Merge ~enr0n/ubuntu/+source/openssh:merge-lp2018094-mantic into ubuntu/+source/openssh:debian/sid

[Nick Rosbrook]

PPA build: https://launchpad.net/~enr0n/+archive/ubuntu/proposed-migration/+packages?field.name_filter=openssh&field.status_filter=published&field.series_filter=mantic

I ran autopkgtests locally (amd64) and they passed.

[Steve Langasek (vorlon)]

review: Needs Information

[Steve Langasek (vorlon)]

review: Approve

Unmerged commits

f4a0129... by Nick Rosbrook on 2023-05-19

changelog

988a629... by Nick Rosbrook on 2023-05-19

update-maintainer

2c2be41... by Nick Rosbrook on 2023-05-19

reconstruct-changelog

f788eb2... by Nick Rosbrook on 2023-05-19

merge-changelogs

387eecd... by Nick Rosbrook on 2023-05-19

  * debian/openssh-server.ucf-md5sum: update for Ubuntu delta

182c872... by Nick Rosbrook on 2023-05-19

  * debian/README.Debian: mention drop-in configurations in instructions
    for disabling sshd socket activation (LP: #2017434).

409372d... by Nick Rosbrook on 2023-05-19

  * debian/tests/systemd-socket-activation: Add autopkgtest for systemd socket
    activation functionality.

a9ff51f... by Nick Rosbrook on 2023-05-19

  * debian/patches/systemd-socket-activation.patch: Fix sshd
    re-execution behavior when socket activation is used

2ff5428... by Nick Rosbrook on 2023-05-19

  * debian/openssh-server.tmpfile,debian/systemd/ssh.service: Move
    /run/sshd creation out of the systemd unit to a tmpfile config so
    that sshd can be run manually if necessary without having to create
    this directory by hand.

17af9ff... by Nick Rosbrook on 2023-05-19

  * debian/openssh-server.ucf-md5sum: Update list of stock sshd_config
    checksums to include those from jammy and kinetic.

diff --git a/debian/.gitignore b/debian/.gitignore
deleted file mode 100644
index 988323b..0000000
--- a/debian/.gitignore
+++ /dev/null
@@ -1,17 +0,0 @@
-/*.debhelper*
-/*substvars
-/build-deb
-/build-udeb
-/files
-/keygen-test/key1
-/keygen-test/key1.pub
-/keygen-test/key2
-/keygen-test/key2.pub
-/openssh-client
-/openssh-client-udeb
-/openssh-server
-/openssh-server-udeb
-/ssh
-/ssh-askpass-gnome
-/ssh-krb5
-/tmp
diff --git a/debian/README.Debian b/debian/README.Debian
index 77d331b..83049c8 100644
--- a/debian/README.Debian
+++ b/debian/README.Debian
@@ -184,23 +184,7 @@ this sshd manually on upgrades.
 Socket-based activation with systemd
 ------------------------------------
 
-If you want to reconfigure systemd to listen on port 22 itself and launch
-sshd on connection (systemd-style socket activation), then you can run:
-
-  systemctl disable --now ssh.service
-  systemctl start ssh.socket
-
-To roll back this change, run:
-
-  systemctl stop ssh.socket
-  systemctl enable --now ssh.service
-
-Or if you want to make this change permanent:
-
-  systemctl enable ssh.socket
-
-This may be appropriate in environments where minimal footprint is critical
-(e.g. cloud guests).
+By default, socket-based activation is used on systems that use systemd.
 
 The provided ssh.socket unit file sets ListenStream=22.  If you need to have
 it listen on a different address or port, then you will need to do this as
@@ -215,6 +199,15 @@ follows (modifying ListenStream to match your requirements):
 
 See systemd.socket(5) for details.
 
+If you do not want to use socket activation for ssh on your system, you
+can disable socket activation by running:
+
+  systemctl disable --now ssh.socket
+  rm -f /etc/systemd/system/ssh.service.d/00-socket.conf
+  rm -f /etc/systemd/system/ssh.service.d/addresses.conf
+  systemctl daemon-reload
+  systemctl enable --now ssh.service
+
 Terminating SSH sessions cleanly on shutdown/reboot with systemd
 ----------------------------------------------------------------
 
diff --git a/debian/changelog b/debian/changelog
index c725f55..e883b37 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,37 @@
+openssh (1:9.2p1-2ubuntu1) mantic; urgency=medium
+
+  * Merge with Debian unstable (LP: #2018094). Remaining changes:
+    - debian/rules: modify dh_installsystemd invocations for
+      socket-activated sshd
+    - debian/openssh-server.postinst: handle migration of sshd_config options
+      to systemd socket options on upgrade.
+    - debian/README.Debian: document systemd socket activation.
+    - debian/patches/socket-activation-documentation.patch: Document in
+      sshd_config(5) that ListenAddress and Port no longer work.
+    - debian/openssh-server.templates: include debconf prompt explaining
+      when migration cannot happen due to multiple ListenAddress values
+    - debian/.gitignore: drop file
+    - debian/openssh-server.postrm: remove systemd drop-ins for
+      socket-activated sshd on purge
+    - debian/openssh-server.ucf-md5sum: Update list of stock sshd_config
+      checksums to include those from jammy and kinetic.
+    - debian/openssh-server.tmpfile,debian/systemd/ssh.service: Move
+      /run/sshd creation out of the systemd unit to a tmpfile config so
+      that sshd can be run manually if necessary without having to create
+      this directory by hand.
+    - debian/patches/systemd-socket-activation.patch: Fix sshd
+      re-execution behavior when socket activation is used
+    - debian/tests/systemd-socket-activation: Add autopkgtest for systemd socket
+      activation functionality.
+  * Dropped changes, included in Debian:
+    - debian/patches/systemd-socket-activation.patch: Initial implementation
+  * New changes:
+    - debian/README.Debian: mention drop-in configurations in instructions
+      for disabling sshd socket activation (LP: #2017434).
+    - debian/openssh-server.ucf-md5sum: update for Ubuntu delta
+
+ -- Nick Rosbrook <[e-mail]>  Fri, 19 May 2023 15:18:17 -0400
+
 openssh (1:9.2p1-2) unstable; urgency=medium
 
   * Fix mistakenly-unreleased entry for 1:9.2p1-1 in debian/NEWS.
@@ -249,6 +283,105 @@ openssh (1:9.1p1-1) unstable; urgency=medium
 
