Adapt to a non-writeable /etc/passwd file in sshd Dockerfile.

rgrunber · rgrunber · commit ad8836e7b2d6 · 2025-10-07T12:55:15.000-04:00
The UDI image currently permits writing to /etc/passwd, and sets the
default user to have a login shell. Make /etc/passwd non-writable and
"disable" /sbin/nologin (by replacing it with /bin/bash) to ensure the
user starting the SSHD service may continue to log into the container
over SSH.

- Small improvements to presentation of landing page with
  "Troubleshooting" section and emphasis on certain commands
- Include 'UserKnownHostsFile /dev/null' in recommended SSH
  configuration section as this eliminates need to remove entries from
  known_hosts if/when the Devworkspace's host key changes

Signed-off-by: Roland Grunberg &lt;rgrunber@redhat.com&gt;
diff --git a/build/dockerfiles/dev.sshd.Dockerfile b/build/dockerfiles/dev.sshd.Dockerfile
@@ -55,7 +55,11 @@ COPY --chown=0:0 /build/scripts/sshd.start /
 RUN mkdir /opt/www
 COPY /build/scripts/server.js /opt/www/
 
-ENV USER_NAME=dev
+# Lock down /etc/passwd until fixed in UDI
+RUN chmod 644 /etc/passwd
+
+# Bypass nologin shell for random generated user
+RUN cp /bin/bash /sbin/nologin
 
 EXPOSE 2022 3400
 
diff --git a/build/scripts/server.js b/build/scripts/server.js
@@ -9,6 +9,8 @@
 
 const http = require('http');
 const fs = require('fs');
+const os = require('os');
+
 const hostname = '127.0.0.1';
 const port = 3400;
 
@@ -33,10 +35,7 @@ const server = http.createServer((req, res) => {
     }
 
   let keyMessage = `
-        <pre>${hasUserPrefSSHKey ? pubKey : genKey}</pre>
-        </p>
-        <p>
-        This can also be configured locally in <code>$HOME/.ssh/config</code> with the following :`;
+        <pre>${hasUserPrefSSHKey ? pubKey : genKey}</pre>`;
 
     res.end(`
 <!DOCTYPE html>
@@ -49,20 +48,27 @@ const server = http.createServer((req, res) => {
     <div class="border">
       <ol>
         <li>Make sure your local oc client is logged in to your OpenShift cluster</li>
-        <li><p class="center">Run <code>oc port-forward ${process.env["HOSTNAME"]} 2022:2022</code>. This establishes a connection to the workspace.</p></li>
+        <li><p class="center">Run <code><b>oc port-forward ${process.env["HOSTNAME"]} 2022:2022</b></code>. This establishes a connection to the workspace.</p></li>
         <li>
-        <p>In your local VS Code, connect to <code>localhost</code> on port <code>2022</code> with user <code>${process.env["USER_NAME"]}</code> ${hasUserPrefSSHKey ? `. The SSH key, corresponding to the following public key, configured in the "SSH Keys" tab of "User Preferences" has been authorized to connect :` : `and the following identity file :`} ${keyMessage}
-        <pre>
+        <p>In your local VS Code, connect to <code>localhost</code> on port <code>2022</code> with user <code>${os.userInfo().username}</code> ${hasUserPrefSSHKey ? `. The SSH key, corresponding to the following public key, configured in the "SSH Keys" tab of "User Preferences" has been authorized to connect :` : `and the following identity file :`} ${keyMessage}</p>
+        <p>
+        This can also be configured locally in <code>$HOME/.ssh/config</code> with the following :
+        <pre><b>
 Host localhost
   HostName 127.0.0.1
-  User ${process.env["USER_NAME"]}
+  User ${os.userInfo().username}
   Port 2022
   IdentityFile /path/to/the/ssh_client_ed25519_key
-        </pre>
+  UserKnownHostsFile /dev/null
+        </b></pre>
         </p>
         </li>
       </ol>
-      <p>If the connection fails with "<code>WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED</code>", it may be necessary to remove the <code>localhost</code> or <code>127.0.0.1</code> entries from <code>$HOME/.ssh/known_hosts</code>. This is because the SSHD service container (to which <code>oc port-forward</code> is forwarding) may change.</p>
+      <h3>Troubleshooting</h3>
+      <p>If the connection fails with "<code>WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED</code>", it may be necessary to remove the <code>localhost</code> or <code>127.0.0.1</code> entries from <code>$HOME/.ssh/known_hosts</code>. This is because the SSHD service container (to which <code>oc port-forward</code> is forwarding) may change. This can be bypassed by setting <code>UserKnownHostsFile /dev/null</code></p>
+      <p>Please ensure the permissions on the private key used are restricted to allow only the file owner to read/write. The SSH service may fail to correctly authenticate otherwise.</p>
+      <p>The most common setup is to connect to the workspace using the "Remote - SSH Connection" from the corresponding editor's extension marketplace. If this setup fails to connect to the workspace, consider disabling the setting <code><b>remote.SSH.useExecServer</b></code> (set to false)</p>
+      <p>For any other issues, relating to the use of a VS Code-based editor and the "Remote - SSH connection", the "Remote - SSH" logs from the "Output" view are very helpful in diagnosing the issue.</p>
     </div>
   </body>
 </html>
