Task "Ensure ssh service is started after disabling socket activation" fails

@pbol-samedi

We get an error now during ansible build:

...
==> openstack.instance: TASK [devsec.hardening.ssh_hardening : Ensure ssh service is started after disabling socket activation] ***
==> openstack.instance: [ERROR]: Task failed: Module failed: Unable to start service ssh: Failed to start ssh.service: Unit ssh.socket is masked.
==> openstack.instance:
==> openstack.instance: Origin: /root/.ansible/collections/ansible_collections/devsec/hardening/roles/ssh_hardening/tasks/disable-systemd-socket.yml:18:3
==> openstack.instance:
==> openstack.instance: 16     - /etc/systemd/system/sockets.target.wants/ssh.socket
==> openstack.instance: 17
==> openstack.instance: 18 - name: Ensure ssh service is started after disabling socket activation
==> openstack.instance:      ^ column 3
==> openstack.instance:
==> openstack.instance: fatal: [localhost]: FAILED! => {"changed": false, "msg": "Unable to start service ssh: Failed to start ssh.service: Unit ssh.socket is masked.\n"}
...

Pinning the version to 10.5.0 worked for us

Originally posted by @pbol-samedi in #931 (comment)

@pbol-samedi

@pbol-samedi Can you please add some more information:

what OS are you using?
which Ansible Version?
Are you using custom parameters for the role?

@schurzi

Hi @schurzi, thanks for creating the new issue.

Ubuntu 24.04, amd64 architecture
ansible version 13.5.0 (latest)
yes, we use these ssh_ variables (some might still be from the dev-sec role):

ssh_allow_agent_forwarding: true
ssh_allow_tcp_forwarding: true
ssh_use_pam: true
ssh_server_ports:
  - 22277
ssh_ciphers:
  - aes256-ctr
  - aes192-ctr
  - aes128-ctr
ssh_macs:
  - hmac-sha2-512
  - hmac-sha2-256
ssh_login_grace_time: 30
ssh_kex:
  - curve25519-sha256@libssh.org
  - diffie-hellman-group-exchange-sha256

I run into this as well on my test ubuntu 24.04.4 install. To fix, I have to go in and delete the socket want for ssh.service. I'm also on 13.5 and am only using the following ssh_ var:
ssh_permit_root_login: prohibit-password

@WhatsCS

@WhatsCS this is interesting, we have one task that deletes all remaining files before restarting ssh.service. Can you check the output of the task Remove ssh service systemd-socket file on your test machine? Does it include the socket want file for you?

Possible stupid question: Should this be ran locally? The task order is to shut down ssh for the socket activation, then deletes the want, then restarts. Unless I've misconfigured ansible, wouldn't that logically kill the ssh connection?

Should this be ran locally? The task order is to shut down ssh for the socket activation, then deletes the want, then restarts. Unless I've misconfigured ansible, wouldn't that logically kill the ssh connection?

The role can be applied locally and remote via SSH. A running SSH connection has a forked server process and stopping the systemd service only makes new connections impossible.

Okay, so my ssh connection is definitely not surviving then for one reason or another. Thus causing the deletion of files to not trigger. I'll try locally as well to triple check.

Works when ran locally, so I suspect either I'm not facing the same issue (sorry!) or they are seeing the same but it's propagating as a different error for one reason or another?

I needed controlpath configurations setup so this was an issue of ansible just not being configured for persistent ssh connections. I suspect similar for OP but they've unfortunately not provided prior task info so no way to know if they're hitting something similar.

Apparently my Ubuntu 24.04 image had ssh.socket configured with RequiredBy=ssh.service in its [Install] section which created a /etc/systemd/system/ssh.service.requires/ssh.socket symlink. That's what added Requires=ssh.socket to ssh.service at runtime. ssh-hardening removes the symlink but systemctl mask doesn't trigger a daemon_reload. So systemd's in-memory state still sees the Requires dependency and the fail starts. So I had to remove the symlink + daemon_reload in as a "pre_task":

- name: Remove ssh.socket requires symlink (Ubuntu 24.04+ / devsec.hardening workaround)
  ansible.builtin.file:
    path: /etc/systemd/system/ssh.service.requires/ssh.socket
    state: absent
  notify: Reload systemd daemon
  when:
    - ansible_distribution == 'Ubuntu'
    - ansible_distribution_major_version | int >= 24

Hello, I ran into a similar problem on Ubuntu 24.04:

$ lsb_release -a
Distributor ID: Ubuntu
Description:    Ubuntu 24.04.4 LTS
Release:        24.04
Codename:       noble