  -- Colin Watson <[e-mail]>  Mon, 14 Nov 2022 16:25:45 +0000
 
+openssh (1:9.0p1-1ubuntu8.1) lunar; urgency=medium
+
+  * debian/patches/systemd-socket-activation.patch: Fix re-execution behavior
+    (LP: #2011458):
+    - Remove FD_CLOEXEC on fds passed by systemd to prevent automatic closing
+      when sshd re-executes.
+    - Do not manually close fds passed by systemd when re-executing.
+    - Only call sd_listen_fds() once, and only in the parent process.
+    - Check the LISTEN_FDS environment variable to get the number of fds
+      passed by systemd when re-executing as a child process.
+  * debian/tests/systemd-socket-activation: Add autopkgtest for systemd socket
+    activation functionality.
+
+ -- Nick Rosbrook <[e-mail]>  Fri, 31 Mar 2023 12:44:32 -0400
+
+openssh (1:9.0p1-1ubuntu8) lunar; urgency=medium
+
+  * debian/openssh-server.postinst: Fix handling of ListenAddress when a port
+    is specified (LP: #1993478):
+    - Strip port before converting hostnames to numerical addresses.
+    - Only append ports when the ListenAddress does not already specify a
+      port.
+    - Revert socket migration on upgrade if a previous version did the
+      migration when it should not have.
+  * debian/openssh-server.postinst: Ignore empty directory failure from rmdir
+    when skipping socket migration (LP: #1995294).
+
+ -- Nick Rosbrook <[e-mail]>  Tue, 25 Oct 2022 11:57:43 -0400
+
+openssh (1:9.0p1-1ubuntu7) kinetic; urgency=medium
+
+  * Update list of stock sshd_config checksums to include those from
+    jammy and kinetic.
+  * Add a workaround for LP: #1990863 (now fixed in livecd-rootfs) to
+    avoid spurious ucf prompts on upgrade.
+  * Move /run/sshd creation out of the systemd unit to a tmpfile config
+    so that sshd can be run manually if necessary without having to create
+    this directory by hand.  LP: #1991283.
+
+  [ Nick Rosbrook ]
+  * debian/openssh-server.postinst: Fix addresses.conf generation when only
+    non-default Port is used in /etc/ssh/sshd_config (LP: #1991199).
+
+ -- Steve Langasek <[e-mail]>  Mon, 26 Sep 2022 21:55:14 +0000
+
+openssh (1:9.0p1-1ubuntu6) kinetic; urgency=medium
+
+  * Fix syntax error in postinst :/
+
+ -- Steve Langasek <[e-mail]>  Fri, 23 Sep 2022 19:51:32 +0000
+
+openssh (1:9.0p1-1ubuntu5) kinetic; urgency=medium
+
+  * Correctly handle the case of new installs, and correctly apply systemd
+    unit overrides on upgrade from existing kinetic systems.
+
+ -- Steve Langasek <[e-mail]>  Fri, 23 Sep 2022 19:45:18 +0000
+
+openssh (1:9.0p1-1ubuntu4) kinetic; urgency=medium
+
+  * Don't migrate users to socket activation if multiple ListenAddresses
+    might make sshd unreliable on boot.
+  * Fix regexp bug that prevented proper migration of IPv6 address settings.
+
+ -- Steve Langasek <[e-mail]>  Fri, 23 Sep 2022 19:35:37 +0000
+
+openssh (1:9.0p1-1ubuntu3) kinetic; urgency=medium
+
+  * Document in the default sshd_config file the changes in behavior 
+    triggered by use of socket-based activation.
+
+ -- Steve Langasek <[e-mail]>  Fri, 26 Aug 2022 00:40:11 +0000
+
+openssh (1:9.0p1-1ubuntu2) kinetic; urgency=medium
+
+  * Fix manpage to not claim socket-based activation is the default on
+    Debian!
+
+ -- Steve Langasek <[e-mail]>  Fri, 26 Aug 2022 00:21:42 +0000
+
+openssh (1:9.0p1-1ubuntu1) kinetic; urgency=medium
+
+  * debian/patches/systemd-socket-activation.patch: support systemd
+    socket activation.
+  * debian/systemd/ssh.socket, debian/systemd/ssh.service: use socket
+    activation by default.
+  * debian/rules: rejigger dh_installsystemd invocations so ssh.service and
+    ssh.socket don't fight.
+  * debian/openssh-server.postinst: handle migration of sshd_config options
+    to systemd socket options on upgrade.
+  * debian/README.Debian: document systemd socket activation.
+  * debian/patches/socket-activation-documentation.patch: Document in
+    sshd_config(5) that ListenAddress and Port no longer work.
+  * debian/openssh-server.templates, debian/openssh-server.postinst: include
+    debconf warning about possible service failure with multiple
+    ListenAddress settings.
+
+ -- Steve Langasek <[e-mail]>  Fri, 19 Aug 2022 20:43:16 +0000
+
 openssh (1:9.0p1-1) unstable; urgency=medium
 
   * New upstream release (https://www.openssh.com/releasenotes.html#9.0p1):
diff --git a/debian/control b/debian/control
index f3ed979..aa9cc2e 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: openssh
 Section: net
 Priority: standard
-Maintainer: Debian OpenSSH Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian OpenSSH Maintainers <[e-mail]>
 Build-Depends: debhelper (>= 13.1~),
                debhelper-compat (= 13),
                dh-exec,
diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index d38695f..a9d5894 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -20,6 +20,86 @@ get_config_option() {
 		/etc/ssh/sshd_config
 }
 
+get_config_option_all() {
+	option="$1"
+	file="$2"
+
+	if [ -z "$file" ]; then
+		file=/etc/ssh/sshd_config
+	fi
+
+	[ -f "$file" ] || return 0
+	# ListenAddress and Port only take a single word argument so anything
+	# after this must be a comment
+	while read option2 value junk; do
+		case $option2 in
+			$option)
+				echo $value
+				;;
+			Include)
+				# globs
+				for f in $value; do
+					get_config_option_all "$option" "$f"
+				done
+				;;
+		esac
+	done < $file
+}
+
+hostnames_to_addresses() {
+	addresses="$1"
+	for address in $addresses; do
+		address_no_port="$(address_strip_port $address)"
+		if echo "$address_no_port" | grep -q '^[0-9a-f:]\+$\|^[0-9.]\+$'; then
+			numeric_addresses="$numeric_addresses $address"
+		else
+			new_addresses=$( (getent ahostsv4 $address_no_port;
+			                  getent ahostsv6 $address_no_port) \
+			   | awk '$1 ~ /^::ffff:/ || $2 != "STREAM" { next; }
+			          $1 ~ /:/ { print "[" $1 "]"; next; }
+			          { print $1 }' \
+			   | sort -u)
+			port="$(port_from_address $address)"
+			if [ -n "$port" ]; then
+				new_addresses="$(for addr in $new_addresses; do echo $addr:$port; done)"
+			fi
+			numeric_addresses="$numeric_addresses $new_addresses"
+		fi
+	done
+	echo "$numeric_addresses"
+}
+
+port_from_address() {
+        address="$1"
+        if echo $address | grep -q '^\[[0-9a-f:]*\]:'; then
+                # This is an IPv6 address with a port.
+                port="$(echo $address | awk -F':' '{print $NF}')"
+        elif echo $address | grep -q '^\[[0-9a-f:]*\]\+$\|^[0-9a-f:]\+$'; then
+                # This is an IPv6 address without a port.
+                port=""
+        else
+                # This is an IPv4 address or hostname, where the port
+                # may or may not be specified.
+                port="$(echo $address | awk -F':' '{print $2}')"
+        fi
+        echo "$port"
+}
+
+address_strip_port() {
+        address="$1"
+        if echo $address | grep -q '^\[[0-9a-f:]*\]\(:\|$\)'; then
+                # This is an IPv6 address in brackets, with or without a port.
+                address_no_port="$(echo $address | awk -F '[][]' '{print $2}')"
+        elif echo $address | grep -q '^[0-9a-f:]\+$'; then
+                # This is an IPv6 address with no brackets and no port.
+                address_no_port="$address"
+        else
+                # This is an IPv4 address or hostname, where the port
+                # may or may not be specified.
+                address_no_port="$(echo $address | awk -F':' '{print $1}')"
+        fi
+        echo "$address_no_port"
+}
 
 host_keys_required() {
 	hostkeys="$(get_config_option HostKey)"
@@ -71,15 +151,20 @@ create_keys() {
 
 
 new_config=
+workaround=
 
 cleanup() {
 	if [ "$new_config" ]; then
 		rm -f "$new_config"
 	fi
+	if [ "$workaround" ]; then
+		rm -f "$workaround"
+	fi
 }
 
