You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fix ssh too open permission issue in sonic-mgmt image (#21184)
Why I did it
Previously, the sonic-mgmt image encountered an issue where the SSH configuration was overly permissive, preventing the Docker container from starting successfully. The error message is provided below. This PR addresses and resolves the issue.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/etc/ssh/ssh_host_rsa_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/etc/ssh/ssh_host_ecdsa_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for '/etc/ssh/ssh_host_ed25519_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
sshd: no hostkeys available -- exiting.
ERROR: failed to start SSH service
Work item tracking
Microsoft ADO (number only):
How I did it
Add a step to reset permissions under the specific folder as #20346, which faced the same issue.
How to verify it
I tested in my local environment, and it could successfully start the docker.
=> [22/22] RUN if ! pip3 list | grep -c pytest >/dev/null && [ 'yutongzhang' != 'AzDevOps' ] && [ -d /var/AzDevOps/env-python3 ]; then /bin/bash -c 1.3s
=> exporting to image 12.1s
=> => exporting layers 12.0s
=> => writing image sha256:e3ed99ef8778d8e3aa50b1123b57747043d18982b7c34149f8ff304a996fedc9 0.0s
=> => naming to docker.io/library/docker-sonic-mgmt-yutongzhang:master 0.0s
INFO: cleanup a temporary dir: /tmp/tmp.SUbOp2b2x2
INFO: creating a container: yutong_test ...
8e909a891449ac957c099d09fba146dc84128248aa242757edaa8a5098e272dd
* Restarting OpenBSD Secure Shell server sshd
...done.
INFO: verifying UID and GID in container matches host
******************************************************************************
EXEC: docker exec --user yutongzhang -ti yutong_test bash
SSH: ssh -i ~/.ssh/id_rsa_docker_sonic_mgmt yutongzhang@172.17.0.2
******************************************************************************
INFO: sonic-mgmt configuration is done!
0 commit comments