Issues with ssh chroot not working #8

New Issue

nat321 · 2020-08-09T02:58:56Z

nat321 commented

2020-08-09 02:58:56 +00:00

I am using gitea helm with a kubeadm deployed kubernetes cluster. Version 1.18.6

Had a issue with the SSH server. The issue was that I would attempt to ssh to the gitea service and then immediately get messages like this from the ssh client:

Connection reset by 10.0.0.14 port 22

Was getting this message in gitea container logs when trying to access my repos over SSH:

chroot("/var/empty"): Operation not permitted [preauth]
chroot("/var/empty"): Operation not permitted [preauth]
chroot("/var/empty"): Operation not permitted [preauth]

I was able to get it to work by patching the deployment and adding this to gitea container definition in the gitea deployment:

    securityContext:
      capabilities:
        add:
        - SYS_CHROOT

as per:

https://unofficial-kubernetes.readthedocs.io/en/latest/concepts/policy/container-capabilities/

This got it to work. Now SSH access is perfectly fine.

I suspect that this isn't the best fix, however. I am not sure of the security implementations of allowing SYS_CHROOT inside a container. Probably a good reason why it's disabled by default.

Probably a better approach would be to add a option to disable the chroot for sshd. Or run sshd in it's own container in the pod so it's isolated without having to do the chroot thing.

Maybe not. I know sshd can be a bear to deal with as far as containers go.

Besides this one issue the helm chart is working great for me. So thanks!

I am using gitea helm with a kubeadm deployed kubernetes cluster. Version 1.18.6 Had a issue with the SSH server. The issue was that I would attempt to ssh to the gitea service and then immediately get messages like this from the ssh client: Connection reset by 10.0.0.14 port 22 Was getting this message in gitea container logs when trying to access my repos over SSH: chroot("/var/empty"): Operation not permitted [preauth] chroot("/var/empty"): Operation not permitted [preauth] chroot("/var/empty"): Operation not permitted [preauth] I was able to get it to work by patching the deployment and adding this to gitea container definition in the gitea deployment: securityContext: capabilities: add: - SYS_CHROOT as per: https://unofficial-kubernetes.readthedocs.io/en/latest/concepts/policy/container-capabilities/ This got it to work. Now SSH access is perfectly fine. I suspect that this isn't the best fix, however. I am not sure of the security implementations of allowing SYS_CHROOT inside a container. Probably a good reason why it's disabled by default. Probably a better approach would be to add a option to disable the chroot for sshd. Or run sshd in it's own container in the pod so it's isolated without having to do the chroot thing. Maybe not. I know sshd can be a bear to deal with as far as containers go. Besides this one issue the helm chart is working great for me. So thanks!

lunny commented

2020-08-09 07:18:02 +00:00

Have you tried #7?

luhahn commented

2020-09-21 15:37:58 +00:00

Since there has been no response and this has not shown up in any of the tests i think we can close this?

techknowlogick closed this issue

2020-09-29 15:09:34 +00:00

Sign in to join this conversation.

No Milestone

No Assignees

3 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: gitea/helm-chart#8