# HG changeset patch
# User Hans Freitag <zem@fnordpol.de>
# Date 1611393602 -3600
#      Sat Jan 23 10:20:02 2021 +0100
# Node ID 4ec39adb6b2a39bf62a8d404a2b15bb13bb77220
# Parent  2a7b1b635da52d904939f99628868f6fc69973d2
configure sshd and git account so that pam is not used any longer

The reason is that some container systems don't run containers with
CAP_AUDIT_WRITE which is needed for pam. As the comment in sshd_config
has pointed out pam was used as a Fix because it handles shadow entries
'!' and '*' differently from ssh. This commit refixes that fix and
creates the git account with '*' (no password login) and disables pam in
sshd_config

Fixes #5891

diff --git a/docker/Dockerfile b/docker/Dockerfile
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -17,8 +17,7 @@
       tzdata \
       nano \
       less \
-    && rm -rf /var/lib/apt/lists/* \
-    && sed 's/session\s*required\s*pam_loginuid.so/session optional pam_loginuid.so/g' -i /etc/pam.d/sshd
+    && rm -rf /var/lib/apt/lists/*
 
 # Remove MOTD
 RUN rm -rf /etc/update-motd.d /etc/motd /etc/motd.dynamic
diff --git a/docker/assets/setup b/docker/assets/setup
--- a/docker/assets/setup
+++ b/docker/assets/setup
@@ -46,7 +46,9 @@
 groupadd -g 991 gitlab-consul
 
 # Create accounts
-useradd -m -u 998 -g git -m -s /bin/sh -d /var/opt/gitlab git
+## The git account is created with * as crypted password as ssh treats the account as locked if it has a ! 
+## Issue #5891 https://gitlab.com/gitlab-org/omnibus-gitlab
+useradd -m -u 998 -g git -p '*' -m -s /bin/sh -d /var/opt/gitlab git
 useradd -m -u 999 -g gitlab-www -m -s /bin/false -d /var/opt/gitlab/nginx gitlab-www
 useradd -m -u 997 -g gitlab-redis -m -s /bin/false -d /var/opt/gitlab/redis gitlab-redis
 useradd -m -u 996 -g gitlab-psql -m -s /bin/sh -d /var/opt/gitlab/postgresql gitlab-psql
diff --git a/docker/assets/sshd_config b/docker/assets/sshd_config
--- a/docker/assets/sshd_config
+++ b/docker/assets/sshd_config
@@ -15,9 +15,10 @@
 AuthorizedKeysCommand /opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell-authorized-keys-check git %u %k
 AuthorizedKeysCommandUser git
 
-# Fix: User username not allowed because account is locked
 # With "UsePAM yes" the "!" is seen as a password disabled account and not fully locked so ssh public key login works
-UsePAM yes
+# Please make sure that the account is created without passwordlogin ("*" in /etc/shadow) or configure pam. 
+# Issue #5891 https://gitlab.com/gitlab-org/omnibus-gitlab
+UsePAM no
 
 # Disabling use DNS in ssh since it tends to slow connecting
 UseDNS no