OpenRC SSH daemon default listen-on-all-interfaces without firewall rule

Answer

No. OpenRC does not restrict where sshd listens and it does not provide a firewall. Whether Artix should ship a default restrictive firewall profile for SSH is a distribution policy choice, not an OpenRC behavior. The current exposure you describe is the combination of OpenSSH’s stock listening defaults and the absence of any packet filter on the base ISO.

Without a known trusted management subnet for your deployment, a safe default rule cannot be specified. If you can confirm the admin access network, a minimal allow-list can be applied via ListenAddress or nftables/iptables. Otherwise the conservative option is to keep SSH listening on all interfaces and rely on authentication hardening with no implicit deny that could lock out recovery access.

Confirmed facts

• OpenRC init scripts do not set network listening parameters. /etc/init.d/sshd starts the OpenSSH server with options from /etc/conf.d/sshd and /etc/ssh/sshd_config.
• OpenSSH sshd default configuration is to listen on all available addresses. With no ListenAddress directive sshd binds 0.0.0.0:22 and :::22. This is independent of init system.
• OpenRC provides no firewall by default. Packet filtering via iptables/nftables/firewalld is separate and not enabled or configured by OpenRC itself.

Likely explanation for observed exposure

sshd is running with stock sshd_config and no ListenAddress restriction, so it accepts connections on every interface, and no host-based firewall rule is blocking port 22. That is why the port is reachable from any network host unless an administrator adds rules.

Steps needed for this case

1. Verify effective sshd config:

   grep -E '^ListenAddress' /etc/ssh/sshd_config || echo 'not set, defaults to all'

2. Verify listening sockets:

   ss -tlnp | grep :22

3. Check service state:

   rc-service sshd status

4. Confirm firewall state:

   nft list ruleset

   or

   iptables -L -n -v

5. If you want interface-level restriction without editing sshd_config, add a per-interface accept/drop rule with nftables/iptables and ensure persistence across reboots. If you prefer sshd-level restriction, set ListenAddress to required IP(s) in /etc/ssh/sshd_config, reload with rc-service sshd restart, and re-verify with ss.

Caution: Changing ListenAddress can lock you out if the specified address is unreachable from your management host. Test from a console first. IPv4 and IPv6 are configured independently; restricting IPv4 only leaves ::: open unless explicitly restricted.

Missing diagnostic detail that changes the recommendation: what subnet or interface is considered trusted for administrative access in your Artix deployment? A default rule criteria depends on that.