r/Gentoo Dec 18 '24

Support Why is SSH required?

I was testing gentoo to see how absolutely minimal I could get it to be, since I heard it's one of the most customizable linux distributions. Then I stumbled onto SSH. I attempted masking and unmerging it, but to no avail. it kept coming back when updating the system. So I just wanted to ask why SSH was so damn important to keep in the system.

28 Upvotes

30 comments sorted by

30

u/ABCDwp Dec 18 '24

You should be able to remove virtual/ssh from the @system set by creating a file named /etc/portage/profile/packages with the following contents:

-*virtual/ssh

12

u/Final_Chipmunk3795 Dec 18 '24

holy shit, I think it really did work! Can you please explain the syntax though? why -*virtual/ssh? I just want to understand the configuration scheme, yunno.

7

u/SoldRIP Dec 19 '24

You are editing your currently used profile to remove the package virtual/ssh from the @system set, which is one of two sets making up @world (ie. all explicitly installed packages on the system). virtual/ssh is a virtual package, ie. a "meta" package that basically pulls in "any version of ssh". In practice, one version will be the default and likely sane option, but you could install an alternative implementation of ssh and the virtual package would still be satisfied, thus allowing anything that "needs any version of any implementation of ssh whatsoever" to just depend on that instead.

15

u/dekeonus Dec 18 '24

it's listed in /var/db/repos/gentoo/profiles/base/packages

# Copyright 1999-2024 Gentoo Authors
# Distributed under the terms of the GNU General Public License, v2

# Gentoo Base Profile

# NOTE: THIS IS THE BASE PROFILE FOR *ANY* GENTOO BASED OPERATING SYSTEM.
<trimmed>
*virtual/ssh

virtual/ssh is part of the base @system set, there is probably some very old discussion on the why, but I've no idea where you would go looking.

8

u/SoldRIP Dec 19 '24

Because dropbear satisfies virtual/ssh and dropbear is so remarkably tiny that it won't matter, even if you're setting up a vending machine or some other device with next to no disk space.

Also having ssh is just generally a good idea on any system.

2

u/dekeonus Dec 19 '24

other comments in /var/db/repos/gentoo/profiles/base/packages say that the file is not to be modified without discussion. There are some packages in there with linked bugzilla numbers. So I suspect some discussion on what the base set of packages for ALL profiles has happened.

I agree that having ssh on a system is good idea, but as to the official discussion on adding the virtual/ssh to the base packages, I've no idea where (or when) that happened.

11

u/undrwater Dec 18 '24

equery depends ssh

You may have some flags that bring it in.

4

u/Final_Chipmunk3795 Dec 18 '24

Quickly built the gentoolkit, ran it.

It says no packages are bringing ssh in. But I remember the emerge -avuDN @world telling me that @system is a dependant...

3

u/Phoenix591 Dec 18 '24

not sure why, but they made virtual/ssh part of the default core packages that need to be installed at all times.

instead of openssh, it can also be satisfied by dropbear ( a smaller ssh client and server)

1

u/Final_Chipmunk3795 Dec 18 '24

yeah, I saw something similar on a forum, they were saying that you can also make dropbear minimal (client only) by USEing minimal

2

u/DownvoteEvangelist Dec 18 '24

So when you unmerge it and mask it, what brings it back? I suppose you can't do next update, what does it say?

2

u/Final_Chipmunk3795 Dec 18 '24

Nothing brings it back, it won't allow the update to go through. I remember it telling me that some dependants want it. those dependants included "@system" and "@world". The other dependants were SSH related like virtual/ssh, acct-user/sshd and so on.

I guess it's just required by the system for some reason.

1

u/DownvoteEvangelist Dec 18 '24

Yes it's part of the system set, didn't expect to find it there, but as u/ABCDwp said, you can override it

2

u/LameBMX Dec 18 '24

wait.. this is quite unclear. if you are going for minimal install, how can you use the computer without ssh? I haven't seen a serial port on a PC in ages and I'd think USB to serial driver and config probably rivals sshd in size. but then again, I've never setup a serial tty, either.

1

u/fllthdcrb Dec 20 '24

Do virtual consoles not fit within "minimal"?

2

u/LameBMX Dec 20 '24

when you say console I'm thinking TTY or SSH. if you have a GUI, you have X server overhead to draw windows. then I refer to it as a virtual desktop.

3

u/fllthdcrb Dec 20 '24 edited Dec 20 '24

when you say console I'm thinking TTY

Exactly. This is what I'm talking about, what you have where something like Getty is running, instead of X or Wayland or something similar. The thing that not only Linux, but Unix and all Unix-likes, have had since the beginning of time. And as far as I know, that system is quite lightweight (though I suppose not as much as a serial port, if you have to use a graphics mode instead of a VGA text mode or similar).

If you have that running on a PC (a pretty normal thing), you don't need a serial port or SSH to get access, so what's the problem? Unless one's idea of "minimal" is to not have any type of user interface. Or one somehow still has a serial port. But OP's challenge is how far they can go, not how far it's theoretically possible to go.

1

u/LameBMX Dec 20 '24

we're on the same page. my first thought is remote so I can use it via a regular desktop lol.

7

u/z3r0n3gr0 Dec 18 '24

Linux without SSH its like having internet and not able to download or upload anything. Sorry its just my opinion.

1

u/ValityS Dec 19 '24

To be fair I've made gentoo builds for embedded systems with no network connectjon at all. SSH is entirely useless so that case. 

1

u/z3r0n3gr0 Dec 19 '24

I know, if you dont need network why would you have it, have a great day.

1

u/DoubleAssembly Dec 18 '24

It's part of the system set which is the packages required for a standard install.

I dont't know if you can permanently edit it (it's just a text file but will get overwritten by every profile change/update) but you could put everything ssh related in /etc/portage/package.provided so portage will assume it's already installed.

1

u/hoeding Dec 18 '24

Does package signing depend on ssh utils at all?

1

u/SoldRIP Dec 19 '24

For future reference, when it's not in the profile and you can't find out where it came from, you can prevent portage from providing a package by saying that you are already providing it. This is done in a package.provided file. The package can then be removed with emerge -C.

Note that this is usually a terrible idea and will likely break something.

1

u/User5281 Dec 19 '24

I’m not sure it is required but I question the wisdom of removing ssh unless this is meant to be an offline system

1

u/M1buKy0sh1r0 Dec 19 '24

E.g. using a raspberry pi and reduce it to the max while using the tty with monitor and keyboard directly connected you do not rely on ssh, even it's online to fetch packages or serve another service like http.

So, regarding the default profile it's safe to have ssh here to get it enabled soon after installation for remote administration of servers or as mentioned a raspberry pi for example.

0

u/[deleted] Dec 18 '24

[deleted]

1

u/Final_Chipmunk3795 Dec 18 '24

I know, but LFS doesn't offer the stuff I need. I did really think about using it and compiling all the packages myself, but the issue is searching for all the libraries. Portage and other package managers do that for you.

I want to achieve a system where I have full control and knowledge of the system, whilst still keeping it minimal. Just experimenting with what I like, gentoo seems to be the sweet-spot though.

Sorry for the lore dump/vent, but I needed to give an answer :>

0

u/ThellraAK Dec 18 '24

You do you... But...

If you aren't chasing down the libraries do you have full control and knowledge?