 
 create_sshdconfig() {
+	prev_ver="$1"
 	# XXX cjwatson 2016-12-24: This debconf template is very confusingly
 	# named; its description is "Disable SSH password authentication for
 	# root?", so true -> prohibit-password (the upstream default),
@@ -101,6 +186,21 @@ create_sshdconfig() {
 			"$new_config"
 	fi
 	mkdir -pZ /etc/ssh
+
+	# Workaround for LP: #1968873: if we have an sshd_config with a known
+	# checksum, confirm it via ucf before applying the changes from
+	# the new version.
+	if dpkg --compare-versions "$prev_ver" lt-nl 1:9.0p1-1ubuntu7 \
+	   && grep -q "^$(md5sum /etc/ssh/sshd_config | awk '{ print $1 }')" \
+	              /usr/share/openssh/sshd_config.md5sum
+	then
+		workaround="$(mktemp)"
+		sed -e'14,16d' "$new_config" > "$workaround"
+		ucf --three-way --debconf-ok \
+			--sum-file /usr/share/openssh/sshd_config.md5sum \
+			"$workaround" /etc/ssh/sshd_config
+	fi
+
 	ucf --three-way --debconf-ok \
 		--sum-file /usr/share/openssh/sshd_config.md5sum \
 		"$new_config" /etc/ssh/sshd_config
@@ -114,7 +214,7 @@ setup_sshd_user() {
 }
 
 if [ "$action" = configure ]; then
-	create_sshdconfig
+	create_sshdconfig "$2"
 	create_keys
 	setup_sshd_user
 	if dpkg --compare-versions "$2" lt-nl 1:7.9p1-5 && \
@@ -127,18 +227,104 @@ if [ "$action" = configure ]; then
 	    # which we now move back into place.
 	    mv /etc/ssh/moduli.dpkg-bak /etc/ssh/moduli
 	fi
-	if dpkg --compare-versions "$2" lt-nl 1:9.1p1-1~ && \
-	   deb-systemd-helper --quiet was-enabled ssh.socket && \
-	   [ -d /run/systemd/system ]
+	if dpkg --compare-versions "$2" lt-nl 1:9.0p1-1ubuntu8~
 	then
 		# migrate to systemd socket activation.
-		systemctl unmask ssh.service
-		systemctl disable ssh.service
+		addresses=$(get_config_option_all ListenAddress)
+		addresses=$(hostnames_to_addresses "$addresses")
+		ports=$(get_config_option_all Port)
+		if [ -n "$addresses$ports" ]
+		then
+			override_dir=/etc/systemd/system/ssh.socket.d
+			mkdir -p "$override_dir"
+			echo '[Socket]' > "$override_dir"/addresses.conf.new
+			echo 'ListenStream=' >> "$override_dir"/addresses.conf.new
+		fi
+		if [ -n "$addresses" ]; then
+			[ -n "$ports" ] || ports=22
+			count=0
+			for address in $addresses; do
+				count=$((count+1))
+				port_from_address="$(port_from_address $address)"
+				if [ -z "$port_from_address" ]; then
+					for port in $ports; do
+						echo "ListenStream=$address:$port" \
+						     >> "$override_dir"/addresses.conf.new
+					done
+				else
+					echo "ListenStream=$address" \
+					     >> "$override_dir"/addresses.conf.new
+				fi
+			done
+			if [ $count -gt 1 ]; then
+				db_input critical openssh-server/listenstream-may-fail || true
+				db_go || true
+				rm -f "$override_dir"/addresses.conf.new
+				rmdir --ignore-fail-on-non-empty "$override_dir"
+				NO_SOCKET_MIGRATION=1
+			fi
+		elif [ -n "$ports" ]; then
+			for port in $ports; do
+				echo "ListenStream=$port" \
+				     >> "$override_dir"/addresses.conf.new
+			done
+		fi
+
+		if [ -z "$NO_SOCKET_MIGRATION" ] && [ -n "$addresses$ports" ]
+		then
+                    mv "$override_dir"/addresses.conf.new \
+                       "$override_dir"/addresses.conf
+		fi
+	fi
+	if dpkg --compare-versions "$2" lt 1:9.0p1-1ubuntu5~; then
+		if [ -z "$NO_SOCKET_MIGRATION" ]; then
+			override_dir=/etc/systemd/system/ssh.service.d
+			mkdir -p "$override_dir"
+			echo '[Unit]' > "$override_dir"/00-socket.conf
+			echo 'After=ssh.socket' >> "$override_dir"/00-socket.conf
+			echo 'Requires=ssh.socket' >> "$override_dir"/00-socket.conf
+
+			# deb-systemd-helper is inadequate for the task of
+			# changing policy for the units on upgrade
+			if [ -d /run/systemd/system ]; then
+				systemctl daemon-reload
+				systemctl disable ssh.service
+				systemctl unmask ssh.service
+				systemctl stop ssh.service
+				systemctl enable ssh.socket
+			fi
+		fi
 	fi
+
+        # Revert socket migration if we can determine the user hit
+        # LP: #1993478.
+        if dpkg --compare-versions "$2" lt-nl 1:9.0p1-1ubuntu7~ \
+           && [ -e /etc/systemd/system/ssh.socket.d/addresses.conf ] \
+           && [ -e /etc/systemd/system/ssh.service.d/00-socket.conf ] \
+           && [ -n "$NO_SOCKET_MIGRATION" ]; then
+                rm /etc/systemd/system/ssh.socket.d/addresses.conf
+                rmdir --ignore-fail-on-non-empty /etc/systemd/system/ssh.socket.d
+                rm /etc/systemd/system/ssh.service.d/00-socket.conf
+                rmdir --ignore-fail-on-non-empty /etc/systemd/system/ssh.service.d
+		if [ -d /run/systemd/system ]; then
+			systemctl daemon-reload
+			systemctl disable ssh.socket
+			systemctl stop ssh.socket
+			systemctl enable ssh.service
+		fi
+        fi
 fi
 
 #DEBHELPER#
 
+if [ -d /run/systemd/system ]; then
+	if deb-systemd-helper --quiet was-enabled ssh.socket; then
+		deb-systemd-invoke restart ssh.socket
+	elif deb-systemd-helper --quiet was-enabled ssh.service; then
+		deb-systemd-invoke restart ssh.service
+	fi
+fi
+
 db_stop
 
 exit 0
diff --git a/debian/openssh-server.postrm b/debian/openssh-server.postrm
index fbaeb17..46798dd 100644
--- a/debian/openssh-server.postrm
+++ b/debian/openssh-server.postrm
@@ -23,6 +23,10 @@ case $1 in
 		if command -v ucfr >/dev/null 2>&1; then
 			ucfr --purge openssh-server /etc/ssh/sshd_config
 		fi
+		rm -f /etc/systemd/system/ssh.service.d/00-socket.conf
+		rm -f /etc/systemd/system/ssh.socket.d/addresses.conf
+		rmdir /etc/systemd/system/ssh.service.d || true
+		rmdir /etc/systemd/system/ssh.socket.d || true
 		rm -f /etc/ssh/sshd_not_to_be_run
 		[ ! -d /etc/ssh ] || rmdir --ignore-fail-on-non-empty /etc/ssh
 
