Skip to content

Commit 0fa211d

Browse files
Fix ssh too open permission issue in sonic-mgmt image (#21184)
Why I did it Previously, the sonic-mgmt image encountered an issue where the SSH configuration was overly permissive, preventing the Docker container from starting successfully. The error message is provided below. This PR addresses and resolves the issue. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Permissions 0644 for '/etc/ssh/ssh_host_rsa_key' are too open. It is required that your private key files are NOT accessible by others. This private key will be ignored. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Permissions 0644 for '/etc/ssh/ssh_host_ecdsa_key' are too open. It is required that your private key files are NOT accessible by others. This private key will be ignored. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Permissions 0644 for '/etc/ssh/ssh_host_ed25519_key' are too open. It is required that your private key files are NOT accessible by others. This private key will be ignored. sshd: no hostkeys available -- exiting. ERROR: failed to start SSH service Work item tracking Microsoft ADO (number only): How I did it Add a step to reset permissions under the specific folder as #20346, which faced the same issue. How to verify it I tested in my local environment, and it could successfully start the docker. => [22/22] RUN if ! pip3 list | grep -c pytest >/dev/null && [ 'yutongzhang' != 'AzDevOps' ] && [ -d /var/AzDevOps/env-python3 ]; then /bin/bash -c 1.3s => exporting to image 12.1s => => exporting layers 12.0s => => writing image sha256:e3ed99ef8778d8e3aa50b1123b57747043d18982b7c34149f8ff304a996fedc9 0.0s => => naming to docker.io/library/docker-sonic-mgmt-yutongzhang:master 0.0s INFO: cleanup a temporary dir: /tmp/tmp.SUbOp2b2x2 INFO: creating a container: yutong_test ... 8e909a891449ac957c099d09fba146dc84128248aa242757edaa8a5098e272dd * Restarting OpenBSD Secure Shell server sshd ...done. INFO: verifying UID and GID in container matches host ****************************************************************************** EXEC: docker exec --user yutongzhang -ti yutong_test bash SSH: ssh -i ~/.ssh/id_rsa_docker_sonic_mgmt yutongzhang@172.17.0.2 ****************************************************************************** INFO: sonic-mgmt configuration is done!
1 parent 5e8e658 commit 0fa211d

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

.azure-pipelines/docker-sonic-mgmt.yml

+5
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,11 @@ stages:
3838
- template: cleanup.yml
3939
- checkout: self
4040
clean: true
41+
- script: |
42+
set -x
43+
sudo setfacl -R -b $(Agent.BuildDirectory)
44+
displayName: 'setfacl'
45+
4146
- bash: |
4247
set -xe
4348
git submodule update --init --recursive -- src/sonic-platform-daemons src/sonic-genl-packet src/sonic-sairedis src/ptf src/sonic-device-data src/sonic-dash-api

0 commit comments

Comments
 (0)