Volume-mount container SSH keys instead of baking them into images

Container SSH public keys are now bind-mounted into student containers
at /etc/ssh/master_keys/ so key rotations take effect immediately
without rebuilding images or restarting containers.

Also improve SSH proxy error handling: show a generic internal error
with a trackable UUID instead of leaking details, and close the
channel on failure.

Author: Nils Bars

docker-compose.template.yml

@@ -92,6 +92,8 @@ services:
             - {{ exercises_path }}:/exercises
             #Make docker availabe inside the container
             - /var/run/docker.sock:/var/run/docker.sock
+            #Container SSH public keys, bind-mounted into student containers at runtime
+            - ./container-keys:/container-keys:ro
             #Source for ref-utils, bind-mounted read-only into student
             #instances so edits on the host apply without rebuilding images.
             - type: bind

ref-docker-base/Dockerfile

@@ -59,9 +59,7 @@ RUN groupadd -g 9999 user && useradd -g 9999 -u 9999 -d /home/user -m -s /bin/ba
 
 WORKDIR /root
 
-COPY container-keys/root_key.pub .ssh/authorized_keys
-RUN chown root:root .ssh/authorized_keys \
-    && chmod 644 .ssh/authorized_keys
+RUN mkdir -p .ssh && chmod 700 .ssh
 
 WORKDIR /home/user
 
@@ -77,11 +75,11 @@ set tabsize 4
 set tabstospaces
 EOF
 
-# Deploy the default ssh-key that is used for authentication by the ssh entry server as user "user".
-RUN mkdir .ssh
-COPY container-keys/user_key.pub .ssh/authorized_keys
-RUN chown root:root .ssh/authorized_keys \
-    && chmod 644 .ssh/authorized_keys
+RUN mkdir .ssh && chmod 700 .ssh
+
+# Directory for master keys volume-mounted from the host at runtime.
+# sshd_config references /etc/ssh/master_keys/%u for key lookup.
+RUN mkdir -p /etc/ssh/master_keys
 
 COPY sshd_config /etc/ssh/sshd_config
 

ref-docker-base/sshd_config

@@ -36,8 +36,10 @@ StrictModes no
 
 #PubkeyAuthentication yes
 
-# Expect .ssh/authorized_keys2 to be disregarded by default in future.
-#AuthorizedKeysFile	.ssh/authorized_keys .ssh/authorized_keys2
+# Check both the per-user authorized_keys (student personal key) and the
+# master keys volume-mounted from the host. sshd expands %u to the
+# connecting username ("root" or "user").
+AuthorizedKeysFile	.ssh/authorized_keys /etc/ssh/master_keys/%u
 
 #AuthorizedPrincipalsFile none
 

ssh-reverse-proxy/Cargo.toml

@@ -43,5 +43,8 @@ futures = "0.3"
 # Random number generation (match russh's rand version)
 rand = "0.8"
 
+# UUID generation for error tracking
+uuid = { version = "1", features = ["v4"] }
+
 [dev-dependencies]
 tokio-test = "0.4"

ssh-reverse-proxy/src/server.rs

@@ -13,6 +13,7 @@ use std::path::Path;
 use std::sync::Arc;
 use tokio::sync::Mutex;
 use tracing::{debug, error, info, warn};
+use uuid::Uuid;
 
 /// Per-connection state stored in the SSH server.
 pub struct ConnectionState {
@@ -529,9 +530,14 @@ impl server::Handler for SshConnection {
         {
             Ok(f) => f,
             Err(e) => {
-                error!("Failed to connect to container: {}", e);
-                let msg = format!("Error: Failed to connect to container: {}\r\n", e);
+                let error_id = Uuid::new_v4();
+                error!("Failed to connect to container [error_id={}]: {}", error_id, e);
+                let msg = format!(
+                    "Error: Internal error (id: {}). If this issue persists, please contact a supervisor and provide the error id.\r\n",
+                    error_id
+                );
                 session.data(channel_id, CryptoVec::from_slice(msg.as_bytes()))?;
+                session.close(channel_id)?;
                 return Ok(());
             }
         };
@@ -620,8 +626,10 @@ impl server::Handler for SshConnection {
         {
             Ok(f) => f,
             Err(e) => {
-                error!("Failed to connect to container: {}", e);
+                let error_id = Uuid::new_v4();
+                error!("Failed to connect to container [error_id={}]: {}", error_id, e);
                 session.channel_failure(channel_id)?;
+                session.close(channel_id)?;
                 return Ok(());
             }
         };
@@ -689,8 +697,10 @@ impl server::Handler for SshConnection {
         {
             Ok(f) => f,
             Err(e) => {
-                error!("Failed to connect to container: {}", e);
+                let error_id = Uuid::new_v4();
+                error!("Failed to connect to container [error_id={}]: {}", error_id, e);
                 session.channel_failure(channel_id)?;
+                session.close(channel_id)?;
                 return Ok(());
             }
         };

webapp/ref/core/instance.py

@@ -584,6 +584,26 @@ def start(self):
                 "mode": "ro",
             }
 
+        # Bind-mount container SSH public keys so sshd can authenticate the
+        # SSH reverse proxy. Keys are live — changing them on the host takes
+        # effect immediately without rebuilding images or restarting containers.
+        container_keys_path = Path("/container-keys")
+        user_key = container_keys_path / "user_key.pub"
+        root_key = container_keys_path / "root_key.pub"
+        if not user_key.exists() or not root_key.exists():
+            raise RuntimeError(
+                f"Container SSH public keys not found at {container_keys_path}. "
+                "Ensure container-keys/ is mounted into the web container."
+            )
+        mounts[self.dc.local_path_to_host(str(user_key))] = {
+            "bind": "/etc/ssh/master_keys/user",
+            "mode": "ro",
+        }
+        mounts[self.dc.local_path_to_host(str(root_key))] = {
+            "bind": "/etc/ssh/master_keys/root",
+            "mode": "ro",
+        }
+
         # Coverage configuration for testing
         coverage_env = {}
         if os.environ.get("COVERAGE_PROCESS_START"):
@@ -632,17 +652,10 @@ def start(self):
 
         instance_entry_service.container_id = container.id
 
-        # Scrip that is initially executed to setup the environment.
-        # 1. Add the SSH key of the user that owns the container to authorized_keys.
-        # FIXME: This key is not actually used for anything right now, since the ssh entry server
-        # uses the master key (docker base image authorized_keys) for authentication for all containers.
-        # 2. Store the instance ID as string in a file /etc/instance_id.
+        # Script that is initially executed to setup the environment.
         container_setup_script = (
             "#!/bin/bash\n"
             "set -e\n"
-            f'if ! grep -q "{self.instance.user.pub_key}" /home/user/.ssh/authorized_keys; then\n'
-            f'bash -c "echo {self.instance.user.pub_key} >> /home/user/.ssh/authorized_keys"\n'
-            "fi\n"
             f"echo -n {self.instance.id} > /etc/instance_id && chmod 400 /etc/instance_id\n"
         )
         if exercise.entry_service.disable_aslr: