Skip to content

Commit 097e5e3

Browse files
author
Jonathan S. Katz
committed
Revert changes from 0574229
0574229 was designed to workaround an issue with the Docker packaging from Red Hat that introduced a bug which prevented the containers from properly loading. Given we are in a single-user environment that only uses ssh public key authentication for performing pgBackRest operations, we can set "UsePAM" to "no". This allows for one to run the containers with a security context of "allowPrivilegeEscalation" set to "false". Issue: [ch10588]
1 parent 22de1b4 commit 097e5e3

File tree

1 file changed

+3
-12
lines changed
  • installers/ansible/roles/pgo-operator/files/pgo-backrest-repo

1 file changed

+3
-12
lines changed

installers/ansible/roles/pgo-operator/files/pgo-backrest-repo/sshd_config

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -80,18 +80,9 @@ ChallengeResponseAuthentication yes
8080
#GSSAPIKeyExchange no
8181
#GSSAPIEnablek5users no
8282

83-
# Set this to 'yes' to enable PAM authentication, account processing,
84-
# and session processing. If this is enabled, PAM authentication will
85-
# be allowed through the ChallengeResponseAuthentication and
86-
# PasswordAuthentication. Depending on your PAM configuration,
87-
# PAM authentication via ChallengeResponseAuthentication may bypass
88-
# the setting of "PermitRootLogin without-password".
89-
# If you just want the PAM account and session checks to run without
90-
# PAM authentication, then enable this but set PasswordAuthentication
91-
# and ChallengeResponseAuthentication to 'no'.
92-
# WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
93-
# problems.
94-
UsePAM yes
83+
# This is set explicitly to *no* as we are only using pubkey authentication and
84+
# because each container is isolated to only an unprivileged user.
85+
UsePAM No
9586

9687
#AllowAgentForwarding yes
9788
#AllowTcpForwarding yes

0 commit comments

Comments
 (0)