Skip to content

Commit

Permalink
Fix ssh too open permission issue in sonic-mgmt image. (#21757)
Browse files Browse the repository at this point in the history
Why I did it
Previously, the sonic-mgmt image encountered an issue where the SSH configuration was overly permissive, preventing the Docker container from starting successfully. The error message is provided below. This PR addresses and resolves the issue.

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/etc/ssh/ssh_host_rsa_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/etc/ssh/ssh_host_ecdsa_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/etc/ssh/ssh_host_ed25519_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
sshd: no hostkeys available -- exiting.

ERROR: failed to start SSH service

How I did it
Add a step to reset permissions under the specific folder as #20346, which faced the same issue.

How to verify it
Same as #21184
  • Loading branch information
yutongzhang-microsoft authored Feb 20, 2025
1 parent b593798 commit 0fd75cd
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions .azure-pipelines/docker-sonic-mgmt-py3-only.yml
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,12 @@ stages:
- template: cleanup.yml
- checkout: self
clean: true

- script: |
set -x
sudo setfacl -R -b $(Agent.BuildDirectory)
displayName: 'setfacl'
- bash: |
set -xe
git submodule update --init --recursive -- src/sonic-platform-daemons src/sonic-genl-packet src/sonic-sairedis src/ptf src/sonic-device-data src/sonic-dash-api
Expand Down

0 comments on commit 0fd75cd

Please sign in to comment.