diff --git a/debian/openssh-server.templates b/debian/openssh-server.templates
index e071fe3..31f2935 100644
--- a/debian/openssh-server.templates
+++ b/debian/openssh-server.templates
@@ -21,3 +21,15 @@ Description: Allow password authentication?
  By default, the SSH server will allow authenticating using a password.
  You may want to change this if all users on this system authenticate using
  a stronger authentication method, such as public keys.
+
+Template: openssh-server/listenstream-may-fail
+Type: error
+_Description: Not migrating to socket activation
+ This version of openssh-server uses socket-based activation by default.
+ However, because you have more than one ListenAddress configured in
+ sshd_config, it is impossible to determine at upgrade time if migrating
+ you to socket-based activation would cause the starting of sshd at boot
+ to be unreliable.
+ .
+ Because a failure to start ssh may make it impossible to admininister a
+ system, you will not be migrated to socket-based activation at this time.
diff --git a/debian/openssh-server.tmpfile b/debian/openssh-server.tmpfile
new file mode 100644
index 0000000..76c6323
--- /dev/null
+++ b/debian/openssh-server.tmpfile
@@ -0,0 +1,2 @@
+#Type	Path				Mode	UID	GID	Age	Arguments
+D	/run/sshd			0755	root	root	-	-
diff --git a/debian/openssh-server.ucf-md5sum b/debian/openssh-server.ucf-md5sum
index 3a9dc23..9a8efb6 100644
--- a/debian/openssh-server.ucf-md5sum
+++ b/debian/openssh-server.ucf-md5sum
@@ -103,8 +103,32 @@ cc873ab3ccc9cf3a3830c3c0728c0d0b
 9f1bec115595c0f76282d80abe5d9bcc
 ae1a449c8adb31cb603e28fda5342696
 
+# From 1:8.4p1-5
+6dbdc3a27e1953d209f929df7aff0c57
+0ef8c8fe6a3afd12382dbb93cd7bbb4e
+ae1a449c8adb31cb603e28fda5342696
+9f1bec115595c0f76282d80abe5d9bcc
+
 # From 1:8.7p1-1:
 fe83fd23553510bb632dc8e6e35ab41a
 d96ecd9064ea650c44372a5a33d3e497
 7fdb195ac56e0bf1992e18ac656811af
 4e03b4df60cd00c651777ec14ff76aef
+
+# From 1:8.9p1-3
+30e0fe758429c57d35a5e71dbd8dd2f8
+23a8a2b1a8f1538be49eb86313367191
+133f5f0119fbf5716b7d72048b25ea71
+697a81708f11897cb0fef857563dee55
+
+# From 1:9.0p1-1ubuntu3
+90ace5da6c7eb3041732930972662f34
+b2c07b86695152141e84f44e4414104a
+e7b9120b6e68c5666ac21a0cc03d4806
+9389be84e67cd5a91b97de5ff03c9306
+
+# From 1:9.2p1-2ubuntu1
+fac56840f6697a357368bb878dd8fb87
+d01da8c9de75176095712d4e37d5dcd5
+e4898846045f33b8d99d3263d6f6fd81
+ec46dc59ba9c9e9458add405264fcedd
diff --git a/debian/patches/series b/debian/patches/series
index cbbfc88..e7e2a9c 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -26,3 +26,4 @@ maxhostnamelen.patch
 conch-ssh-rsa.patch
 systemd-socket-activation.patch
 remove-spurious-ssh-agent-options.patch
+socket-activation-documentation.patch
diff --git a/debian/patches/socket-activation-documentation.patch b/debian/patches/socket-activation-documentation.patch
new file mode 100644
index 0000000..9afde55
--- /dev/null
+++ b/debian/patches/socket-activation-documentation.patch
@@ -0,0 +1,50 @@
+Index: openssh-9.0p1/sshd_config.5
+===================================================================
+--- openssh-9.0p1.orig/sshd_config.5
++++ openssh-9.0p1/sshd_config.5
+@@ -1069,6 +1069,15 @@
+ Multiple
+ .Cm ListenAddress
+ options are permitted.
++.Pp
++.Cm Note:
++On Ubuntu, the openssh-server package is configured to use systemd
++socket-based activation by default.  Therefore if you are using systemd with
++the default configuration,
++.Cm ListenAddress
++options will not be honored.  Address configuration must be handled in
++.Pa /etc/systemd/system/ssh.socket.d
++instead.
+ .It Cm LoginGraceTime
+ The server disconnects after this time if the user has not
+ successfully logged in.
+@@ -1520,6 +1529,15 @@
+ Multiple options of this type are permitted.
+ See also
+ .Cm ListenAddress .
++.Pp
++.Cm Note:
++On Ubuntu, the openssh-server package is configured to use systemd
++socket-based activation by default.  Therefore if you are using systemd with
++the default configuration,
++.Cm Port
++options will not be honored.  Address configuration must be handled in
++.Pa /etc/systemd/system/ssh.socket.d
++instead.
+ .It Cm PrintLastLog
+ Specifies whether
+ .Xr sshd 8
+Index: openssh-9.0p1/sshd_config
+===================================================================
+--- openssh-9.0p1.orig/sshd_config
++++ openssh-9.0p1/sshd_config
+@@ -12,6 +12,9 @@
+ 
+ Include /etc/ssh/sshd_config.d/*.conf
+ 
++# Port and ListenAddress options are not used when sshd is socket-activated,
++# which is now the default in Ubuntu.  See sshd_config(5) and
++# /usr/share/doc/openssh-server/README.Debian.gz for details.
+ #Port 22
+ #AddressFamily any
+ #ListenAddress 0.0.0.0
diff --git a/debian/patches/systemd-socket-activation.patch b/debian/patches/systemd-socket-activation.patch
index 5441622..3bfa116 100644
--- a/debian/patches/systemd-socket-activation.patch
+++ b/debian/patches/systemd-socket-activation.patch
@@ -1,47 +1,72 @@
-From 4cedd1c9acac0fba598db2eaf43278dfe8e53ef0 Mon Sep 17 00:00:00 2001
-From: Steve Langasek <[e-mail]>
-Date: Thu, 1 Sep 2022 16:03:37 +0100
-Subject: Support systemd socket activation
+Description: support systemd socket activation
+ Unlike inetd socket activation, with systemd socket activation the
+ supervisor passes the listened-on socket to the child process and lets
+ the child process handle the accept().  This lets us do delayed start
+ of the sshd daemon without becoming incompatible with config options
+ like ClientAliveCountMax.
+Author: Steve Langasek <[e-mail]>
+Author: Nick Rosbrook <[e-mail]>
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2011458
+Last-Update: 2023-04-17
 
-Unlike inetd socket activation, with systemd socket activation the
-supervisor passes the listened-on socket to the child process and lets
-the child process handle the accept().  This lets us do delayed start
-of the sshd daemon without becoming incompatible with config options
-like ClientAliveCountMax.
-
-Last-Update: 2022-09-01
-
-Patch-Name: systemd-socket-activation.patch
----
- sshd.c | 89 +++++++++++++++++++++++++++++++++++++++++++++++++---------
- 1 file changed, 75 insertions(+), 14 deletions(-)
-
-diff --git a/sshd.c b/sshd.c
-index 0a4eefe01..fc22fcb62 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -141,10 +141,16 @@ int deny_severity;
+@@ -140,11 +140,14 @@
+ int deny_severity;
  #endif /* LIBWRAP */
  
