mirror of
https://github.com/libssh2/libssh2.git
synced 2026-10-24 03:48:58 +03:00
4ab391ec9f
To silence a warning, in rare failure cases:
```
srclimit_penalise: ipv4: new 172.17.0.1/32 deferred penalty of 1.000
seconds for penalty: connections without attempting authentication
```
Ref: https://github.com/libssh2/libssh2/actions/runs/37207427612/job/111451438515?pr=2649#step:25:537
Also:
- seize the opportunity and bump sshd debug level to 2.
Level 1 is too low to see clearly in some cases.
Ref: https://github.com/libssh2/libssh2/pull/2649
Follow-up to 45aa5c5fa4 #2621
Refs:
https://man.openbsd.org/sshd_config#PerSourcePenalties
https://www.openssh.org/txt/release-9.8
Closes #2650
84 lines
3.2 KiB
Docker
84 lines
3.2 KiB
Docker
# Copyright (C) Alexander Lamaison <alexander.lamaison@gmail.com>
|
|
# SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
# To update, get the latest digest e.g. from https://hub.docker.com/_/debian/tags
|
|
FROM debian:testing-20260824-slim@sha256:b21cba5194c0cddc19b41045ceebce11b5413ac40bac7f2410c066b5acb28091
|
|
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-suggests --no-install-recommends adduser openssh-server && \
|
|
apt-get clean && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
RUN [ -d /var/run/sshd ] || mkdir /var/run/sshd
|
|
|
|
# Chmodding because, when building on Windows, files are copied in with
|
|
# -rwxr-xr-x permissions.
|
|
#
|
|
# Copying to a temp location, then moving because chmodding the copied file has
|
|
# no effect (Docker AUFS-related bug maybe?)
|
|
|
|
# Host keys
|
|
COPY ssh_host_rsa_key.pub /etc/ssh/
|
|
COPY ssh_host_rsa_key /tmp/etc/ssh/
|
|
RUN install -m 0600 /tmp/etc/ssh/ssh_host_rsa_key /etc/ssh/
|
|
|
|
COPY ssh_host_ecdsa_key.pub /etc/ssh/
|
|
COPY ssh_host_ecdsa_key /tmp/etc/ssh/
|
|
RUN install -m 0600 /tmp/etc/ssh/ssh_host_ecdsa_key /etc/ssh/
|
|
|
|
COPY ssh_host_ed25519_key.pub /etc/ssh/
|
|
COPY ssh_host_ed25519_key /tmp/etc/ssh/
|
|
RUN install -m 0600 /tmp/etc/ssh/ssh_host_ed25519_key /etc/ssh/
|
|
|
|
COPY ssh_host_mldsa44-ed25519_key.pub /etc/ssh/
|
|
COPY ssh_host_mldsa44-ed25519_key /tmp/etc/ssh/
|
|
RUN install -m 0600 /tmp/etc/ssh/ssh_host_mldsa44-ed25519_key /etc/ssh/
|
|
|
|
# Host certificates
|
|
COPY ssh_host_rsa_key-cert.pub /tmp/etc/ssh/
|
|
RUN install -m 0644 /tmp/etc/ssh/ssh_host_rsa_key-cert.pub /etc/ssh/
|
|
|
|
COPY ssh_host_ecdsa_key-cert.pub /tmp/etc/ssh/
|
|
RUN install -m 0644 /tmp/etc/ssh/ssh_host_ecdsa_key-cert.pub /etc/ssh/
|
|
|
|
COPY ssh_host_ed25519_key-cert.pub /tmp/etc/ssh/
|
|
RUN install -m 0644 /tmp/etc/ssh/ssh_host_ed25519_key-cert.pub /etc/ssh/
|
|
|
|
COPY ssh_host_mldsa44-ed25519_key-cert.pub /tmp/etc/ssh/
|
|
RUN install -m 0644 /tmp/etc/ssh/ssh_host_mldsa44-ed25519_key-cert.pub /etc/ssh/
|
|
|
|
# Trusted user CA keys
|
|
COPY ca_user_keys.pub /tmp/etc/ssh/
|
|
RUN install -m 0600 /tmp/etc/ssh/ca_user_keys.pub /etc/ssh/
|
|
|
|
# User
|
|
RUN adduser --disabled-password --gecos 'Test user for libssh2 integration tests' libssh2
|
|
RUN echo 'libssh2:my test password' | chpasswd
|
|
|
|
# Config
|
|
RUN sed -i 's/KbdInteractiveAuthentication no/KbdInteractiveAuthentication yes/' /etc/ssh/sshd_config
|
|
COPY sshd_config /tmp/etc/ssh/
|
|
RUN cat /tmp/etc/ssh/sshd_config >> /etc/ssh/sshd_config
|
|
RUN echo 'TrustedUserCAKeys /etc/ssh/ca_user_keys.pub' >> /etc/ssh/sshd_config
|
|
RUN echo 'HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub' >> /etc/ssh/sshd_config
|
|
RUN echo 'HostCertificate /etc/ssh/ssh_host_ecdsa_key-cert.pub' >> /etc/ssh/sshd_config
|
|
RUN echo 'HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub' >> /etc/ssh/sshd_config
|
|
RUN echo 'HostCertificate /etc/ssh/ssh_host_mldsa44-ed25519_key-cert.pub' >> /etc/ssh/sshd_config
|
|
RUN echo 'PerSourcePenalties no' >> /etc/ssh/sshd_config
|
|
|
|
# SSH login fix. Otherwise user is kicked off after login
|
|
RUN sed 's/session\s*required\s*pam_loginuid.so/session optional pam_loginuid.so/g' -i /etc/pam.d/sshd
|
|
|
|
USER libssh2
|
|
|
|
RUN mkdir -p /home/libssh2/.ssh
|
|
RUN mkdir -p /home/libssh2/sandbox
|
|
|
|
COPY authorized_keys /tmp/libssh2/.ssh/
|
|
RUN install -m 0600 /tmp/libssh2/.ssh/authorized_keys /home/libssh2/.ssh/
|
|
|
|
USER root
|
|
|
|
EXPOSE 22
|
|
# -e gives logs via 'container/docker/podman logs'
|
|
CMD ["/usr/sbin/sshd", "-D", "-e"]
|