on upgrade sshd-socket-generator conversion does not respect administrator intent

Is there a strong use case for installing openssh-server, but then not wanting it to run as a daemon (i.e. disabling the necessary systemd units)? The purpose of this snippet is to migrate to socket activated sshd by default, which is the case for new installs of openssh-server.

I'm not that invested in the having openssh-server installed but not running use-case, but in general people do not like their local configuration beeing overridden on package upgrades in this manner.

I could image people having it installed for the man-pages, or maybe using other units for it (per VRF instances or something), having the main service and socket units disabled, but I doubt that happens that much in practice.

For me the biggest problem was the socket unit beeing re-enabled when I had it disabled it but still running sshd.service (ie without socket activation) - now you're unexpectidly switched back to using socket activation - something I explicitly opted out of.

I could also see this causing problems if you have the socket unit masked (dont see why you would want that however) but the the service is enabled, now you are without sshd. Actually I think the postinst would also fail in that case, as systemctl enable fails enabling masked units.

> For me the biggest problem was the socket unit beeing re-enabled when I had it disabled it but still running sshd.service (ie without socket activation) - now you're unexpectidly switched back to using socket activation - something I explicitly opted out of.

Okay. We could probably adjust the check to ignore migration if the user is upgrading from kinetic or newer and has ssh.socket disabled.

> I could also see this causing problems if you have the socket unit masked (dont see why you would want that however) but the the service is enabled, now you are without sshd. Actually I think the postinst would also fail in that case, as systemctl enable fails enabling masked units.

This is a good point as well.

This bug was fixed in the package openssh - 1:9.6p1-3ubuntu13

---------------
openssh (1:9.6p1-3ubuntu13) noble; urgency=medium

  [ Marco Trevisan (Treviño) ]
  * debian: Remove dependency on libsystemd
    As per the xz backdoor we learned that the least dependencies sshd have,
    the best it is, so avoid to plug libsystemd (which also brings various
    other dependencies) inside sshd for no reason:

    - d/p/systemd-readiness.patch: Use upstream patch with no libsystemd
      dependency
    - d/p/systemd-socket-activation.patch: Import patch from debian that
      mimics the libsystemd sd_listen_fds() code, as refactored by Colin
      Watson.
    - d/control: Remove dependencies on libsystemd-dev | libelogind-dev
    - d/rules: Drop --with-systemd flag (new options are used by default)

  [ Nick Rosbrook ]
  * debian/patches: only set PAM_RHOST if remote host is not "UNKNOWN"
    (LP: #2060150)
  * debian/openssh-server.postinst: don't re-enable ssh.socket if it was disabled
    (LP: #2059874)
  * d/p/sshd-socket-generator.patch: do not always ignore ListenStream=22
    (LP: #2059872)

 -- Nick Rosbrook <email address hidden> Fri, 05 Apr 2024 15:30:31 -0400