# HG changeset patch # User Hans Freitag <zem@fnordpol.de> # Date 1611393602 -3600 # Sat Jan 23 10:20:02 2021 +0100 # Node ID 4ec39adb6b2a39bf62a8d404a2b15bb13bb77220 # Parent 2a7b1b635da52d904939f99628868f6fc69973d2 configure sshd and git account so that pam is not used any longer The reason is that some container systems don't run containers with CAP_AUDIT_WRITE which is needed for pam. As the comment in sshd_config has pointed out pam was used as a Fix because it handles shadow entries '!' and '*' differently from ssh. This commit refixes that fix and creates the git account with '*' (no password login) and disables pam in sshd_config Fixes #5891 diff --git a/docker/Dockerfile b/docker/Dockerfile --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -17,8 +17,7 @@ tzdata \ nano \ less \ - && rm -rf /var/lib/apt/lists/* \ - && sed 's/session\s*required\s*pam_loginuid.so/session optional pam_loginuid.so/g' -i /etc/pam.d/sshd + && rm -rf /var/lib/apt/lists/* # Remove MOTD RUN rm -rf /etc/update-motd.d /etc/motd /etc/motd.dynamic diff --git a/docker/assets/setup b/docker/assets/setup --- a/docker/assets/setup +++ b/docker/assets/setup @@ -46,7 +46,9 @@ groupadd -g 991 gitlab-consul # Create accounts -useradd -m -u 998 -g git -m -s /bin/sh -d /var/opt/gitlab git +## The git account is created with * as crypted password as ssh treats the account as locked if it has a ! +## Issue #5891 https://gitlab.com/gitlab-org/omnibus-gitlab +useradd -m -u 998 -g git -p '*' -m -s /bin/sh -d /var/opt/gitlab git useradd -m -u 999 -g gitlab-www -m -s /bin/false -d /var/opt/gitlab/nginx gitlab-www useradd -m -u 997 -g gitlab-redis -m -s /bin/false -d /var/opt/gitlab/redis gitlab-redis useradd -m -u 996 -g gitlab-psql -m -s /bin/sh -d /var/opt/gitlab/postgresql gitlab-psql diff --git a/docker/assets/sshd_config b/docker/assets/sshd_config --- a/docker/assets/sshd_config +++ b/docker/assets/sshd_config @@ -15,9 +15,10 @@ AuthorizedKeysCommand /opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell-authorized-keys-check git %u %k AuthorizedKeysCommandUser git -# Fix: User username not allowed because account is locked # With "UsePAM yes" the "!" is seen as a password disabled account and not fully locked so ssh public key login works -UsePAM yes +# Please make sure that the account is created without passwordlogin ("*" in /etc/shadow) or configure pam. +# Issue #5891 https://gitlab.com/gitlab-org/omnibus-gitlab +UsePAM no # Disabling use DNS in ssh since it tends to slow connecting UseDNS no