Live data from Hacker News

Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

fosstodon.org

41–50 of 62 posts

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#41
post #22

Earlier quoted context omitted.

I pointed out this weakness the other day on the internet. I got attacked by open source software armies.

Maybe it was because you weren't pointing out anything new? There was a pull request to stop linking liblzma into libsystemd a month before the backdoor was found https://github.com/systemd/systemd/pull/31550 This was likely one of many things that pushed the attackers to work faster, and forced them into making mistakes.

No. They couldn't get along with the idea that some open source software packages should also sometimes be cut away, just like all other packages.

They felt threatened by the idea that open source maintenance can ever go wrong and started attacking me. They argued closed source was worse.

That was not my point at all. I was not raising a weakness of open source. I was just pointing out that linking to libsystemd had that kind of problem.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#42

If you requested this 5 years ago every would think you were crazy... Same as the suckless people. They were right after all.

> If you requested this 5 years ago every would think you were crazy...

That's a straw man. Nobody was ever pushing for people to import all of libsystemd just to use the communication protocol with systemd, that protocol was designed to be very easy and simple to implement on your own precisely so you didn't have to depend on anything else, libsystemd just happened to provide an implementation too, and somebody was lazy and imported that instead, but I seriously doubt that's what anyone thought was best practice.

Contrary to popular belief, systemd isn't about linking gigantic binaries and libraries together into a giant blob like everyone things (e.g. the standard nonsense line from detractors that e.g. `systemd-resolved` is "part of systemd" as in "part of the same binary", which it isn't), but about just letting programs talk to each other, so that you can get reliable, featureful integration on your desktop instead of everything being a half-working mess of shims and ad hoc communication, and providing a centralized service that can consistently and from first principles solve certain tasks, so that you don't have to have every single daemon reimplementing their own, or a central implementation that's a big pile of preprocessed shell scripts, spinlocks, edge cases, and bullshit.

> Same as the suckless people. They were right after all.

Right about what? Right in myopically judging software quality by "lines of code" and setting nonsensical arbitrary line limits, and as a consequence confusing a (poor) map for the territory, because while, yes, "few lines of code" can make software good in some ways (less buggy, etc), it can also make it quite bad in others (less featureful, doesn't handle edge cases, brittle, annoying to use), or just be completely unrelated? Or finding every possible way to vrware software that most definitely "sucks more" for the vast majority of users that don't randomly happen to perfectly align with it, software that sucks so bad people have to maintain patch lists to make it useable, with all the inherent problems with maintainability and stability over time patches incur?

Suckless is a cargo cult of tradition following a fundamentalist interpretation of its holy texts, refusing to innovate and actually make computing better, stubbornly sticking to a model left unchanged since the 70s, which wasn't even that great back then, and proud of it.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#43
post #6

Earlier quoted context omitted.

> A back door in the same library is not likely. But libsystemd is not linked to xz only. By removing it, sshd is free of many other potential risks.

Correct, I misread. Still the question remains: what technology could be implemented to mitigate this type of attack (beyond sshd)? For example, Linux sandboxing is poor, and SeLinux is not usually enforced.

> what technology could be implemented to mitigate this type of attack (beyond sshd)?

UNIX ? (do one thing and do it well).

When your program links with 20 libraries, i have i very hard time to believe that security is one of your goals.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#44

libsystem is such a bizarre abstraction covering far too much surface area. The name alone is a code smell. Why is the same library used for both internal service management and for services implementing on-demand launches and notifications?

> Why is the same library used for both internal service management and for services implementing on-demand launches and notifications?

Poettering was a Microsoft fan. I guess he designed SystemD like svchost.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#45
post #3
post #2

As per the well known XZ-utils backdoor, we decided to take a step further and drop libsystemd dependency altogether by implementing the missing bits with few small patches (one upstream, the other to be forwarded).

A back door in the same library is not likely. It drew attention and many looked into it. What could be done to prevent supply chain attacks more broadly?

Indeed it's not.

But this implies removing dependencies on various libraries, and keep a such important process small is already relevant, despite the fact that it will load PAM libraries, making it quite still prone to issues.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#46
post #36

Earlier quoted context omitted.

You can of course copy them into whatever format you want, systemd has support for syslog style export.

Versus the logical dmesg|grep {what you are looking for} or tail -n 30 /var/log/messages.

Tell me you never tried

  journalctl | grep {term}
without telling anything.

Also you are probably never worked with a localised distros. Go try your luck at least on a non-Latin one.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#47
post #2

As per the well known XZ-utils backdoor, we decided to take a step further and drop libsystemd dependency altogether by implementing the missing bits with few small patches (one upstream, the other to be forwarded).

Bravo. On BSD somehow OpenSSH doesn't require systemd, but on Linux it did. Magic.

On BSD, OpenSSH doesn't need to detect whether systemd is running or not (that's all that libsystemd does). The answer is always no.

Magic, indeeded.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#48

Earlier quoted context omitted.

That is the systemd way, and what many of us have pointed out for years as a major risk of the approach.

This reads as though your objection is to the scope of systemd rather than its implementation detail, which isn’t where my objection lies. I have nothing against the service management stack also addressing common principles like logging and on-demand starts a la inetd, but the notion that applications should link against a component of the service manager which is also used by the service manager boggles my tiny min…

libsystemd is not being used by systemd itself.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#49

Earlier quoted context omitted.

As a Debian user since the 1990s, this situation has once again made me thankful that I've moved important systems I'm responsible for away from Debian and over to OpenBSD and FreeBSD whenever possible. Even if Debian wasn't perfect before systemd was introduced, at least I knew there was a very high probability that I could trust it to function well. That stopped being the case after systemd was introduced. I've had…

It’s interesting you say that? It runs completely counter to my experience coming from the “BSD-style” rc.d init Arch used to use, and migrating to systemd. Any specific issues? I didn’t see any. No offense. One factor may be that Arch prioritizes not patching upstream - helped save them from targeting here, and it doesn’t go overboard with default configs, which I’ve long appreciated. Not to distro-war, I’m very gra…

> I’m not sure how often it’s posted here but Benno Rice formerly of FreeBSD Core Team has an excellent and amusing discussion of systemd’s technical merits.

IMO he makes a couple good points (and a couple poor ones), but it’s about everything except technical merits. It’s more about social and philosophical aspects.

Re: Ubuntu 24.04 (and Debian) removed libsystemd from SSH server dependencies

#50

Earlier quoted context omitted.

Versus the logical dmesg|grep {what you are looking for} or tail -n 30 /var/log/messages.

Tell me you never tried journalctl | grep {term} without telling anything. Also you are probably never worked with a localised distros. Go try your luck at least on a non-Latin one.

you can just run journalctl -g {term} too lol
Post reply on HN