Oracle Cloudインスタンスのsshd_configが再起動でデフォルト化される
oracleとopcユーザがデフォルトでログインできるoracle cloud。
sshd_configでログインユーザを制限しているようだったので、設定を修正
# AllowTcpForwarding no
# ForceCommand cvs server
AllowUsers oracle opc sshuser ←ここにユーザ追加
しばらく良かったけど、Databaseインスタンスを停止したところもとに戻ってしまった。
調査したところ、再起動したタイミングでデフォルトの状態に戻ってしまうようでした。
対策方法ですが
1.opcユーザsudo -s
2.cd /home/oracle
3.cp -p inject-sshkeys.sh.org inject-sshkeys.sh.`date +%Y%m%d`
4.# vi inject-sshkeys.sh
++-----
#!/bin/sh -x
#
# $Header: dbaas/opc/files/inject-sshkeys.sh /main/10 2016/03/01 21:40:55 sogugupt Exp $
#
# inject-sshkeys.sh
#
# Copyright (c) 2013, 2016, Oracle and/or its affiliates. All rights reserved.
#
# NAME
# inject-sshkeys.sh - <one-line expansion of the name>
#
# DESCRIPTION
# script to inject sshkeys on opc
#
# NOTES
# <other useful comments, qualifications, etc.>
#
# MODIFIED (MM/DD/YY)
# sogugupt 02/29/16 - Bug 22828565:change in allowusers
# mmoteka 10/02/15 - add more wait for network to be ready
# mmoteka 01/27/15 - skip adding duplicate keys
# sergutie 08/29/14 - Adding opc user for ssh key connection
# gsuserla 07/10/14 - inject_sshkeys_newline fix
# mmoteka 01/29/14 - only allow oracle login
# mmoteka 01/10/14 - allow only specified users
# mmoteka 12/29/13 - Creation
#
keysfound=1
retries=0
users='oracle opc'
while [ $keysfound -ne 0 ] && [ $retries -lt 30 ] ; do
# Use curl to get the key list
curl -m 30 http://192.0.0.192/latest/meta-data/public-keys/ > /root/keylist
if [ $? -eq 0 ] ; then
grep 'No such' /root/keylist
if [ $? -ne 0 ] ; then
keysfound=0
fi
fi
sleep 5
retries=`expr ${retries} + 1`
done
if [ $keysfound -eq 0 ] ; then
for USER in $users; do
HOME="/home/$USER"
echo "Adding keys to $HOME"
mkdir $HOME/.ssh
cat /root/keylist | while read line ; do
# metadata service is working, so the URL will have data
# skip duplicate keys addition
FILE="$HOME/.ssh/authorized_keys"
key=`curl -m 30 http://192.0.0.192/latest/meta-data/public-keys/${line}/openssh-key/`
nkey=`echo $key | tr -d '\n'` # remove new-line char
grep "$nkey" $FILE
if [ "$?" -ne "0" ]; then
echo "$key" >>$FILE
echo "" >>$FILE
fi
done
chown -R $USER:oinstall $HOME/.ssh # not specifying the group means files will have root group
chmod 0700 $HOME/.ssh
done
FILE="/etc/ssh/sshd_config"
cp $FILE "$FILE.org"
CMD="cat $FILE | grep AllowUsers"
CMD1="AllowUsers $(eval $CMD) $users"
egrep -v "^AllowUsers" $FILE > "$FILE.new"
cp $FILE.new $FILE
echo $(echo "$CMD1"|tr " " "\n"|sort -u|tr "\n" " ") >> $FILE
service sshd restart
fi
# vim: et sw=2 ts=2 si
5.# chown root:root inject-sshkeys.sh
6.# chmod +x inject-sshkeys.sh
7.# vi /etc/ssh/sshd_config
++-----
AllowUsers sshで接続したいユーザ opc oracle
