Experimenting with smf to run parallel sshd service on different port

It’s been long time that  I have posted something about my funny experiments at home. Today I just spent some time to write this post for those who want to know about creating a new SMF service .  This post also covers the procedure to create a parallel sshd service which runs on non standard port (i.e. 222) instead of regular port ( i.e. 22).

Before going to actual topic, few basic points:

1. /var/svc/manifest/network —   it is the directory where we can find existing network service templates like ssh, ftp, rpc, ipsec …etc

 

Example :

bash-3.2# ls /var/svc/manifest/network
apocd.xml                  ipfilter.xml               ntp4.xml                   stdiscover.xml
cde-spc.xml                ipmievd.xml                pfil.xml                   stlisten.xml
chargen.xml                ipsec                      rarp.xml                   swat.xml
comsat.xml                 iscsi_initiator.xml        rexec.xml                  talk.xml
daytime.xml                ldap                       routing                    telnet.xml
dhcp-server.xml            login.xml                  rpc                        time.xml
discard.xml                network-initial.xml        samba.xml                  tname.xml
dns                        network-loopback.xml       security                   tnctl.xml
echo.xml                   network-physical.xml       sendmail-client.xml        tnd.xml
finger.xml                 network-routing-setup.xml  shares                     uucp.xml
forwarding.xml             network-service.xml        shell.xml                  winbind.xml
ftp.xml                    nfs                        slp.xml                    wins.xml
http-apache2.xml           nis                        smtp-sendmail.xml
inetd-upgrade.xml          nssh.xml                   ssh.xml
inetd.xml                  ntp.xml                    ssl

2. Every service template under /var/svc/manifest/network will a have defined service start/stop/restart method scripts under /lib/svc/method

example:

# ls /lib/svc/method
boot-archive         manifest-import      ppd-cache-update     svc-hotplug          svc-sma
boot-archive-update  mpxio-upgrade        print-svc            svc-ipmievd          svc-snmpdx
console-login        net-dtspcd           quagga               svc-iscsitgt         svc-stosreg
devices-local        net-init             rmtmpfiles           svc-kdc              svc-syseventd
dns-server           net-loopback         rpc-bind             svc-kdmconfig        svc-tnctl
fc-fabric            net-physical         rpc-cmsd             svc-labeld           svc-tnd
fs-local             net-routing-setup    rpc-ttdbserverd      svc-legacy-routing   svc-tsol-zones
fs-minimal           net-svc              sendmail-client      svc-mdmonitor        svc-utmpd
fs-root              nfs-client           slp                  svc-metainit         svc-volfs
fs-usr               nfs-server           smtp-sendmail        svc-ndp              svc-wbem
http-apache2         nisplus              sshd                 svc-nscd             svc-webconsole
identity-domain      nlockmgr             svc-auditd           svc-poold            svc-zones
identity-node        nsshd                svc-autofs           svc-pools            sysidtool-net
inetd-upgrade        ntp                  svc-autoreg          svc-power            sysidtool-system
installupdates       ogl-select           svc-consadm          svc-rdisc            system-log
ipfilter             patch-finish         svc-cron             svc-resource-mgmt    x11-server
iscsi-initiator      patchchk             svc-dmi              svc-ripng            xntp
iscsid               pfil                 svc-dtlogin          svc-route            yp
keymap               postgres_83          svc-dumpadm          svc-sar
ldap-client          postgresql           svc-forwarding       svc-scheduler

3.  We have to define port number for our new sshd service, let us call it as nsshd, in /etc/services

Actual procedure to create a new sshd  i.e. nsshd  service using SMF:

 

Step 1. Create a new service in /etc/services, by entering below lines just below the ssh service

nssh            222/tcp                         # Secure Shell

Step 2. Create a nssh.xml file by copying the current sshd.xml from the directory /var/svc/manifest/network

# cd /var/svc/manifest/network

# cp ssh.xml nssh.xml

Step 3. Make below modification to the nssh.xml file so that we can start / stop / restart the nsshd service  using SMF commands

change 1:change the name of service  from ssh to nssh

from  :  <service_bundle type=’manifest’ name=’SUNWsshdr:ssh’>

to       :   <service_bundle type=’manifest’ name=’SUNWsshdr:nssh’>

change 2: Remove below dependent service definition from nssh.xml, because this will be already checked by the primary sshd service.

