sshd AuthorizedKeysCommand抛出状态127 [英] sshd AuthorizedKeysCommand throws status 127
问题描述
我正在尝试构建一个ssh服务以允许推/拉到phabricator仓库.我已经对所有服务进行了docker化,并且当前遇到了一个奇怪的错误,该错误无法执行ssh所需的身份验证脚本.
I'm attempting to construct an ssh service to allow push/pull to phabricator repos. I've dockerized all the services, and I'm currently running into an odd error that fails to execute the requisite auth script for ssh.
docker镜像同时运行php-fpm
和sshd
服务,其思想是将ssh与必需的php脚本结合在一起.
The docker image runs both php-fpm
and sshd
services, with the idea of uniting ssh with the requisite php scripts.
尤其是,我有以下/etc/ssh/sshd_config:
In particular, I have the following /etc/ssh/sshd_config:
AuthorizedKeysCommand /usr/libexec/phabricator-ssh-hook.sh
AuthorizedKeysCommandUser git
AllowUsers git
Port 2222
Protocol 2
PermitRootLogin no
AllowAgentForwarding no
AllowTcpForwarding no
PrintMotd no
#PrintLastLog no
PasswordAuthentication no
ChallengeResponseAuthentication no
AuthorizedKeysFile none
PidFile /var/run/sshd-phabricator.pid
(作为一个附带说明,当我启动sshd时,PrintLastLog会引发错误,我认为这并不相关,但是可能是?)
(as a side note, PrintLastLog throws an error when I start sshd, which I don't think is related, but might be??)
当我手动运行时
su - git -c "/srv/phabricator/scripts/ssh/ssh-auth.php git"
,我能够成功执行脚本.
su - git -c "/srv/phabricator/scripts/ssh/ssh-auth.php git"
, I am able to successfully execute the script.
但是,当我在调试模式(/usr/sbin/sshd -d -d -d
)下运行时检查sshd
日志时,出现以下错误:
HOWEVER, when I examine the sshd
logs when running in debug mode (/usr/sbin/sshd -d -d -d
), I receive the following error:
...other stuff...
debug3: monitor_read: checking request 22
debug3: mm_answer_keyallowed entering
debug3: mm_answer_keyallowed: key_from_blob: 0x5564c1f473c0
debug3: subprocess: AuthorizedKeysCommand command "/usr/libexec/phabricator-ssh-hook.sh git" running as git
debug1: temporarily_use_uid: 1000/1000 (e=0/0)
debug1: restore_uid: 0/0
debug3: subprocess: AuthorizedKeysCommand pid 885
debug1: temporarily_use_uid: 1000/1000 (e=0/0)
debug2: key not found
AuthorizedKeysCommand /usr/libexec/phabricator-ssh-hook.sh git failed, status 127
debug1: restore_uid: 0/0
Failed publickey for git from some.ip.address.here port 58378 ssh2: ED25519 SHA256:GBGS4ag9s8msV3XsuojlIoqATF63tvXU3t5GIUN0eYY
debug3: mm_answer_keyallowed: key 0x5564c1f473c0 is not allowed
debug3: mm_request_send entering: type 23
debug2: userauth_pubkey: authenticated 0 pkalg ssh-ed25519 [preauth]
debug3: userauth_finish: failure partial=0 next methods="publickey" [preauth]
debug3: send packet: type 51 [preauth]
Connection closed by 24.5.151.66 port 58378 [preauth]
debug1: do_cleanup [preauth]
debug1: monitor_read_log: child log fd closed
debug3: mm_request_receive entering
debug1: do_cleanup
debug1: Killing privsep child 884
似乎确实执行了
/usr/libexec/phabricator-ssh-hook.sh
,但是它执行的脚本/srv/phabricator/bin/ssh-auth
大概失败了.该文件(phabricator目录)实际上位于主机卷上.我想知道这是否可能是导致这些status 127
问题的原因.
It seems like
/usr/libexec/phabricator-ssh-hook.sh
actually does execute, but the script it executes/srv/phabricator/bin/ssh-auth
, presumably fails. That file (the phabricator directory) is actually on a host volume. I wonder if that could be the cause of thesestatus 127
issues.
我已经读到,当从PATH中找不到给定的命令并且不是内置的shell命令(或者找不到脚本使用的库)时,/bin/sh返回状态127.
I've read that status 127 is returned by /bin/sh when the given command is is not found from PATH and it is not a builtin shell command (or a library cannot be found that is used by the script).
话虽如此,我能够手动执行脚本,因此状态127不太可能引用此脚本.
That being said, I am able to execute the script manually, so it seems unlikely that status 127 refers to this.
请注意,我也可以以git
用户身份执行.
Note above, that I can execute as the git
user as well.
docker容器版本信息:
the docker container version info:
Linux version 4.11.9-1-ARCH (builduser@tobias) (gcc version 7.1.1 20170621 (GCC) ) #1 SMP PREEMPT Wed Jul 5 18:23:08 CEST 2017
在正确方向上的任何帮助将不胜感激.
Any help in the right direction would be appreciated.
编辑
docker版本
Client:
Version: 17.06.0-ce
API version: 1.30
Go version: go1.8.3
Git commit: 3dfb8343
Built: Wed Jul 26 18:03:33 2017
OS/Arch: linux/amd64
Server:
Version: 17.06.0-ce
API version: 1.30 (minimum version 1.12)
Go version: go1.8.3
Git commit: 02c1d87617
Built: Wed Jul 26 20:03:39 2017
OS/Arch: linux/amd64
Experimental: false
码头工人信息
Containers: 10
Running: 10
Paused: 0
Stopped: 0
Images: 147
Server Version: 17.06.0-ce
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge host macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: cfb82a876ecc11b5ca0977d1733adbe58599088a
runc version: 2d41c047c83e09a6d61d464906feb2a2f3c52aa4
init version: 949e6fa
Security Options:
seccomp
Profile: default
Kernel Version: 4.11.9-1-ARCH
Operating System: Arch Linux
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 7.631GiB
Name: <host-name>
ID: KYNR:4YHS:T4C2:URUY:GIB5:KCNF:DCNC:JLUT:DYO3:D5P7:VVOD:C2YV
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false
推荐答案
我也在为此而苦苦挣扎.最终,我发现执行phabricator-ssh-hook.sh
时php
不在PATH
中.就我而言,它安装在/usr/local/bin
(默认为FreeBSD)中,所以我添加了:
I was struggling with this, too. Eventually, I found that php
wasn't in the PATH
when executing phabricator-ssh-hook.sh
. In my case, it's installed in /usr/local/bin
(FreeBSD default), so I added:
export PATH="/usr/local/bin:$PATH"
phabricator-ssh-hook.sh
的最后一行之前.
这篇关于sshd AuthorizedKeysCommand抛出状态127的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!