Trying to set up sshd but foiled by selinux

Discussion:

Guy Attrill

2014-03-21 10:50:04 UTC

my docker file
the base image is tianon/centos with java5 java6 maven and jenkins user
created

FROM guya/centos-6.5-build-slave-base:base
RUN yum update -y
RUN wget
http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
RUN wget http://rpms.famillecollet.com/enterprise/remi-release-6.rpm
RUN rpm -Uvh remi-release-6*.rpm epel-release-6*.rpm
RUN yum install openssh-server supervisor policycoreutils-python-2.0.83
selinux-policy policycoreutils-python -y
RUN mkdir -p /var/run/sshd
RUN mkdir -p /var/run/sshd
RUN mkdir -p /var/log/supervisor
ADD supervisor.conf /etc/supervisor.conf
RUN mkdir -p /var/run/sshd ; chmod -rx /var/run/sshd
RUN ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key
RUN sed -ri 's/#PermitRootLogin yes/PermitRootLogin yes/g'
/etc/ssh/sshd_config
RUN sed -ri 's/UsePAM yes/#UsePAM yes/g' /etc/ssh/sshd_config
RUN sed -ri 's/#UsePAM no/UsePAM no/g' /etc/ssh/sshd_config
RUN echo 'root:secret' | chpasswd
RUN sed -ri 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
RUNrun sed -i -e 's/session required pam_loginuid.so/#session
required pam_loginuid.so/' /etc/pam.d/sshd sed -i -e 's/session
required pam_loginuid.so/#session required pam_loginuid.so/'
/etc/pam.d/sshd
EXPOSE 22
CMD ["/usr/bin/supervisord","-c","/etc/supervisor.conf"]

supervisor conf

[supervisord]
nodaemon=true

[program:sshd]
command=/usr/sbin/sshd -d

sshd starts up fine
but when i attempt to log in as root

debug1: Authentication succeeded (password).
Authenticated to localhost ([127.0.0.1]:49204).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-***@openssh.com
debug1: Entering interactive session.
debug1: channel 0: free: client-session, nchannels 1
Connection to localhost closed by remote host.
Connection to localhost closed.
Transferred: sent 2976, received 2392 bytes, in 0.0 seconds
Bytes per second: sent 1829168.9, received 1470219.1
debug1: Exit status -1

[***@guyabox buildslave]$ docker run -i -t -p 22 guya/jenkins-slave bash
bash-4.1# /usr/sbin/sshd -d
debug1: sshd version OpenSSH_5.3p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
Could not load host key: /etc/ssh/ssh_host_dsa_key
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 172.17.42.1 port 56560
debug1: Client protocol version 2.0; client software version OpenSSH_6.2
debug1: match: OpenSSH_6.2 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: permanently_set_uid: 74/74
debug1: list_hostkey_types: ssh-rsa
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
debug1: userauth-request for user root service ssh-connection method none
debug1: attempt 0 failures 0
debug1: userauth-request for user root service ssh-connection method
publickey
debug1: attempt 1 failures 0
debug1: test whether pkalg/pkblob are acceptable
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: trying public key file /root/.ssh/authorized_keys
debug1: Could not open authorized keys '/root/.ssh/authorized_keys': No
such file or directory
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: trying public key file /root/.ssh/authorized_keys2
debug1: Could not open authorized keys '/root/.ssh/authorized_keys2': No
such file or directory
debug1: restore_uid: 0/0
Failed publickey for root from 172.17.42.1 port 56560 ssh2
debug1: userauth-request for user root service ssh-connection method
password
debug1: attempt 2 failures 1
Accepted password for root from 172.17.42.1 port 56560 ssh2
debug1: monitor_child_preauth: root has been authenticated by privileged
process
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: ssh_gssapi_storecreds: Not a GSSAPI mechanism
debug1: restore_uid: 0/0
debug1: SELinux support enabled
ssh_selinux_getctxbyname: Failed to get default SELinux security context
for root
ssh_selinux_setup_exec_context: security_getenforce() failed
debug1: do_cleanup

Any idea how i tell selinx to allow sshd?-bash-4.1# sestatus -v

sestatus does the following
SELinux status: enabled
SELinuxfs mount: not mounted

Please mount selinuxfs for proper results.