++/* This will only get set if we build with systemd. */
++static int systemd_num_listen_fds;
++
  /* Re-exec fds */
 -#define REEXEC_DEVCRYPTO_RESERVED_FD	(STDERR_FILENO + 1)
 -#define REEXEC_STARTUP_PIPE_FD		(STDERR_FILENO + 2)
 -#define REEXEC_CONFIG_PASS_FD		(STDERR_FILENO + 3)
 -#define REEXEC_MIN_FREE_FD		(STDERR_FILENO + 4)
-+#ifdef HAVE_SYSTEMD
-+#define SYSTEMD_OFFSET sd_listen_fds(0)
-+#else
-+#define SYSTEMD_OFFSET 0
-+#endif
-+
-+#define REEXEC_DEVCRYPTO_RESERVED_FD	(STDERR_FILENO + 1 + SYSTEMD_OFFSET)
-+#define REEXEC_STARTUP_PIPE_FD		(STDERR_FILENO + 2 + SYSTEMD_OFFSET)
-+#define REEXEC_CONFIG_PASS_FD		(STDERR_FILENO + 3 + SYSTEMD_OFFSET)
-+#define REEXEC_MIN_FREE_FD		(STDERR_FILENO + 4 + SYSTEMD_OFFSET)
++#define REEXEC_DEVCRYPTO_RESERVED_FD	(STDERR_FILENO + 1 + systemd_num_listen_fds)
++#define REEXEC_STARTUP_PIPE_FD		(STDERR_FILENO + 2 + systemd_num_listen_fds)
++#define REEXEC_CONFIG_PASS_FD		(STDERR_FILENO + 3 + systemd_num_listen_fds)
++#define REEXEC_MIN_FREE_FD		(STDERR_FILENO + 4 + systemd_num_listen_fds)
  
  extern char *__progname;
  
-@@ -1025,6 +1031,48 @@ server_accept_inetd(int *sock_in, int *sock_out)
+@@ -195,6 +198,7 @@
+  */
+ #define	MAX_LISTEN_SOCKS	16
+ static int listen_socks[MAX_LISTEN_SOCKS];
++static int listen_socks_no_close[MAX_LISTEN_SOCKS];
+ static int num_listen_socks = 0;
+ 
+ /* Daemon's agent connection */
+@@ -280,12 +284,16 @@
+  * Close all listening sockets
+  */
+ static void
+-close_listen_socks(void)
++close_listen_socks(int force)
+ {
+ 	int i;
+ 
+-	for (i = 0; i < num_listen_socks; i++)
++	for (i = 0; i < num_listen_socks; i++) {
++		if (listen_socks_no_close[i] > 0 && force <= 0)
++			continue;
++
+ 		close(listen_socks[i]);
++        }
+ 	num_listen_socks = 0;
+ }
+ 
+@@ -324,7 +332,7 @@
+ 	if (options.pid_file != NULL)
+ 		unlink(options.pid_file);
+ 	platform_pre_restart();
+-	close_listen_socks();
++	close_listen_socks(/* force = */ 0);
+ 	close_startup_pipes();
+ 	ssh_signal(SIGHUP, SIG_IGN); /* will be restored after exec */
+ 	execv(saved_argv[0], saved_argv);
+@@ -1033,6 +1041,65 @@
  	debug("inetd sockets after dupping: %d, %d", *sock_in, *sock_out);
  }
  
@@ -52,7 +77,7 @@ index 0a4eefe01..fc22fcb62 100644
 +static void
 +setup_systemd_socket(int listen_sock)
 +{
-+	int ret;
++	int flags, ret;
 +	struct sockaddr_storage addr;
 +	socklen_t len = sizeof(addr);
 +	char ntop[NI_MAXHOST], strport[NI_MAXSERV];
@@ -77,10 +102,27 @@ index 0a4eefe01..fc22fcb62 100644
 +		close(listen_sock);
 +		return;
 +	}
++
 +	/* Socket options */
 +	set_reuseaddr(listen_sock);
 +
++        /* systemd sets FD_CLOEXEC on the fds it passes to us, but we need this
++         * to stay open across re-exec. */
++        flags = fcntl(listen_sock, F_GETFD);
++        if (flags < 0) {
++                error("Failed to get fd flags: %s", strerror(errno));
++                close(listen_sock);
++                return;
++        }
++
++        if (fcntl(listen_sock, F_SETFD, flags & ~FD_CLOEXEC) < 0) {
++                error("Failed to clear FD_CLOEXEC flag: %s", strerror(errno));
++                close(listen_sock);
++                return;
++        }
++
 +	listen_socks[num_listen_socks] = listen_sock;
++	listen_socks_no_close[num_listen_socks] = 1;
 +	num_listen_socks++;
 +
 +	logit("Server listening on %s port %s.", ntop, strport);
@@ -90,15 +132,7 @@ index 0a4eefe01..fc22fcb62 100644
  /*
   * Listen for TCP connections
   */
-@@ -1104,22 +1152,35 @@ static void
- server_listen(void)
- {
- 	u_int i;
-+#ifdef HAVE_SYSTEMD
-+	int systemd_socket_count;
-+#endif
- 
- 	/* Initialise per-source limit tracking. */
+@@ -1117,17 +1184,26 @@
  	srclimit_init(options.max_startups, options.per_source_max_startups,
  	    options.per_source_masklen_ipv4, options.per_source_masklen_ipv6);
  