$ uname -a
Linux host.example.org 6.8.0-124-generic #124-Ubuntu SMP PREEMPT_DYNAMIC Tue May 26 13:00:45 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux

---
collections:
  - name: devsec.hardening
    version: 10.6.0

# Custom parameters for the role
---
ssh_permit_root_login: prohibit-password
ssh_server_accept_env_vars: "LANG LC_*"

$ ansible --version
ansible [core 2.21.0]
  config file = /Users/username/SourceCode/my-infrastructure-as-code/ansible.cfg
  configured module search path = ['/Users/username/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /opt/homebrew/Cellar/ansible/14.0.0_1/libexec/lib/python3.14/site-packages/ansible
  ansible collection location = /Users/username/.ansible/collections:/usr/share/ansible/collections
  executable location = /opt/homebrew/bin/ansible
  python version = 3.14.6 (main, Jun 10 2026, 10:03:53) [Clang 21.0.0 (clang-2100.0.123.102)] (/opt/homebrew/Cellar/ansible/14.0.0_1/libexec/bin/python)
  jinja version = 3.1.6
  pyyaml version = 6.0.3 (with libyaml v0.2.5)

This was fixed by adding Reload systemd units; see below for more details:

---  
- name: Run SSH Hardening  
  hosts: hardening  
  become: true  
  
  pre_tasks:  
    - name: Disable systemd-socket activation  
      ansible.builtin.systemd:  
        name: ssh.socket  
        state: stopped  
        enabled: false  
        masked: true  
      when: ansible_facts['os_family'] == "Debian"  
  
    - name: Remove ssh service systemd-socket file  
      ansible.builtin.file:  
        path: "{{ item }}"  
        state: absent  
      loop:  
        - /etc/systemd/system/ssh.service.d/00-socket.conf  
        - /etc/systemd/system/ssh.service.requires/ssh.socket  
        - /etc/systemd/system/sockets.target.wants/ssh.socket  
      when: ansible_facts['os_family'] == "Debian"  
  
    - name: Reload systemd units  
      ansible.builtin.systemd_service:  
        daemon_reload: true  
      when: ansible_facts['os_family'] == "Debian"  
  
    - name: Enable and start classic ssh.service  
      ansible.builtin.systemd_service:  
        name: ssh.service  
        enabled: true  
        state: started  
      when: ansible_facts['os_family'] == "Debian"  
  
  roles:  
    - devsec.hardening.ssh_hardening

Note: This is just a workaround for Ubuntu; I don't think it's a good solution, but I hope it can serve as a basis for a proper fix for the devsec.hardening.ssh_hardening role.

Log showing the error when running the Enable and start classic ssh.service task:

TASK [Gathering Facts] *******************************************************************************************************************************************************************  
ok: [host.example.org]  
  
TASK [devsec.hardening.ssh_hardening : Validating arguments against arg spec 'main' - The main entry point for the ssh hardening role.] **************************************************  
ok: [host.example.org]  
  
TASK [devsec.hardening.ssh_hardening : Include hardening tasks] **************************************************************************************************************************  
included: /Users/username/.ansible/collections/ansible_collections/devsec/hardening/roles/ssh_hardening/tasks/hardening.yml for host.example.org  
  
TASK [devsec.hardening.ssh_hardening : Fetch OS dependent variables] *********************************************************************************************************************  
ok: [host.example.org] => (item=/Users/username/.ansible/collections/ansible_collections/devsec/hardening/roles/ssh_hardening/vars/Debian.yml)  
  
TASK [devsec.hardening.ssh_hardening : Set OS dependent variables, if not already defined by user] ***************************************************************************************  
ok: [host.example.org] => (item={'key': 'ssh_pkgs', 'value': ['openssh-server', 'openssh-client']})  
ok: [host.example.org] => (item={'key': 'sshd_path', 'value': '/usr/sbin/sshd'})  
ok: [host.example.org] => (item={'key': 'ssh_host_keys_dir', 'value': '/etc/ssh'})  
ok: [host.example.org] => (item={'key': 'sshd_service_name', 'value': 'ssh'})  
ok: [host.example.org] => (item={'key': 'ssh_owner', 'value': 'root'})  
ok: [host.example.org] => (item={'key': 'ssh_group', 'value': 'root'})  
ok: [host.example.org] => (item={'key': 'ssh_host_keys_owner', 'value': 'root'})  
ok: [host.example.org] => (item={'key': 'ssh_host_keys_group', 'value': 'root'})  
ok: [host.example.org] => (item={'key': 'ssh_host_keys_mode', 'value': '0600'})  
ok: [host.example.org] => (item={'key': 'ssh_selinux_packages', 'value': ['policycoreutils-python-utils', 'checkpolicy']})  
ok: [host.example.org] => (item={'key': 'ssh_kerberos_support', 'value': True})  
ok: [host.example.org] => (item={'key': 'ssh_pam_support', 'value': True})  
ok: [host.example.org] => (item={'key': 'sshd_moduli_file', 'value': '/etc/ssh/moduli'})  
ok: [host.example.org] => (item={'key': 'sshd_disable_crypto_policy', 'value': False})  
  
