Saturday, March 15, 2014

RHEL 6.4 bug causes SSH login issues into EC2 instance launched from an AMI created from an existing running RHEL 6.4 instance

When an instance is launched from an AMI that was created from an existing running RHEL 6.4 instance, we have to aware of a bug in RHEL 6.4 where UseDNS and PermitRootLogin are present multiple times in /etc/ssh/sshd_config file

bug ref:- RHEL 6.4 bug with EC2 AMI Copy

**********
$ tail -20 sshd_config
# no default banner path
#Banner none

# override default of no subsystems
Subsystem sftp  /usr/libexec/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#       X11Forwarding no
#       AllowTcpForwarding no
#       ForceCommand cvs serverUseDNS no
PermitRootLogin without-password
UseDNS no
PermitRootLogin without-password
UseDNS no
PermitRootLogin without-passwordUseDNS no
PermitRootLogin without-passwordUseDNS no
PermitRootLogin without-password
UseDNS no
PermitRootLogin without-password
*********

and rc.local under /etc/rc.local

*******
$ cat rc.local
#!/bin/sh
#
# This script will be executed *after* all the other init scripts.
# You can put your own initialization stuff in here if you don't
# want to do the full Sys V style init stuff.

touch /var/lock/subsys/local
if [ ! -d /root/.ssh ] ; then
    mkdir -p /root/.ssh
    chmod 0700 /root/.ssh
    restorecon /root/.ssh
fi

# bz 707364
if [ ! -f /etc/blkid/blkid.tab ] ; then
        blkid /dev/xvda &>/dev/null
fi

cat <<EOL >> /etc/ssh/sshd_config
UseDNS no
PermitRootLogin without-password

******

To workaround, if the instance store is ebs volume, unmount the volume and attach as a new ebs volume to an existing instance then comment out UseDNS and PermitRootLogin from sshd_config and rc.local and remount the volume back to the original EC2 instance.

No comments:

Post a Comment