Skip to content

ssh.service could never start on a first boot: run the host-key generator before Debian's sshd -t #930

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
VijitSingh97 merged 1 commit into from
Aug 13, 2026
Merged

ssh.service could never start on a first boot: run the host-key generator before Debian's sshd -t #930

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions os/overlay/pithead-ssh-host-keys.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,12 @@
RequiresMountsFor=/data

[Service]
# Runs before sshd loads any HostKey (ExecStartPre entries across merged drop-ins all run, in
# order, ahead of ExecStart — unlike ExecStart itself, which a later drop-in's own ExecStart=
# reset-then-set would otherwise clobber). Generates the key into /data/ssh if missing; a no-op
# after the first boot.
# ORDER IS THE WHOLE FIX HERE. Drop-in ExecStartPre entries APPEND after the main unit's, and
# Debian's ssh.service already carries `ExecStartPre=/usr/sbin/sshd -t` — a config test that
# fails with "no hostkeys available" while /data/ssh is still empty. Appended, our generator
# ran second and never got its turn: on a first boot ssh.service could not start at all (found
# by the KVM battery — every _ssh leg dead). Reset the list, generate first, then re-run the
# distro's own test; the image is frozen, so restating its line cannot drift.
ExecStartPre=
ExecStartPre=/usr/local/sbin/pithead-ssh-host-keys
ExecStartPre=/usr/sbin/sshd -t
8 changes: 8 additions & 0 deletions tests/os/verify-image.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,6 +247,14 @@ chk "machine-id ships empty (systemd's own read-only-root first-boot semantics)"
chk "SSH host-key generator baked and executable" '[ -x "$ROOT/usr/local/sbin/pithead-ssh-host-keys" ]'
chk "ssh.service host-key drop-in orders after /data" \
'grep -q "RequiresMountsFor=/data" "$ROOT/etc/systemd/system/ssh.service.d/pithead-host-keys.conf"'
# Debian's own unit runs `sshd -t` as ExecStartPre, and drop-in entries APPEND — without the
# reset, the config test runs before the generator, finds no key on a first boot, and
# ssh.service can never start (KVM-battery find). The reset line + generator-first order is
# load-bearing, so pin all three lines and their order.
chk "host-key generator runs BEFORE the distro's sshd -t (reset + reorder)" \
'[ "$(grep "^ExecStartPre" "$ROOT/etc/systemd/system/ssh.service.d/pithead-host-keys.conf" | head -1)" = "ExecStartPre=" ] &&
grep -qxF "ExecStartPre=/usr/local/sbin/pithead-ssh-host-keys" "$ROOT/etc/systemd/system/ssh.service.d/pithead-host-keys.conf" &&
grep -qxF "ExecStartPre=/usr/sbin/sshd -t" "$ROOT/etc/systemd/system/ssh.service.d/pithead-host-keys.conf"'
chk "sshd points at the /data host key" \
'grep -q "^HostKey /data/ssh/ssh_host_ed25519_key" "$ROOT/etc/ssh/sshd_config.d/pithead-host-keys.conf"'
chk "machine-id restore script baked and executable" '[ -x "$ROOT/usr/local/sbin/pithead-machine-id" ]'
Expand Down