Guy Attrill

2014-03-21 17:08:24 UTC

Permalink

Ok I have now got a work around

It appears that it is the docker host

By disabling selinux on the host by passing in selinux=0 on the grub.conf
file
It now allows sshd connections

This is a workaround however and not recommended....
It is the kernel that must be doing it ! any ideas?

Post by Guy Attrill
my docker file
the base image is tianon/centos with java5 java6 maven and jenkins user
created
FROM guya/centos-6.5-build-slave-base:base
RUN yum update -y
RUN wget
http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
RUN wget http://rpms.famillecollet.com/enterprise/remi-release-6.rpm
RUN rpm -Uvh remi-release-6*.rpm epel-release-6*.rpm
RUN yum install openssh-server supervisor policycoreutils-python-2.0.83
selinux-policy policycoreutils-python -y
RUN mkdir -p /var/run/sshd
RUN mkdir -p /var/run/sshd
RUN mkdir -p /var/log/supervisor
ADD supervisor.conf /etc/supervisor.conf
RUN mkdir -p /var/run/sshd ; chmod -rx /var/run/sshd
RUN ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key
RUN sed -ri 's/#PermitRootLogin yes/PermitRootLogin yes/g'
/etc/ssh/sshd_config
RUN sed -ri 's/UsePAM yes/#UsePAM yes/g' /etc/ssh/sshd_config
RUN sed -ri 's/#UsePAM no/UsePAM no/g' /etc/ssh/sshd_config
RUN echo 'root:secret' | chpasswd
RUN sed -ri 's/SELINUX=enforcing/SELINUX=permissive/g' /etc/selinux/config
RUNrun sed -i -e 's/session required pam_loginuid.so/#session
required pam_loginuid.so/' /etc/pam.d/sshd sed -i -e 's/session
required pam_loginuid.so/#session required pam_loginuid.so/'
/etc/pam.d/sshd
EXPOSE 22
CMD ["/usr/bin/supervisord","-c","/etc/supervisor.conf"]
supervisor conf
[supervisord]
nodaemon=true
[program:sshd]
command=/usr/sbin/sshd -d
sshd starts up fine
but when i attempt to log in as root
debug1: Authentication succeeded (password).
Authenticated to localhost ([127.0.0.1]:49204).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
debug1: channel 0: free: client-session, nchannels 1
Connection to localhost closed by remote host.
Connection to localhost closed.
Transferred: sent 2976, received 2392 bytes, in 0.0 seconds
Bytes per second: sent 1829168.9, received 1470219.1
debug1: Exit status -1
bash-4.1# /usr/sbin/sshd -d
debug1: sshd version OpenSSH_5.3p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
Could not load host key: /etc/ssh/ssh_host_dsa_key
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-d'
Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8
debug1: inetd sockets after dupping: 3, 3
Connection from 172.17.42.1 port 56560
debug1: Client protocol version 2.0; client software version OpenSSH_6.2
debug1: match: OpenSSH_6.2 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3
debug1: permanently_set_uid: 74/74
debug1: list_hostkey_types: ssh-rsa
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
debug1: userauth-request for user root service ssh-connection method none
debug1: attempt 0 failures 0
debug1: userauth-request for user root service ssh-connection method
publickey
debug1: attempt 1 failures 0
debug1: test whether pkalg/pkblob are acceptable
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: trying public key file /root/.ssh/authorized_keys
debug1: Could not open authorized keys '/root/.ssh/authorized_keys': No
such file or directory
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: trying public key file /root/.ssh/authorized_keys2
debug1: Could not open authorized keys '/root/.ssh/authorized_keys2': No
such file or directory
debug1: restore_uid: 0/0
Failed publickey for root from 172.17.42.1 port 56560 ssh2
debug1: userauth-request for user root service ssh-connection method
password
debug1: attempt 2 failures 1
Accepted password for root from 172.17.42.1 port 56560 ssh2
debug1: monitor_child_preauth: root has been authenticated by privileged
process
debug1: temporarily_use_uid: 0/0 (e=0/0)
debug1: ssh_gssapi_storecreds: Not a GSSAPI mechanism
debug1: restore_uid: 0/0
debug1: SELinux support enabled
ssh_selinux_getctxbyname: Failed to get default SELinux security context
for root
ssh_selinux_setup_exec_context: security_getenforce() failed
debug1: do_cleanup
Any idea how i tell selinx to allow sshd?-bash-4.1# sestatus -v
sestatus does the following
SELinux status: enabled
SELinuxfs mount: not mounted
Please mount selinuxfs for proper results.

