diff --git a/docker/Dockerfile b/docker/Dockerfile index 2a7b1b635da52d904939f99628868f6fc69973d2_ZG9ja2VyL0RvY2tlcmZpbGU=..4ec39adb6b2a39bf62a8d404a2b15bb13bb77220_ZG9ja2VyL0RvY2tlcmZpbGU= 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -17,8 +17,7 @@ tzdata \ nano \ less \ - && rm -rf /var/lib/apt/lists/* \ - && sed 's/session\s*required\s*pam_loginuid.so/session optional pam_loginuid.so/g' -i /etc/pam.d/sshd + && rm -rf /var/lib/apt/lists/* # Remove MOTD RUN rm -rf /etc/update-motd.d /etc/motd /etc/motd.dynamic diff --git a/docker/assets/setup b/docker/assets/setup index 2a7b1b635da52d904939f99628868f6fc69973d2_ZG9ja2VyL2Fzc2V0cy9zZXR1cA==..4ec39adb6b2a39bf62a8d404a2b15bb13bb77220_ZG9ja2VyL2Fzc2V0cy9zZXR1cA== 100755 --- a/docker/assets/setup +++ b/docker/assets/setup @@ -46,7 +46,9 @@ groupadd -g 991 gitlab-consul # Create accounts -useradd -m -u 998 -g git -m -s /bin/sh -d /var/opt/gitlab git +## The git account is created with * as crypted password as ssh treats the account as locked if it has a ! +## Issue #5891 https://gitlab.com/gitlab-org/omnibus-gitlab +useradd -m -u 998 -g git -p '*' -m -s /bin/sh -d /var/opt/gitlab git useradd -m -u 999 -g gitlab-www -m -s /bin/false -d /var/opt/gitlab/nginx gitlab-www useradd -m -u 997 -g gitlab-redis -m -s /bin/false -d /var/opt/gitlab/redis gitlab-redis useradd -m -u 996 -g gitlab-psql -m -s /bin/sh -d /var/opt/gitlab/postgresql gitlab-psql diff --git a/docker/assets/sshd_config b/docker/assets/sshd_config index 2a7b1b635da52d904939f99628868f6fc69973d2_ZG9ja2VyL2Fzc2V0cy9zc2hkX2NvbmZpZw==..4ec39adb6b2a39bf62a8d404a2b15bb13bb77220_ZG9ja2VyL2Fzc2V0cy9zc2hkX2NvbmZpZw== 100644 --- a/docker/assets/sshd_config +++ b/docker/assets/sshd_config @@ -15,5 +15,4 @@ AuthorizedKeysCommand /opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell-authorized-keys-check git %u %k AuthorizedKeysCommandUser git -# Fix: User username not allowed because account is locked # With "UsePAM yes" the "!" is seen as a password disabled account and not fully locked so ssh public key login works @@ -19,5 +18,7 @@ # With "UsePAM yes" the "!" is seen as a password disabled account and not fully locked so ssh public key login works -UsePAM yes +# Please make sure that the account is created without passwordlogin ("*" in /etc/shadow) or configure pam. +# Issue #5891 https://gitlab.com/gitlab-org/omnibus-gitlab +UsePAM no # Disabling use DNS in ssh since it tends to slow connecting UseDNS no