[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <bd7c5319-8048-4dcf-b679-5e0355551650@posteo.org>
Date: Tue, 30 Dec 2025 07:23:12 +0000
From: wish42offcl98@...teo.org
To: oss-security@...ts.openwall.com
Subject: Systemd vsock sshd
I have searched for that - instead of blacklisting the vsock module, I
did myself two measures:
- systemctl mask --now sshd-unix-local.socket
to kill and mask the sshd unix socket created by that generator,
- systemctl mask sshd-vsock.socket
to mask the sshd vsock created by that generator (use --now if the
socket has started or use systemctl stop... ).
Though, vsock untested but I found that source mentioning that socket.
https://linux-audit.com/system-administration/commands/systemd-analyze/
Masking the sockets should stop them from starting again.
The vsock kernel module should not be blacklisted if some hypervisor
features are required:
https://libvirt.org/ssh-proxy.html
https://wiki.qemu.org/Features/VirtioVsock
Greetings
Alex
On 12/29/25 05:11, Jacob Bachmeyer wrote:
> On 12/27/25 21:46, Greg Dahlman wrote:
>> [...]
>>
>> **Systemd v256 change** - When the *openssh-server* package is
>> installed on a VM with vsock support, systemd now automatically
>> starts an *sshd* instance that listens on the **af_vsock** socket in
>> the **global network namespace** without any manual configuration.
>
> Obvious question: what manual configuration is required to kill that
> listener?
>
>
> -- Jacob
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
