Skip to content

UsePAM yes required for Ubuntu 26.04 containers #191

Description

@johrstrom

Our github CI started failing consistently with Ubuntu:26.04 containers recently and was fixed through resetting UsePAM yes in /etc/ssh/sshd_config (below). This just started happening this week (middle of June) I suspect from some rolling update to the Ubuntu:26.04 container, though I cannot confirm this.

    docker_image_commands:
      - sed -i 's/^UsePAM no/UsePAM yes/' /etc/ssh/sshd_config

In github the action consistently failed with an error message like this, ending in Inappropriate ioctl for device.

ubuntu2604 13:23:28$ cat /etc/resolv.conf
  Attempting ssh connection to 127.0.0.1, user: root, opts: {:config=>false, :verify_host_key=>:never, :auth_methods=>["password", "publickey", "hostbased", "keyboard-interactive"], :port=>"2222", :forward_agent=>false, :keys=>["/home/runner/.ssh/id_rsa"], :user_known_hosts_file=>"/home/runner/.ssh/known_hosts", :keepalive=>true, :***"root"}
  Warning: Try 1 -- Host 127.0.0.1 unreachable: Errno::ECONNRESET - Connection reset by peer
  Warning: Trying again in 3 seconds
  Attempting ssh connection to 127.0.0.1, user: root, opts: {:config=>false, :verify_host_key=>:never, :auth_methods=>["password", "publickey", "hostbased", "keyboard-interactive"], :port=>"2222", :forward_agent=>false, :keys=>["/home/runner/.ssh/id_rsa"], :user_known_hosts_file=>"/home/runner/.ssh/known_hosts", :keepalive=>true, :***"root", :logger=>#<Logger:0x00007f64675e2130 @level=4, @progname=nil, @default_formatter=#<Logger::Formatter:0x00007f6467547248 @datetime_format=nil>, @formatter=nil, @logdev=#<Logger::LogDevice:0x00007f646742d038 @shift_period_suffix=nil, @shift_size=nil, @shift_age=nil, @filename=nil, @dev=#<IO:<STDERR>>, @binmode=false, @reraise_write_errors=[], @skip_header=false, @mon_data=#<Monitor:0x00007f6467547040>, @mon_data_owner_object_id=4820>, @level_override={}>, :password_prompt=>#<Net::SSH::Prompt:0x00007f6467546758>, :user=>"root"}
root@127.0.0.1's password:Inappropriate ioctl for device

Note that the Inappropriate ioctl for device is a red herring this is only because the first attempt to login fails, beaker then uses keyboard-interactive which can't work in a github action.

Various interactive testing confirmed that the password being used was correct, sshd just didn't accept it. Even after execing into the container and trying to ssh to localhost from within the container failed, with sshd-session errors like Failed password for root from 127.0.0.1 port 55018 ssh2. su from another user confirmed that the root password was correct.

I'm not an admin or expert in this area so can't really speak to why this is necessary now for this container. If nothing else, this ticket is informational for subsequent users who have the same issue and/or for AI to ingest for subsequent users who may run into this issue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions