When an instance is launched from an AMI that was created from an existing running RHEL 6.4 instance, we have to aware of a bug in RHEL 6.4 where UseDNS and PermitRootLogin are present multiple times in /etc/ssh/sshd_config file
bug ref:- RHEL 6.4 bug with EC2 AMI Copy
**********
$ tail -20 sshd_config
# no default banner path
#Banner none
# override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server
# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# ForceCommand cvs serverUseDNS no
PermitRootLogin without-password
UseDNS no
PermitRootLogin without-password
UseDNS no
PermitRootLogin without-passwordUseDNS no
PermitRootLogin without-passwordUseDNS no
PermitRootLogin without-password
UseDNS no
PermitRootLogin without-password
*********
and rc.local under /etc/rc.local
*******
$ cat rc.local
#!/bin/sh
#
# This script will be executed *after* all the other init scripts.
# You can put your own initialization stuff in here if you don't
# want to do the full Sys V style init stuff.
touch /var/lock/subsys/local
if [ ! -d /root/.ssh ] ; then
mkdir -p /root/.ssh
chmod 0700 /root/.ssh
restorecon /root/.ssh
fi
# bz 707364
if [ ! -f /etc/blkid/blkid.tab ] ; then
blkid /dev/xvda &>/dev/null
fi
cat <<EOL >> /etc/ssh/sshd_config
UseDNS no
PermitRootLogin without-password
******
bug ref:- RHEL 6.4 bug with EC2 AMI Copy
**********
$ tail -20 sshd_config
# no default banner path
#Banner none
# override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server
# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# ForceCommand cvs serverUseDNS no
PermitRootLogin without-password
UseDNS no
PermitRootLogin without-password
UseDNS no
PermitRootLogin without-passwordUseDNS no
PermitRootLogin without-passwordUseDNS no
PermitRootLogin without-password
UseDNS no
PermitRootLogin without-password
*********
and rc.local under /etc/rc.local
*******
$ cat rc.local
#!/bin/sh
#
# This script will be executed *after* all the other init scripts.
# You can put your own initialization stuff in here if you don't
# want to do the full Sys V style init stuff.
touch /var/lock/subsys/local
if [ ! -d /root/.ssh ] ; then
mkdir -p /root/.ssh
chmod 0700 /root/.ssh
restorecon /root/.ssh
fi
# bz 707364
if [ ! -f /etc/blkid/blkid.tab ] ; then
blkid /dev/xvda &>/dev/null
fi
cat <<EOL >> /etc/ssh/sshd_config
UseDNS no
PermitRootLogin without-password
******
To workaround, if the instance store is ebs volume, unmount the volume and attach as a new ebs volume to an existing instance then comment out UseDNS and PermitRootLogin from sshd_config and rc.local and remount the volume back to the original EC2 instance.
No comments:
Post a Comment