@@ -109,11 +143,10 @@ index 0a4eefe01..fc22fcb62 100644
 -		memset(&options.listen_addrs[i], 0,
 -		    sizeof(options.listen_addrs[i]));
 +#ifdef HAVE_SYSTEMD
-+	systemd_socket_count = sd_listen_fds(0);
-+	if (systemd_socket_count > 0)
++	if (systemd_num_listen_fds > 0)
 +	{
 +		int i;
-+		for (i = 0; i < systemd_socket_count; i++)
++		for (i = 0; i < systemd_num_listen_fds; i++)
 +			setup_systemd_socket(SD_LISTEN_FDS_START + i);
 +	} else
 +#endif
@@ -136,3 +169,78 @@ index 0a4eefe01..fc22fcb62 100644
  	if (!num_listen_socks)
  		fatal("Cannot bind any address.");
  }
+@@ -1182,7 +1258,7 @@
+ 		if (received_sigterm) {
+ 			logit("Received signal %d; terminating.",
+ 			    (int) received_sigterm);
+-			close_listen_socks();
++			close_listen_socks(/* force = */ 1);
+ 			if (options.pid_file != NULL)
+ 				unlink(options.pid_file);
+ 			exit(received_sigterm == SIGTERM ? 0 : 255);
+@@ -1196,7 +1272,7 @@
+ 		if (received_sighup) {
+ 			if (!lameduck) {
+ 				debug("Received SIGHUP; waiting for children");
+-				close_listen_socks();
++				close_listen_socks(/* force = */ 0);
+ 				lameduck = 1;
+ 			}
+ 			if (listening <= 0) {
+@@ -1319,7 +1395,7 @@
+ 				 * connection without forking.
+ 				 */
+ 				debug("Server will not fork when running in debugging mode.");
+-				close_listen_socks();
++				close_listen_socks(/* force = */ 0);
+ 				*sock_in = *newsock;
+ 				*sock_out = *newsock;
+ 				close(startup_p[0]);
+@@ -1353,7 +1429,7 @@
+ 				platform_post_fork_child();
+ 				startup_pipe = startup_p[1];
+ 				close_startup_pipes();
+-				close_listen_socks();
++				close_listen_socks(/* force = */ 0);
+ 				*sock_in = *newsock;
+ 				*sock_out = *newsock;
+ 				log_init(__progname,
+@@ -1701,6 +1777,38 @@
+ 			break;
+ 		}
+ 	}
++
++#ifdef HAVE_SYSTEMD
++        /* We should call sd_listen_fds() exactly once, and only in the parent
++         * process.
++         *
++         * If the parent calls sd_listen_fds() more than once, then FD_CLOEXEC
++         * will be re-configured for the passed fds, which will cause problems
++         * during re-execution. The FD_CLOEXEC flag will be cleared by
++         * setup_systemd_socket().
++         *
++         * If the child calls sd_listen_fds(), it will return 0 because it will
++         * compare our pid to the LISTEN_PID environment variable, and only
++         * return LISTEN_FDS if they match. Thus, when we are a child process,
++         * check the LISTEN_FDS ourselves. */
++        if (rexeced_flag) {
++                const char* s = getenv("LISTEN_FDS");
++                if (s && s[0] != '\0') {
++                        errno = 0;
++                        r = (int)strtonum(s, 0, MAX_LISTEN_SOCKS, NULL);
++                        if (errno > 0)
++                                fatal("Failed to parse LISTEN_FDS: %s", strerror(errno));
++                } else
++                        r = 0;
++        } else {
++                r = sd_listen_fds(0);
++                if (r < 0)
++                        fatal("Failed to get systemd socket fds: %s", strerror(-r));
++        }
++
++        systemd_num_listen_fds = r;
++#endif
++
+ 	if (rexeced_flag || inetd_flag)
+ 		rexec_flag = 0;
+ 	if (!test_flag && rexec_flag && !path_absolute(av[0]))
diff --git a/debian/po/cs.po b/debian/po/cs.po
index d01e0ff..21b4c7b 100644
--- a/debian/po/cs.po
+++ b/debian/po/cs.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh 1:6.6p1-1\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2014-03-20 02:06+0000\n"
+"POT-Creation-Date: 2022-09-23 19:34+0000\n"
 "PO-Revision-Date: 2014-06-12 12:25+0200\n"
 "Last-Translator: Michal Simunek <[e-mail]>\n"
 "Language-Team: Czech <[e-mail]>\n"
@@ -53,3 +53,28 @@ msgstr ""
 "poškodit systémy, které jsou nastaveny s předpokladem, že bude možné se "
 "přihlašovat přes SSH jako root pomocí ověřování heslem. Změnu této volby "
 "byste měli provést pouze pokud ověřování heslem potřebujete."
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Not migrating to socket activation"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"This version of openssh-server uses socket-based activation by default. "
+"However, because you have more than one ListenAddress configured in "
+"sshd_config, it is impossible to determine at upgrade time if migrating you "
+"to socket-based activation would cause the starting of sshd at boot to be "
+"unreliable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Because a failure to start ssh may make it impossible to admininister a "
+"system, you will not be migrated to socket-based activation at this time."
+msgstr ""
diff --git a/debian/po/da.po b/debian/po/da.po
index 70d576d..a08ca3b 100644
--- a/debian/po/da.po
+++ b/debian/po/da.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2014-03-20 02:06+0000\n"
+"POT-Creation-Date: 2022-09-23 19:34+0000\n"
 "PO-Revision-Date: 2014-03-21 23:51+0200\n"
 "Last-Translator: Joe Hansen <[e-mail]>\n"
 "Language-Team: Danish <[e-mail]>\n"
@@ -53,3 +53,28 @@ msgstr ""
 "Det kan dog ødelægge systemer, som er opsat med forventning om at kunne SSH "
 "som root via brug af adgangskodegodkendelse. Du skal kun lave denne ændring, "
 "hvis du ikke har brug for dette."
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Not migrating to socket activation"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"This version of openssh-server uses socket-based activation by default. "
+"However, because you have more than one ListenAddress configured in "
+"sshd_config, it is impossible to determine at upgrade time if migrating you "
+"to socket-based activation would cause the starting of sshd at boot to be "
+"unreliable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Because a failure to start ssh may make it impossible to admininister a "
+"system, you will not be migrated to socket-based activation at this time."
+msgstr ""
diff --git a/debian/po/de.po b/debian/po/de.po
index ecba54b..2536ea4 100644
--- a/debian/po/de.po
+++ b/debian/po/de.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh_1:6.6p1-1\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2014-03-20 02:06+0000\n"
+"POT-Creation-Date: 2022-09-23 19:34+0000\n"
 "PO-Revision-Date: 2014-03-24 22:21+0100\n"
 "Last-Translator: Stephan Beck <[e-mail]>\n"
 "Language-Team: Debian German translation team <debian-l10n-german@lists."
@@ -59,3 +59,28 @@ msgstr ""
 "in der Absicht konfiguriert wurden, die Anmeldung als »root« über SSH unter "
 "Verwendung von Passwort-Authentifizierung zuzulassen. Sie sollten diese "
 "Änderung nur vornehmen, wenn Sie auf Letzteres verzichten können."
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Not migrating to socket activation"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"This version of openssh-server uses socket-based activation by default. "
+"However, because you have more than one ListenAddress configured in "
+"sshd_config, it is impossible to determine at upgrade time if migrating you "
+"to socket-based activation would cause the starting of sshd at boot to be "
+"unreliable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Because a failure to start ssh may make it impossible to admininister a "
+"system, you will not be migrated to socket-based activation at this time."
+msgstr ""
diff --git a/debian/po/es.po b/debian/po/es.po
index de8a67a..14550d6 100644
--- a/debian/po/es.po
+++ b/debian/po/es.po
@@ -28,7 +28,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2014-03-20 02:06+0000\n"
+"POT-Creation-Date: 2022-09-23 19:34+0000\n"
 "PO-Revision-Date: 2014-03-23 20:43-0300\n"
 "Last-Translator: Matías Bellone <[e-mail]>\n"
 "Language-Team: Debian l10n Spanish <[e-mail]>\n"
@@ -78,3 +78,28 @@ msgstr ""
 "configuración permite que el usuario root inicie sesión a través de SSH "
 "utilizando una contraseña. Sólo debería realizar este cambio si no necesita "
 "este comportamiento."
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Not migrating to socket activation"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"This version of openssh-server uses socket-based activation by default. "
+"However, because you have more than one ListenAddress configured in "
+"sshd_config, it is impossible to determine at upgrade time if migrating you "
+"to socket-based activation would cause the starting of sshd at boot to be "
+"unreliable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Because a failure to start ssh may make it impossible to admininister a "
+"system, you will not be migrated to socket-based activation at this time."
+msgstr ""
diff --git a/debian/po/fr.po b/debian/po/fr.po
index f7125e9..7d7093b 100644
--- a/debian/po/fr.po
+++ b/debian/po/fr.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh_1:6.5p1-6\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2014-03-20 02:06+0000\n"
+"POT-Creation-Date: 2022-09-23 19:34+0000\n"
 "PO-Revision-Date: 2014-03-22 08:26+0100\n"
 "Last-Translator: Étienne Gilli <[e-mail]>\n"
 "Language-Team: French <[e-mail]>\n"
@@ -57,3 +57,28 @@ msgstr ""
 "inutilisables les systèmes reposant sur la possibilité de se connecter au "
 "compte « root » par SSH avec authentification par mot de passe. Vous ne "
 "devriez appliquer cette modification que si ce n’est pas votre cas."
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Not migrating to socket activation"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"This version of openssh-server uses socket-based activation by default. "
+"However, because you have more than one ListenAddress configured in "
+"sshd_config, it is impossible to determine at upgrade time if migrating you "
+"to socket-based activation would cause the starting of sshd at boot to be "
+"unreliable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Because a failure to start ssh may make it impossible to admininister a "
+"system, you will not be migrated to socket-based activation at this time."
+msgstr ""
diff --git a/debian/po/it.po b/debian/po/it.po
index dd71060..5390795 100644
--- a/debian/po/it.po
+++ b/debian/po/it.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2014-03-20 02:06+0000\n"
+"POT-Creation-Date: 2022-09-23 19:34+0000\n"
 "PO-Revision-Date: 2014-03-28 11:12+0200\n"
 "Last-Translator: Beatrice Torracca <[e-mail]>\n"
 "Language-Team: Italian <[e-mail]>\n"
@@ -56,3 +56,28 @@ msgstr ""
 "impostati facendo affidamento sulla possibilità di autenticazione SSH come "
 "root usando la password. Si dovrebbe fare questo cambiamento solo se non si "
 "ha bisogno di tale comportamento."
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Not migrating to socket activation"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"This version of openssh-server uses socket-based activation by default. "
+"However, because you have more than one ListenAddress configured in "
+"sshd_config, it is impossible to determine at upgrade time if migrating you "
+"to socket-based activation would cause the starting of sshd at boot to be "
+"unreliable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Because a failure to start ssh may make it impossible to admininister a "
+"system, you will not be migrated to socket-based activation at this time."
+msgstr ""
diff --git a/debian/po/ja.po b/debian/po/ja.po
index db382f1..b48d281 100644
--- a/debian/po/ja.po
+++ b/debian/po/ja.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2014-03-20 02:06+0000\n"
+"POT-Creation-Date: 2022-09-23 19:34+0000\n"
 "PO-Revision-Date: 2014-03-20 11:06+0900\n"
 "Last-Translator: victory <[e-mail]>\n"
 "Language-Team: Japanese <[e-mail]>\n"
@@ -53,3 +53,28 @@ msgstr ""
 "ます。しかしパスワード認証により root で SSH 接続できることを前提として構成し"
 "たシステムでは問題が発生する可能性があります。そういった必要のない場合にのみ"
 "この変更を行うようにしてください。"
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Not migrating to socket activation"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"This version of openssh-server uses socket-based activation by default. "
+"However, because you have more than one ListenAddress configured in "
+"sshd_config, it is impossible to determine at upgrade time if migrating you "
+"to socket-based activation would cause the starting of sshd at boot to be "
+"unreliable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Because a failure to start ssh may make it impossible to admininister a "
+"system, you will not be migrated to socket-based activation at this time."
+msgstr ""
diff --git a/debian/po/nl.po b/debian/po/nl.po
index 3afd617..eca9662 100644
--- a/debian/po/nl.po
+++ b/debian/po/nl.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2014-03-20 02:06+0000\n"
+"POT-Creation-Date: 2022-09-23 19:34+0000\n"
 "PO-Revision-Date: 2014-10-03 23:54+0200\n"
 "Last-Translator: Frans Spiesschaert <[e-mail]>\n"
 "Language-Team: Debian Dutch l10n Team <[e-mail]>\n"
@@ -58,3 +58,28 @@ msgstr ""
 "ingesteld werden vanuit de verwachting dat de systeembeheerder SSH kan "
 "gebruiken met authenticatie via wachtwoord. Enkel wanneer u dit laatste niet "
 "nodig heeft, zou u deze wijziging kunnen doorvoeren."
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Not migrating to socket activation"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"This version of openssh-server uses socket-based activation by default. "
+"However, because you have more than one ListenAddress configured in "
+"sshd_config, it is impossible to determine at upgrade time if migrating you "
+"to socket-based activation would cause the starting of sshd at boot to be "
+"unreliable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Because a failure to start ssh may make it impossible to admininister a "
+"system, you will not be migrated to socket-based activation at this time."
+msgstr ""
diff --git a/debian/po/pt.po b/debian/po/pt.po
index 2dab84c..8f51af9 100644
--- a/debian/po/pt.po
+++ b/debian/po/pt.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh 1:6.6p1-1\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2014-03-20 02:06+0000\n"
+"POT-Creation-Date: 2022-09-23 19:34+0000\n"
 "PO-Revision-Date: 2014-03-21 21:13+0000\n"
 "Last-Translator: Américo Monteiro <[e-mail]>\n"
 "Language-Team: Portuguese <[e-mail]>\n"
@@ -57,3 +57,28 @@ msgstr ""
 "configurados com a expectativa de serem capazes de SSH como root usando "
 "autenticação por palavra-passe. Apenas deverá fazer esta alteração se não "
 "precisa de tal método de autenticação."
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Not migrating to socket activation"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"This version of openssh-server uses socket-based activation by default. "
+"However, because you have more than one ListenAddress configured in "
+"sshd_config, it is impossible to determine at upgrade time if migrating you "
+"to socket-based activation would cause the starting of sshd at boot to be "
+"unreliable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Because a failure to start ssh may make it impossible to admininister a "
+"system, you will not be migrated to socket-based activation at this time."
+msgstr ""
diff --git a/debian/po/pt_BR.po b/debian/po/pt_BR.po
index 99b1182..98856bb 100644
--- a/debian/po/pt_BR.po
+++ b/debian/po/pt_BR.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2014-03-20 02:06+0000\n"
+"POT-Creation-Date: 2022-09-23 19:34+0000\n"
 "PO-Revision-Date: 2014-11-23 23:49-0200\n"
 "Last-Translator: José de Figueiredo <[e-mail]>\n"
 "Language-Team: Brazilian Portuguese <[e-mail]."
@@ -55,3 +55,28 @@ msgstr ""
 "Entretanto, ela pode quebrar sistemas que foram configurados com a "
 "expectativa de acesso SSH com root usando autenticação por senha. Você deve "
 "fazer esta mudança somente se você não precisa fazer isso."
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Not migrating to socket activation"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"This version of openssh-server uses socket-based activation by default. "
+"However, because you have more than one ListenAddress configured in "
+"sshd_config, it is impossible to determine at upgrade time if migrating you "
+"to socket-based activation would cause the starting of sshd at boot to be "
+"unreliable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Because a failure to start ssh may make it impossible to admininister a "
+"system, you will not be migrated to socket-based activation at this time."
+msgstr ""
diff --git a/debian/po/ru.po b/debian/po/ru.po
index f2e1daf..3fa193c 100644
--- a/debian/po/ru.po
+++ b/debian/po/ru.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh 1:6.6p1-1\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2014-03-20 02:06+0000\n"
+"POT-Creation-Date: 2022-09-23 19:34+0000\n"
 "PO-Revision-Date: 2014-03-22 10:04+0400\n"
 "Last-Translator: Yuri Kozlov <[e-mail]>\n"
 "Language-Team: Russian <[e-mail]>\n"
@@ -14,8 +14,8 @@ msgstr ""
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n"
-"%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && "
+"n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
 "X-Generator: Lokalize 1.4\n"
 