 <dependent                                                                      
                name=’ssh_multi-user-server’                  
                grouping=’optional_all’                                
                restart_on=’none’>                                                 
                        <service_fmri                                                  
                            value=’svc:/milestone/multi-user-server’ />                
  </dependent>      

change 3: mention service start method for nsshd , by changing the below lines

From : 

 <exec_method
                type=’method’
                name=’start’
                exec=’/lib/svc/method/sshd start’
                timeout_seconds=’60’/>

to:

 <exec_method
                type=’method’
                name=’start’
                exec=’/lib/svc/method/nsshd start’
                timeout_seconds=’60’/>

change 3: mention new service restart method for nsshd, by changing the below lines

From:

<exec_method
                type=’method’
                name=’refresh’
                exec=’/lib/svc/method/sshd  restart’
                timeout_seconds=’60’ />

To:

<exec_method
                type=’method’
                name=’refresh’
                exec=’/lib/svc/method/nsshd  restart’
                timeout_seconds=’60’ />

Step 4. Create new service start/stop/restart method for our new service nsshd  i.e. /lib/svc/method/nsshd

you can just copy the existing service method /lib/svc/method/sshd to /lib/svc/method/nsshd and make minor modifications to the lines as below. :

From:

‘start’)
        /usr/lib/ssh/sshd
        ;;

To:

‘start’)
        /usr/lib/ssh/sshd -p 222
        ;;

Note:  sshd -p 222 will actually start the sshd service to listen at the port 222 instead of regular 22 port.

 

Step 5. Verify that newly created nssh.xml for syntax errors, using the below command. If no errors you are good to use the file.

bash-3.2# svccfg validate nssh.xml

 

Step 6. Once the .xml file validated with no errors, we are good to import the service definition to smf and to enable the service.

# cd /var/svc/manifest/network

# svccfg import nssh.xml

Once you import the .xml file the new service is visible in svcs output as below

# svcs -a |grep ssh
online         22:20:48 svc:/network/ssh:default
disabled    22:51:42 svc:/network/nssh:default

 

to enable the service use the below command:

# svcadm enable svc:/network/nssh:default

# svcs -a |grep ssh
online         22:20:48 svc:/network/ssh:default
online         22:51:42 svc:/network/nssh:default

 

That’s it the new sshd server daemon is ready to receive new connections from outside.  For testing you just to go to different machine and try to run the command

#ssh -p 222  <Server running with nssh>

And from the server macine just verify that new sshd are starting at the port 222, as below

 

# ps -ef|grep ssh
    root  1392  1391   0 22:21:01 ?           0:01 /usr/lib/ssh/sshd
    root  1492  1487   0 22:52:29 ?           0:00 /usr/lib/ssh/sshd -p 222
    root  1391  1390   0 22:21:01 ?           0:00 /usr/lib/ssh/sshd
    root  1390     1   0 22:20:48 ?           0:00 /usr/lib/ssh/sshd
    root  1493  1492   0 22:52:29 ?           0:00 /usr/lib/ssh/sshd -p 222
    root  1487     1   0 22:51:43 ?           0:00 /usr/lib/ssh/sshd -p 222

Some troubleshooting tips, while experimenting this task;

1. Just incase if you see the service going into maintenance mode when you try enable it, check the service log for the errors. Service startup log can be found from the “svcs -xv” output for each failed service

Example:

# svcs -xv
svc:/network/nssh:default (NSSH server)
 State: maintenance since Wed May 30 22:44:53 2012
Reason: Start method failed repeatedly, last exited with status 1.
   See: http://sun.com/msg/SMF-8000-KS
   See: man -M /usr/share/man -s 1M sshd
   See: /var/svc/log/network-nssh:default.log
Impact: This service is not running.

check the log file for errors:

# cat /var/svc/log/network-nssh:default.log
[ May 30 22:44:46 Disabled. ]
[ May 30 22:44:46 Rereading configuration. ]
[ May 30 22:44:53 Enabled. ]
[ May 30 22:44:53 Executing start method (“/lib/svc/method/sshd -p 222 start”) ]
Usage: /lib/svc/method/sshd { start | restart }
[ May 30 22:44:53 Method “start” exited with status 1 ]
[ May 30 22:44:53 Executing start method (“/lib/svc/method/sshd -p 222 start”) ]
Usage: /lib/svc/method/sshd { start | restart }
[ May 30 22:44:53 Method “start” exited with status 1 ]
[ May 30 22:44:53 Executing start method (“/lib/svc/method/sshd -p 222 start”) ]
Usage: /lib/svc/method/sshd { start | restart }
[ May 30 22:44:53 Method “start” exited with status 1 ]
[ May 30 22:49:07 Rereading configuration. ]

 

2. If you want to import the .xml after some corrections, you should delete the currently loaded configuration with below command, before you import it again.

Example:

# svccfg delete svc:/network/nssh:default
# svccfg import nssh.xml