohofwoe wrote: post #24
metalspoon wrote: post #8

Earlier quoted context omitted.

I pointed out this weakness the other day on the internet. I got attacked by open source software armies.

Please don't throw despicable systemd zealots and honorable open source zealots into the same bucket ;)

Plot twist: systemd zealots were all sockpuppets

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#36

Post by tuna74 »

bartekpacia wrote: post #33
oftenwrong wrote: post #26

Earlier quoted context omitted.

What's wrong with journald? I do not know much about it, aside from having to use journalctl to view logs occasionally.

Logs being stored in binary is the main problem, I think.

You can of course copy them into whatever format you want, systemd has support for syslog style export.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#37

Post by angiosperm »

TomJansen wrote: post #28

If you requested this 5 years ago every would think you were crazy... Same as the suckless people. They were right after all.

Seems like the code they added in place of the call to the huge libsystemd should be in a little library that all the other programs that need to perform systemd_notify may use. Seems like systemd should ship that library, or split out the part of their massive (789981 bytes in the text section) library that does just that bit. And probably split out other parts.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#38

Post by angiosperm »

jbverschoor wrote: post #27
HackerThemAll wrote: post #25

Earlier quoted context omitted.

Bravo. On BSD somehow OpenSSH doesn't require systemd, but on Linux it did. Magic.

Why would it require even systemd?

Systemd manages daemons. Sshd is a daemon. It knows when sshd has finished starting up, in case something else is waiting on that, and if it dies, and whether it needs to be shut down. If systemd didn't do it, something else would.

That is not to say systemd isn't a hypertrophied pig, but it does do important work.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#39

Post by angiosperm »

klysm wrote: post #23
tomohawk wrote: post #10

Earlier quoted context omitted.

That is the systemd way, and what many of us have pointed out for years as a major risk of the approach.

I have never seen anybody point to it as a security risk before this happened. Would be happy to see a reference of somebody saying that prior to the xz event

Report is that shortly before the hole was reported, a PR had been posted requesting to remove the dependency on xz.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#40

Post by frankharv »

tuna74 wrote: post #36
bartekpacia wrote: post #33

Earlier quoted context omitted.

Logs being stored in binary is the main problem, I think.

You can of course copy them into whatever format you want, systemd has support for syslog style export.

Versus the logical dmesg|grep {what you are looking for} or tail -n 30 /var/log/messages.
Post reply on HN