 #. Type: boolean
@@ -55,3 +55,28 @@ msgstr ""
 "атак). Однако, это вредит системам, в которых специально настроен вход для "
 "root по SSH с парольной аутентификацией. Если это не ваш случай, то ответьте "
 "утвердительно."
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Not migrating to socket activation"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"This version of openssh-server uses socket-based activation by default. "
+"However, because you have more than one ListenAddress configured in "
+"sshd_config, it is impossible to determine at upgrade time if migrating you "
+"to socket-based activation would cause the starting of sshd at boot to be "
+"unreliable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Because a failure to start ssh may make it impossible to admininister a "
+"system, you will not be migrated to socket-based activation at this time."
+msgstr ""
diff --git a/debian/po/sv.po b/debian/po/sv.po
index 278b0cc..296e611 100644
--- a/debian/po/sv.po
+++ b/debian/po/sv.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2014-03-20 02:06+0000\n"
+"POT-Creation-Date: 2022-09-23 19:34+0000\n"
 "PO-Revision-Date: 2014-03-21 21:36+0100\n"
 "Last-Translator: Andreas Rönnquist <[e-mail]>\n"
 "Language-Team: Swedish\n"
@@ -56,3 +56,28 @@ msgstr ""
 "sådana angrepp). Dock så kan detta förstöra system som förväntas kunna "
 "använda SSH som root med hjälp av lösenordsautentisering. Du skall endast "
 "göra denna förändring om du inte har ett behov av att kunna göra detta."
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Not migrating to socket activation"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"This version of openssh-server uses socket-based activation by default. "
+"However, because you have more than one ListenAddress configured in "
+"sshd_config, it is impossible to determine at upgrade time if migrating you "
+"to socket-based activation would cause the starting of sshd at boot to be "
+"unreliable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Because a failure to start ssh may make it impossible to admininister a "
+"system, you will not be migrated to socket-based activation at this time."
+msgstr ""
diff --git a/debian/po/templates.pot b/debian/po/templates.pot
index 47c9e36..c9dc5ba 100644
--- a/debian/po/templates.pot
+++ b/debian/po/templates.pot
@@ -1,6 +1,6 @@
 # SOME DESCRIPTIVE TITLE.
 # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
-# This file is distributed under the same license as the PACKAGE package.
+# This file is distributed under the same license as the openssh package.
 # FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
 #
 #, fuzzy
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2014-03-20 02:06+0000\n"
+"POT-Creation-Date: 2022-09-23 19:34+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <[e-mail]>\n"
@@ -44,3 +44,28 @@ msgid ""
 "able to SSH as root using password authentication. You should only make this "
 "change if you do not need to do that."
 msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Not migrating to socket activation"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"This version of openssh-server uses socket-based activation by default. "
+"However, because you have more than one ListenAddress configured in "
+"sshd_config, it is impossible to determine at upgrade time if migrating you "
+"to socket-based activation would cause the starting of sshd at boot to be "
+"unreliable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Because a failure to start ssh may make it impossible to admininister a "
+"system, you will not be migrated to socket-based activation at this time."
+msgstr ""
diff --git a/debian/po/tr.po b/debian/po/tr.po
index 1ada041..fd6bde5 100644
--- a/debian/po/tr.po
+++ b/debian/po/tr.po
@@ -7,15 +7,15 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openssh-server\n"
 "Report-Msgid-Bugs-To: [e-mail]\n"
-"POT-Creation-Date: 2014-03-20 02:06+0000\n"
+"POT-Creation-Date: 2022-09-23 19:34+0000\n"
 "PO-Revision-Date: 2014-08-01 14:44+0200\n"
 "Last-Translator: Mert Dirik <[e-mail]>\n"
 "Language-Team: Debian L10n Turkish <[e-mail]>\n"
+"Language: tr\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "X-Generator: Poedit 1.5.4\n"
-"Language: tr\n"
 
