After exiting "ssh-agent -s" and "applet.py" processes remain lingering. Proposed solution.

[maacruz]

I have found out that each new remote desktop spawns a "ssh-agent -s" and a system-config-printer "applet.py" process which will remain once the desktop session is closed, preventing the systemd session from exiting normally.
This happens at least when using lightdm, I haven't tried with other display managers.

The problem with applet.py is known upstream and is WONTFIX. It's been reported to happen with sddm, kdm and lightdm.

I propose the following solution for lightdm:

1. Edit /etc/lightdm/lightdm.conf and put this line under section [Seat:*]
   session-cleanup-script=/etc/lightdm/session-cleanup-script.sh

2. Create the file /etc/lightdm/session-cleanup-script.sh with the following content

#!/bin/bash
#exec >/tmp/lightdm-cleanup-script.log 2>&1 #uncomment this line to log any error output when the script is run

# kill lingering applet.py and "ssh-agent -s" processes

ALL_SESSION_ID=$(loginctl list-sessions|cut -c -7|grep -E "[0-9]+$")
for SESSION_ID in $ALL_SESSION_ID; do
        SESSION_SCOPE=$(systemd-cgls --no-pager -u session-$SESSION_ID.scope)
        LEADER_PID=$(loginctl -p Leader --value show-session $SESSION_ID)
        # get the pids using grep -noE to extract strings of numbers prepended by line_number':'. There can be more than one hit per line so use uniq to keep just the first result. uniq comparison works only up to 99 lines.
        SESSION_PIDS=$(echo "$SESSION_SCOPE"|grep -noE "[1-9][0-9]*"|uniq -w 2|cut -f 2 -d ':')
        # if leader PID doesn't exist anymore
        if [[ ! " ${SESSION_PIDS} " =~ [[:space:]]${LEADER_PID}[[:space:]] ]]; then
                PIDS=$(echo "$SESSION_SCOPE"|grep -E "(applet.py)|(ssh-agent -s)"|grep -noE "[1-9][0-9]*"|uniq -w 2|cut -f 2 -d ':')
                # kill processes
                for PID in $PIDS; do kill $PID; done
        fi
done

3. Make the script executable with
   chmod +x /etc/lightdm/session-cleanup-script.sh

4. Restart lightdm
   systemctl restart lightdm

Explanation: I haven't managed to get the current systemd session scope for the lightdm process launching the session-cleanup script ("loginctl session-status" returns error), so I resorted to kill all "ssh-agent -s" and "applet.py" processes on all systemd session scopes where the leader has already been killed.
This script will be run each time the desktop session is terminated.
A bit blunt but works fine.

[gitbls]

Thanks for researching and writing this up! I'll have a look into it in the next several days.

Presumably you're doing this on a RasPiOS Bookworm system With Desktop, but can you please confirm the system on which you've identified this issue? Thx!

[maacruz]

Actually, it is a RasPiOS Buster with Desktop. I also have another one with Bullseye where I can implement this setup, if you want me to check another system.
The applet.py upstream bug report is here OpenPrinting/system-config-printer#175. It's been confirmed on a variety of systems (Ubuntu, Fedora...).
The latest version of applet.py implements a check in order not to start more than one instance (which it'll usually be the first desktop session started), but this doesn't make the applet.py exit when its session leader terminates so that systemd session won't be able to terminate and will remain forever.

[gitbls]

Buster is 4+ years old now. Even Bullseye is 2+ years old at this point.

Since you have a solution, albeit blunt, that works for you, I'm going to take a pass on doing anything about this, since my interests are always in looking forward to future versions, not supporting relatively ancient OSen.