Skip to content
Snippets Groups Projects
Commit 4ec39adb authored by Hans Freitag's avatar Hans Freitag
Browse files

configure sshd and git account so that pam is not used any longer

The reason is that some container systems don't run containers with
CAP_AUDIT_WRITE which is needed for pam. As the comment in sshd_config
has pointed out pam was used as a Fix because it handles shadow entries
'!' and '*' differently from ssh. This commit refixes that fix and
creates the git account with '*' (no password login) and disables pam in
sshd_config

Fixes #5891
parent 2a7b1b63
No related branches found
No related tags found
Loading
...@@ -17,8 +17,7 @@ ...@@ -17,8 +17,7 @@
tzdata \ tzdata \
nano \ nano \
less \ less \
&& rm -rf /var/lib/apt/lists/* \ && rm -rf /var/lib/apt/lists/*
&& sed 's/session\s*required\s*pam_loginuid.so/session optional pam_loginuid.so/g' -i /etc/pam.d/sshd
# Remove MOTD # Remove MOTD
RUN rm -rf /etc/update-motd.d /etc/motd /etc/motd.dynamic RUN rm -rf /etc/update-motd.d /etc/motd /etc/motd.dynamic
......
...@@ -46,7 +46,9 @@ ...@@ -46,7 +46,9 @@
groupadd -g 991 gitlab-consul groupadd -g 991 gitlab-consul
# Create accounts # Create accounts
useradd -m -u 998 -g git -m -s /bin/sh -d /var/opt/gitlab git ## The git account is created with * as crypted password as ssh treats the account as locked if it has a !
## Issue #5891 https://gitlab.com/gitlab-org/omnibus-gitlab
useradd -m -u 998 -g git -p '*' -m -s /bin/sh -d /var/opt/gitlab git
useradd -m -u 999 -g gitlab-www -m -s /bin/false -d /var/opt/gitlab/nginx gitlab-www useradd -m -u 999 -g gitlab-www -m -s /bin/false -d /var/opt/gitlab/nginx gitlab-www
useradd -m -u 997 -g gitlab-redis -m -s /bin/false -d /var/opt/gitlab/redis gitlab-redis useradd -m -u 997 -g gitlab-redis -m -s /bin/false -d /var/opt/gitlab/redis gitlab-redis
useradd -m -u 996 -g gitlab-psql -m -s /bin/sh -d /var/opt/gitlab/postgresql gitlab-psql useradd -m -u 996 -g gitlab-psql -m -s /bin/sh -d /var/opt/gitlab/postgresql gitlab-psql
......
...@@ -15,5 +15,4 @@ ...@@ -15,5 +15,4 @@
AuthorizedKeysCommand /opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell-authorized-keys-check git %u %k AuthorizedKeysCommand /opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell-authorized-keys-check git %u %k
AuthorizedKeysCommandUser git AuthorizedKeysCommandUser git
# Fix: User username not allowed because account is locked
# With "UsePAM yes" the "!" is seen as a password disabled account and not fully locked so ssh public key login works # With "UsePAM yes" the "!" is seen as a password disabled account and not fully locked so ssh public key login works
...@@ -19,5 +18,7 @@ ...@@ -19,5 +18,7 @@
# With "UsePAM yes" the "!" is seen as a password disabled account and not fully locked so ssh public key login works # With "UsePAM yes" the "!" is seen as a password disabled account and not fully locked so ssh public key login works
UsePAM yes # Please make sure that the account is created without passwordlogin ("*" in /etc/shadow) or configure pam.
# Issue #5891 https://gitlab.com/gitlab-org/omnibus-gitlab
UsePAM no
# Disabling use DNS in ssh since it tends to slow connecting # Disabling use DNS in ssh since it tends to slow connecting
UseDNS no UseDNS no
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment