Make unique dynamic user for each ssh connection and improve doc

Disallow public access the ssh socket
Enable Restart for ssh service
2025-07-27 22:00:03 -04:00 · 2025-07-27 21:02:23 -04:00 · 2025-05-22 12:44:30 -04:00
2 changed files with 12 additions and 1 deletions
--- a/nnss-ssh@.service
+++ b/nnss-ssh@.service
@@ -8,10 +8,21 @@ StopWhenUnneeded=yes
 Type=notify
 NotifyAccess=all
 DynamicUser=yes
+User=nnss-ssh-%i

 LoadCredential=ssh:/etc/nnss/%i

+# Note: App service running in the namespace should have Restart=always,
+# otherwise, both the ssh connection and the app will be stopped as this unit
+# has StopWhenUnneeded set
+# https://enotty.pipebreaker.pl/posts/2024/01/how-systemd-exponential-restart-delay-works/
+Restart=on-failure
+RestartSec=5min
+RestartSteps=6
+RestartMaxDelaySec=24h
+
 RuntimeDirectory=nnss-%i
+RuntimeDirectoryMode=0750
 StateDirectory=nnss-%i
 ExecStart=ssh -F /usr/lib/nnss/ssh_config default

--- a/nnssB@.service
+++ b/nnssB@.service
@@ -10,7 +10,7 @@ NotifyAccess=all
 RuntimeDirectory=nnssB%i

 # Add SOCKS_PROXY environment variable to below file. E.g.
-# SOCKS_PROXY=socks5://127.0.0.1:9050
+# echo SOCKS_PROXY=socks5://127.0.0.1:9050 > /etc/nnss/env_tor
 EnvironmentFile=/etc/nnss/env_%i

 ExecStart=/usr/lib/nnss/tunsocks.sh "%i" use_env setup
Author	SHA1	Message	Date
Balakrishnan Balasubramanian	739cca01c4	Make unique dynamic user for each ssh connection and improve doc	2025-07-27 22:00:03 -04:00
Balakrishnan Balasubramanian	90cab573eb	Disallow public access the ssh socket	2025-07-27 21:02:23 -04:00
Balakrishnan Balasubramanian	82aa6e0a4f	Enable Restart for ssh service	2025-05-22 12:44:30 -04:00