 #. Type: boolean
 #. Description
@@ -56,3 +56,28 @@ msgstr ""
 "parola doğrulama yöntemiyle oturum açılabileceği varsayımıyla hareket eden "
 "sistemlerde eskiden çalışan düzenin bozulmasına sebep olacaktır. Bu "
 "değişikliği yalnızca sorun çıkarmayacağından eminseniz yapın."
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid "Not migrating to socket activation"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"This version of openssh-server uses socket-based activation by default. "
+"However, because you have more than one ListenAddress configured in "
+"sshd_config, it is impossible to determine at upgrade time if migrating you "
+"to socket-based activation would cause the starting of sshd at boot to be "
+"unreliable."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../openssh-server.templates:3001
+msgid ""
+"Because a failure to start ssh may make it impossible to admininister a "
+"system, you will not be migrated to socket-based activation at this time."
+msgstr ""
diff --git a/debian/rules b/debian/rules
index 18b2bf3..400fca7 100755
--- a/debian/rules
+++ b/debian/rules
@@ -186,8 +186,9 @@ override_dh_installinit:
 	dh_installinit -R --name ssh
 
 override_dh_installsystemd:
-	dh_installsystemd -popenssh-server ssh.service rescue-ssh.target
-	dh_installsystemd -popenssh-server --no-enable ssh.socket
+	dh_installsystemd -popenssh-server --no-start ssh.socket
+	dh_installsystemd -popenssh-server rescue-ssh.target
+	dh_installsystemd -popenssh-server --no-enable --no-start ssh.service
 
 debian/openssh-server.sshd.pam: debian/openssh-server.sshd.pam.in
 ifeq ($(DEB_HOST_ARCH_OS),linux)
diff --git a/debian/systemd/ssh.service b/debian/systemd/ssh.service
index 7495d9a..a18105b 100644
--- a/debian/systemd/ssh.service
+++ b/debian/systemd/ssh.service
@@ -14,8 +14,6 @@ KillMode=process
 Restart=on-failure
 RestartPreventExitStatus=255
 Type=notify
-RuntimeDirectory=sshd
-RuntimeDirectoryMode=0755
 
 [Install]
 WantedBy=multi-user.target
diff --git a/debian/tests/control b/debian/tests/control
index 8bc480a..0329ea0 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -8,3 +8,9 @@ Depends: devscripts,
          python3-twisted,
          sudo,
          sysvinit-utils,
+
+Tests: systemd-socket-activation
+Restrictions: needs-root allow-stderr
+Depends: openssh-client,
+         openssh-server,
+         systemd,
diff --git a/debian/tests/systemd-socket-activation b/debian/tests/systemd-socket-activation
new file mode 100644
index 0000000..42d4526
--- /dev/null
+++ b/debian/tests/systemd-socket-activation
@@ -0,0 +1,57 @@
+#!/bin/bash
+
+set -euo pipefail
+
+assert_unit_property() {
+    local property="$(echo "$2" | awk -F'=' '{print $1}')"
+
+    local expect="$2"
+    local actual="$(systemctl show -p "$property" "$1")"
+
+    if [[ "$actual" != "$expect" ]]; then
+        echo "Fail: $1: expected $expect, but got $actual"
+        return 1
+    fi
+}
+
+# Generate RSA key and add it to this user's authorized keys.
+ssh-keygen -t rsa -N "" -f "$HOME/.ssh/id_rsa" -q
+if [[ -f ~/.ssh/authorized_keys ]]; then
+    touch ~/.ssh/authorized_keys
+    chmod 0600 ~/.ssh/authorized_keys
+fi
+cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
+
+# Make sure ssh.service is not running.
+echo "Stopping ssh.service..."
+systemctl stop ssh.service 2>/dev/null
+
+# Check that ssh.socket is active and listening.
+echo "Checking that ssh.socket is active and listening..."
+assert_unit_property ssh.socket "ActiveState=active"
+assert_unit_property ssh.socket "SubState=listening"
+
+# Check that ssh.service is currently inactive/dead.
+echo "Checking that ssh.service is inactive/dead..."
+assert_unit_property ssh.service "ActiveState=inactive"
+assert_unit_property ssh.service "SubState=dead"
+
+# Check that a connection attempt successfully activates ssh.service.
+echo "Checking that a connection attempt activates ssh.service..."
+ssh -oStrictHostKeyChecking=no localhost -- /usr/bin/true
+assert_unit_property ssh.service "ActiveState=active"
+assert_unit_property ssh.service "SubState=running"
+
+# Check that we can re-execute sshd via systemctl reload.
+echo "Checking that sshd can be re-executed..."
+systemctl reload ssh.service
+assert_unit_property ssh.service "ActiveState=active"
+assert_unit_property ssh.service "SubState=running"
+
+# Check that we can run sshd in debug mode.
+echo "Checking sshd can run in debug mode..."
+systemctl stop ssh.service 2>/dev/null
+sed -i 's/^SSHD_OPTS=.*/SSHD_OPTS=-ddd/g' /etc/default/ssh
+ssh -oStrictHostKeyChecking=no localhost -- /usr/bin/true
+
+echo "Done."