Michael Crosby

2014-03-22 01:13:27 UTC

Permalink

Yes, your in luck. We have first class selinux support coming to docker in
this PR:

https://github.com/dotcloud/docker/pull/4211

Post by Guy Attrill
Ok I have now got a work around
It appears that it is the docker host
By disabling selinux on the host by passing in selinux=0 on the grub.conf
file
It now allows sshd connections
This is a workaround however and not recommended....
It is the kernel that must be doing it ! any ideas?

Arno Schulz

2014-04-16 13:05:08 UTC

Permalink

I've checked and SELinux pull was included in Docker 0.10.0 and I got the
RPM for RHEL<ftp://195.220.108.108/linux/epel/testing/6/x86_64/docker-io-0.10.0-2.el6.x86_64.rpm>installed but I still get the same error as Guy

debug1: SELinux support enabled
debug3: ssh_selinux_setup_pty: setting TTY context on /dev/pts/0
ssh_selinux_getctxbyname: ssh_selinux_getctxbyname: security_getenforce()
failed
debug1: do_cleanup
debug1: PAM: cleanup
debug1: PAM: closing session

Similar by disabling SELinux everything works like a charm, but setting it
to either Enforcing or Permissive and it fails.

No logs on either the host or container under /var/log/messages (where I
would check for SELinux issues)

Any idea on what could be tested to narrow down the issue?

Also I've opened a bug report (#1085081)<https://bugzilla.redhat.com/show_bug.cgi?id=1085081>on RH bugzilla

Paul Nasrat

2014-04-16 13:32:25 UTC

Permalink

You might want to install setroubleshoot-server on the RHEL host then
check /var/log/audit/audit.log IIRC

I don't have a RHEL 6 box to hand but this looks relevant
http://blog.slacknet.ca/planet-cdot/selinuxs-setroubleshoot-install-on-a-rhel6-server/

Paul

Post by Arno Schulz
I've checked and SELinux pull was included in Docker 0.10.0 and I got the
RPM for RHEL installed but I still get the same error as Guy
debug1: SELinux support enabled
debug3: ssh_selinux_setup_pty: setting TTY context on /dev/pts/0
ssh_selinux_getctxbyname: ssh_selinux_getctxbyname: security_getenforce()
failed
debug1: do_cleanup
debug1: PAM: cleanup
debug1: PAM: closing session
Similar by disabling SELinux everything works like a charm, but setting it
to either Enforcing or Permissive and it fails.
No logs on either the host or container under /var/log/messages (where I
would check for SELinux issues)
Any idea on what could be tested to narrow down the issue?
Also I've opened a bug report (#1085081) on RH bugzilla

Arno Schulz

2014-05-01 15:42:29 UTC

Permalink

Updated RHEL 6.5 and the issue went away.

Post by Paul Nasrat
You might want to install setroubleshoot-server on the RHEL host then
check /var/log/audit/audit.log IIRC
I don't have a RHEL 6 box to hand but this looks relevant
http://blog.slacknet.ca/planet-cdot/selinuxs-setroubleshoot-install-on-a-rhel6-server/
Paul

Post by Arno Schulz
I've checked and SELinux pull was included in Docker 0.10.0 and I got

the

Post by Arno Schulz
RPM for RHEL installed but I still get the same error as Guy
debug1: SELinux support enabled
debug3: ssh_selinux_setup_pty: setting TTY context on /dev/pts/0

security_getenforce()

Post by Arno Schulz
failed
debug1: do_cleanup
debug1: PAM: cleanup
debug1: PAM: closing session
Similar by disabling SELinux everything works like a charm, but setting

Post by Arno Schulz
to either Enforcing or Permissive and it fails.
No logs on either the host or container under /var/log/messages (where I
would check for SELinux issues)
Any idea on what could be tested to narrow down the issue?
Also I've opened a bug report (#1085081) on RH bugzilla

Andrea Turli

2014-05-01 19:36:08 UTC

Permalink

Hi Arno,

I'm having the same issue, how did you solve it?

