Docker SSH连接到Localhost在运行权限中被拒绝(publicKey，密码，键盘相互作用)

Question

我正在为单个节点hadoop容器构建一个docker容器，并且我遇到了一个问题，设置了Hadoop用户的无密码SSH登录(我没有使用root运行Hadoop服务(。我一直在通过可能的修复程序，授权_Keys，/.ssh等上的权限进行搜索，看起来都不错。这是调试日志的相关部分：

debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/hdadmin/.ssh/id_rsa
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug2: we did not send a packet, disable method
...
debug1: No more authentication methods to try.
Permission denied (publickey,password,keyboard-interactive).

在尝试SSH之前文件权限：

drwx------    1 hdadmin  hdadmin       4096 Feb 25 14:33 /home/hdadmin/.ssh
-rw-------    1 hdadmin  hdadmin        402 Feb 25 04:54 authorized_keys
-rw-------    1 hdadmin  hdadmin         87 Feb 25 04:54 config
-rw-------    1 hdadmin  hdadmin       1671 Feb 25 04:54 id_rsa
-rw-r--r--    1 hdadmin  hdadmin        402 Feb 25 04:54 id_rsa.pub
-rw-------    1 hdadmin  hdadmin       1637 Feb 25 04:54 known_hosts

和来自Dockerfile的相关代码：

RUN ... 
&& mkdir -p /home/hdadmin 
&& mkdir -p /home/hdadmin/.ssh 
&& touch /home/hdadmin/.ssh/authorized_keys 
&& touch /home/hdadmin/.ssh/config 
&& touch /home/hdadmin/.ssh/known_hosts 
&& addgroup hadoop 
&& adduser -D -g hadoop -h /home/hdadmin hdadmin -s /etc/passwd 
&& chown -R hdadmin:hdadmin /home/hdadmin 
&& chmod -R 0700 /home/hdadmin 
&& ssh-keygen -A
&& HOST_KEY="$(cat /etc/ssh/ssh_host_rsa_key.pub)" 
&& echo "127.0.0.1 ${HOST_KEY}" >> /home/hdadmin/.ssh/known_hosts 
&& echo "localhost ${HOST_KEY}" >> /home/hdadmin/.ssh/known_hosts 
&& echo "$HOSTNAME ${HOST_KEY}" >> /home/hdadmin/.ssh/known_hosts 
&& echo "0.0.0.0 ${HOST_KEY}"   >> /home/hdadmin/.ssh/known_hosts 
&& su-exec hdadmin ssh-keygen -q -N '' -t rsa -f /home/hdadmin/.ssh/id_rsa 
&& cat /home/hdadmin/.ssh/id_rsa.pub >> /home/hdadmin/.ssh/authorized_keys 
&& echo "Host *" >> /home/hdadmin/.ssh/config 
&& echo -e "tUser hdadmin" >> /home/hdadmin/.ssh/config 
&& echo -e "tPubKeyAuthentication yes" >> /home/hdadmin/.ssh/config 
&& echo -e "tIdentityFile /home/hdadmin/.ssh/id_rsa" >> /home/hdadmin/.ssh/config 
&& eval $(ssh-agent) 
&& ssh-add /home/hdadmin/.ssh/id_rsa 
&& chmod 0600 /home/hdadmin/.ssh/* 
&& chmod 0644 /home/hdadmin/.ssh/*.pub 
&& /usr/sbin/sshd 
&& su-exec hdadmin ssh -vvv localhost 

sshd_config文件全部默认，尚未修改。无法弄清楚为什么这不起作用，我认为我正在正确地做所有事情。

编辑1：在Dockerfile示例中添加了更多内容。

Answer 1

，所以我最终弄清楚了。首先，我安装了Syslog功能，以便实际查看日志消息。这是在Alpine Linux上运行的，所以我在Dockerfile中进行了以下操作，所以我会收到消息：

COPY init.sh /tmp/init.sh   # This sh file just contains /usr/sbin/rsyslogd -n -f /etc/rsyslog.conf & so that it runs in the background
RUN apk add --no-cache rsyslog 
&& echo "$ModLoad inmark.so" >> /etc/rsyslog.conf 
&& echo "$IncludeConfig /etc/rsyslog.d/*.conf" >> /etc/rsyslog.conf 
&& echo "auth,authpriv.* /var/log/auth.log" >> /etc/rsyslog.conf 
&& sed -i "s/#LogLevel.*/LogLevel DEBUG/g" /etc/ssh/sshd_config 
&& sed -i "s/#SyslogFacility.*/SyslogFacility AUTH/g" /etc/ssh/sshd_config 

一旦我这样做，在我发现的/var/log/auth.log文件中：

2018-02-25T19:23:18.942070+00:00 c97682336915 sshd[29]: User hdadmin not allowed because account is locked

我没有为帐户设置密码，因为它不会交互式使用。因此，我以前在Dockerfile中设置了一个：

usermod -p '*' hdadmin

然后我收到了这些消息：

2018-02-25T19:23:18.942070+00:00 c97682336915 sshd[29]: User hdadmin not allowed because shell /etc/passwd is not executable

所以我将adduser系列更改为：

&& adduser -D -g hadoop -h /home/hdadmin -s /bin/bash hdadmin 

现在一切都很好。我相信这仍然使HDADMIN帐户处于无法与密码或任何交互式登录的状态一起使用的状态，但是仍然可以通过公共密钥身份验证编程使用。