From d7487032d27c0803289509d68dd2f448db7787db Mon Sep 17 00:00:00 2001
From: Tatu Argillander <629430+kuglimon@users.noreply.github.com>
Date: Fri, 20 Mar 2026 16:06:59 +0200
Subject: [PATCH] disable sshd socket activation first (#931)

Ansible can open multiple connections and it's possible for a new socket
to open before activation is fully disabled, leaving a zombie sshd
process. At least that is the guess. Ubuntu 24.04 suffers from this.

Reload the configuration after disabling socket activation to not enable
it again.

Signed-off-by: Tatu Argillander <tatu.argillander@kouralabs.com>
---
 .../tasks/disable-systemd-socket.yml             | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/roles/ssh_hardening/tasks/disable-systemd-socket.yml b/roles/ssh_hardening/tasks/disable-systemd-socket.yml
index 04878ec3..d8c6a2d4 100644
--- a/roles/ssh_hardening/tasks/disable-systemd-socket.yml
+++ b/roles/ssh_hardening/tasks/disable-systemd-socket.yml
@@ -1,4 +1,11 @@
 ---
+- name: Disable systemd-socket activation
+  ansible.builtin.systemd:
+    name: ssh.socket
+    state: stopped
+    enabled: false
+    masked: true
+
 - name: Remove ssh service systemd-socket file
   ansible.builtin.file:
     path: "{{ item }}"
@@ -8,9 +15,8 @@
     - /etc/systemd/system/ssh.service.requires/ssh.socket
     - /etc/systemd/system/sockets.target.wants/ssh.socket
 
-- name: Disable systemd-socket activation
+- name: Ensure ssh service is started after disabling socket activation
   ansible.builtin.systemd:
-    name: ssh.socket
-    state: stopped
-    enabled: false
-    masked: true
+    name: "{{ sshd_service_name }}"
+    state: started
+    enabled: true