TASK [devsec.hardening.ssh_hardening : Install openssh package and configure the service] ************************************************************************************************  
included: /Users/username/.ansible/collections/ansible_collections/devsec/hardening/roles/ssh_hardening/tasks/install.yml for host.example.org  
  
TASK [devsec.hardening.ssh_hardening : Install openssh package(s)] ***********************************************************************************************************************  
ok: [host.example.org] => (item=openssh-server)  
ok: [host.example.org] => (item=openssh-client)  
  
TASK [devsec.hardening.ssh_hardening : Change Debian/Ubuntu systems so ssh starts traditionally instead of socket-activated] *************************************************************  
included: /Users/username/.ansible/collections/ansible_collections/devsec/hardening/roles/ssh_hardening/tasks/disable-systemd-socket.yml for host.example.org  
  
TASK [devsec.hardening.ssh_hardening : Disable systemd-socket activation] ****************************************************************************************************************  
changed: [host.example.org]  
  
TASK [devsec.hardening.ssh_hardening : Remove ssh service systemd-socket file] ***********************************************************************************************************  
ok: [host.example.org] => (item=/etc/systemd/system/ssh.service.d/00-socket.conf)  
changed: [host.example.org] => (item=/etc/systemd/system/ssh.service.requires/ssh.socket)  
changed: [host.example.org] => (item=/etc/systemd/system/sockets.target.wants/ssh.socket)  
  
TASK [devsec.hardening.ssh_hardening : Ensure ssh service is started after disabling socket activation] **********************************************************************************  
[ERROR]: Task failed: Module failed: Unable to start service ssh: Failed to start ssh.service: Unit ssh.socket is masked.  
  
Origin: /Users/username/.ansible/collections/ansible_collections/devsec/hardening/roles/ssh_hardening/tasks/disable-systemd-socket.yml:18:3  
  
16     - /etc/systemd/system/sockets.target.wants/ssh.socket  
17  
18 - name: Ensure ssh service is started after disabling socket activation  
     ^ column 3  
  
fatal: [host.example.org]: FAILED! => {"changed": false, "msg": "Unable to start service ssh: Failed to start ssh.service: Unit ssh.socket is masked.\n"}  
  
PLAY RECAP *******************************************************************************************************************************************************************************  
host.example.org           : ok=75   changed=25   unreachable=0    failed=1    skipped=2    rescued=0    ignored=0

I think it's caused by this commit: d748703

NOW it's

Disable systemd-socket activation
        ↓
Remove ssh service systemd-socket file
        ↓
Ensure ssh service is started after disabling socket activation

I think it should be

Remove ssh service systemd-socket file
        ↓
systemctl daemon-reload
        ↓
Disable systemd-socket activation
        ↓
Ensure ssh service is started after disabling socket activation

Also affects Ubuntu 26.04.1 (resolute) with devsec.hardening 11.0.0 (openssh-server 1:10.2p1-2ubuntu3.8, ansible-core 2.21.5). After the failed task, ssh.service still has Requires=ssh.socket and nothing listens on port 22 anymore, so a remote host is locked out except for the session that's still open.

I tested #986 on the same fresh setup: it fixes this. sshd runs as a service, the socket is masked, logins work, a second run is clean, and SSH survives a restart.

Until it's released, a workaround before the role is to remove /etc/systemd/system/ssh.service.requires/ssh.socket, run systemctl daemon-reload, then mask ssh.socket and start ssh.service.

Navigation Menu

Repository navigation

Task "Ensure ssh service is started after disabling socket activation" fails #941

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Task "Ensure ssh service is started after disabling socket activation" fails #941

Description

Activity

schurzi commented on Mar 30, 2026

pbol-samedi commented on Mar 31, 2026

WhatsCS commented on Apr 12, 2026

schurzi commented on Apr 12, 2026

WhatsCS commented on Apr 12, 2026

schurzi commented on Apr 12, 2026

WhatsCS commented on Apr 12, 2026

WhatsCS commented on Apr 12, 2026

WhatsCS commented on Apr 12, 2026

pbol-samedi commented on May 8, 2026

xorcare commented on Jun 18, 2026

eyebrowkang commented on Aug 10, 2026

jdreesen commented on Oct 20, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions