Skip to content

Commit

Permalink
Fix ssh too open permission issue in sonic-mgmt image (#21184)
Browse files Browse the repository at this point in the history
Why I did it
Previously, the sonic-mgmt image encountered an issue where the SSH configuration was overly permissive, preventing the Docker container from starting successfully. The error message is provided below. This PR addresses and resolves the issue.

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/etc/ssh/ssh_host_rsa_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/etc/ssh/ssh_host_ecdsa_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/etc/ssh/ssh_host_ed25519_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
sshd: no hostkeys available -- exiting.

ERROR: failed to start SSH service
Work item tracking
Microsoft ADO (number only):
How I did it
Add a step to reset permissions under the specific folder as #20346, which faced the same issue.

How to verify it
I tested in my local environment, and it could successfully start the docker.

 => [22/22] RUN if ! pip3 list | grep -c pytest >/dev/null && [ 'yutongzhang' != 'AzDevOps' ] && [ -d /var/AzDevOps/env-python3 ]; then /bin/bash -c   1.3s
 => exporting to image                                                                                                                                12.1s
 => => exporting layers                                                                                                                               12.0s
 => => writing image sha256:e3ed99ef8778d8e3aa50b1123b57747043d18982b7c34149f8ff304a996fedc9                                                           0.0s
 => => naming to docker.io/library/docker-sonic-mgmt-yutongzhang:master                                                                                0.0s
INFO: cleanup a temporary dir: /tmp/tmp.SUbOp2b2x2
INFO: creating a container: yutong_test ...
8e909a891449ac957c099d09fba146dc84128248aa242757edaa8a5098e272dd
 * Restarting OpenBSD Secure Shell server sshd
   ...done.
INFO: verifying UID and GID in container matches host
******************************************************************************
EXEC: docker exec --user yutongzhang -ti yutong_test bash
SSH:  ssh -i ~/.ssh/id_rsa_docker_sonic_mgmt [email protected]
******************************************************************************

INFO: sonic-mgmt configuration is done!
  • Loading branch information
yutongzhang-microsoft authored Feb 17, 2025
1 parent 5e8e658 commit 0fa211d
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions .azure-pipelines/docker-sonic-mgmt.yml
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,11 @@ stages:
- template: cleanup.yml
- checkout: self
clean: true
- script: |
set -x
sudo setfacl -R -b $(Agent.BuildDirectory)
displayName: 'setfacl'
- bash: |
set -xe
git submodule update --init --recursive -- src/sonic-platform-daemons src/sonic-genl-packet src/sonic-sairedis src/ptf src/sonic-device-data src/sonic-dash-api
Expand Down

0 comments on commit 0fa211d

Please sign in to comment.