Need help with service-config-manager and socket activated services

Need help with service-config-manager and socket activated services

[Joseph Reynolds]

We are adding a new function to allow the BMC admin to disable the 
dropbear SSH server [issue 1763][].  This consists of a D-Bus interface 
controlled by [service-config-manager][] and an enhanced Redfish REST API.

We need help to understand how to enhance service-config-manager to work 
with socket activated services such as dropbear.  For example, to 
disable dropbear, is the correct action to perform something like this?:
   systemctl stop dropbear.socket
   systemctl disable dropbear.socket

- Joseph

[issue 1763]: https://github.com/ibm-openbmc/dev/issues/1763
[service-config-manager]: https://github.com/openbmc/service-config-manager

Re: Need help with service-config-manager and socket activated services

[Joseph Reynolds]

On 4/7/21 6:04 PM, Joseph Reynolds wrote:
> We are adding a new function to allow the BMC admin to disable the 
> dropbear SSH server [issue 1763][].  This consists of a D-Bus 
> interface controlled by [service-config-manager][] and an enhanced 
> Redfish REST API.

Richard and AppaRao,

We are enhancing service-config-manager so it can control the dropbear 
SSH server.  See [gerrit review 42072][].  The problem with this 
patchset are:
- It always reports dropbear as disabled.
- When we enable dropbear via this service, it reports dropbear as 
enabled for a few seconds, then it reports dropbear as disabled.

I believe the underlying issue is that dropbear is socket activated 
service.  Does service-config-manager understand how to control socket 
activated services like dropbear server?
- If so, can you help us debug what is going wrong?
- If not, can you point us to what code needs to be enhanced to make 
this work?

Thanks,
- Joseph

>
> We need help to understand how to enhance service-config-manager to 
> work with socket activated services such as dropbear.  For example, to 
> disable dropbear, is the correct action to perform something like this?:
>   systemctl stop dropbear.socket
>   systemctl disable dropbear.socket
>
> - Joseph
>
> [issue 1763]: https://github.com/ibm-openbmc/dev/issues/1763
> [service-config-manager]: 
> https://github.com/openbmc/service-config-manager
[gerrit review 42072]: 
https://gerrit.openbmc-project.xyz/c/openbmc/service-config-manager/+/42072

Re: Need help with service-config-manager and socket activated services

[Thomaiyar, Richard Marian]

Hi Joseph,

Service config manager currently is not designed to monitor the new 
service instantiated dynamically. It lists all the objects instantiated 
when BMC FW starts and not after that.

ssh service will be started dynamically based on user connection to the 
SSH port. Hence following 2 things are possible

1. Control only socket attributes

2. Update service config manager to monitor signal for new unit service 
and accordingly update the attributes as needed.

Left comments in review.

Regards,

Richard

On 4/19/2021 8:16 PM, Joseph Reynolds wrote:
> On 4/7/21 6:04 PM, Joseph Reynolds wrote:
>> We are adding a new function to allow the BMC admin to disable the 
>> dropbear SSH server [issue 1763][]. This consists of a D-Bus 
>> interface controlled by [service-config-manager][] and an enhanced 
>> Redfish REST API.
>
> Richard and AppaRao,
>
> We are enhancing service-config-manager so it can control the dropbear 
> SSH server.  See [gerrit review 42072][].  The problem with this 
> patchset are:
> - It always reports dropbear as disabled.
> - When we enable dropbear via this service, it reports dropbear as 
> enabled for a few seconds, then it reports dropbear as disabled.
>
> I believe the underlying issue is that dropbear is socket activated 
> service.  Does service-config-manager understand how to control socket 
> activated services like dropbear server?
> - If so, can you help us debug what is going wrong?
> - If not, can you point us to what code needs to be enhanced to make 
> this work?
>
> Thanks,
> - Joseph
>
>>
>> We need help to understand how to enhance service-config-manager to 
>> work with socket activated services such as dropbear.  For example, 
>> to disable dropbear, is the correct action to perform something like 
>> this?:
>>   systemctl stop dropbear.socket
>>   systemctl disable dropbear.socket
>>
>> - Joseph
>>
>> [issue 1763]: https://github.com/ibm-openbmc/dev/issues/1763
>> [service-config-manager]: 
>> https://github.com/openbmc/service-config-manager
> [gerrit review 42072]: 
> https://gerrit.openbmc-project.xyz/c/openbmc/service-config-manager/+/42072
>