Post by Arno Schulz
Updated RHEL 6.5 and the issue went away.

Post by Arno Schulz
I've checked and SELinux pull was included in Docker 0.10.0 and I got

the

Post by Arno Schulz
RPM for RHEL installed but I still get the same error as Guy
debug1: SELinux support enabled
debug3: ssh_selinux_setup_pty: setting TTY context on /dev/pts/0

security_getenforce()

Post by Arno Schulz
failed
debug1: do_cleanup
debug1: PAM: cleanup
debug1: PAM: closing session
Similar by disabling SELinux everything works like a charm, but setting

Post by Arno Schulz
to either Enforcing or Permissive and it fails.
No logs on either the host or container under /var/log/messages (where

Post by Arno Schulz
would check for SELinux issues)
Any idea on what could be tested to narrow down the issue?
Also I've opened a bug report (#1085081) on RH bugzilla

Arno Schulz

2014-05-01 19:41:34 UTC

Permalink

Aside running yum update I have no idea of what has fixed the issue.

I can confirm the issue still exists if you use an ubuntu 12.04 container
after the update, but using ubuntu > 12.10 works fine the same for fedora
19/20 containers.

After the SELinux issue went away, you might see a permission issue and you
need to chmod 700 /var/run/sshd

Otherwise everything works as expected.

Post by Andrea Turli
Hi Arno,
I'm having the same issue, how did you solve it?

Post by Arno Schulz
Updated RHEL 6.5 and the issue went away.

Post by Arno Schulz
I've checked and SELinux pull was included in Docker 0.10.0 and I got

the

Post by Arno Schulz
RPM for RHEL installed but I still get the same error as Guy
debug1: SELinux support enabled
debug3: ssh_selinux_setup_pty: setting TTY context on /dev/pts/0

security_getenforce()

Post by Arno Schulz
failed
debug1: do_cleanup
debug1: PAM: cleanup
debug1: PAM: closing session
Similar by disabling SELinux everything works like a charm, but

setting it

Post by Arno Schulz
to either Enforcing or Permissive and it fails.
No logs on either the host or container under /var/log/messages (where

Post by Arno Schulz
would check for SELinux issues)
Any idea on what could be tested to narrow down the issue?
Also I've opened a bug report (#1085081) on RH bugzilla

Andrea Turli

2014-05-01 19:57:33 UTC

Permalink

Thanks Arno,

but after yum update the problem is still there. Maybe it is not the only
one for me

Post by Arno Schulz
Aside running yum update I have no idea of what has fixed the issue.
I can confirm the issue still exists if you use an ubuntu 12.04 container
after the update, but using ubuntu > 12.10 works fine the same for fedora
19/20 containers.
After the SELinux issue went away, you might see a permission issue and
you need to chmod 700 /var/run/sshd
Otherwise everything works as expected.

Post by Andrea Turli
Hi Arno,
I'm having the same issue, how did you solve it?

Post by Arno Schulz
Updated RHEL 6.5 and the issue went away.

Post by Arno Schulz
I've checked and SELinux pull was included in Docker 0.10.0 and I got

the

Post by Arno Schulz
RPM for RHEL installed but I still get the same error as Guy
debug1: SELinux support enabled
debug3: ssh_selinux_setup_pty: setting TTY context on /dev/pts/0

security_getenforce()

Post by Arno Schulz
failed
debug1: do_cleanup
debug1: PAM: cleanup
debug1: PAM: closing session
Similar by disabling SELinux everything works like a charm, but

setting it

Post by Arno Schulz
to either Enforcing or Permissive and it fails.
No logs on either the host or container under /var/log/messages

(where I

Post by Arno Schulz
would check for SELinux issues)
Any idea on what could be tested to narrow down the issue?
Also I've opened a bug report (#1085081) on RH bugzilla