diff options
| author | Arseney300 <Arseney300@gmail.com> | 2026-02-20 04:25:07 +0700 |
|---|---|---|
| committer | Arseney300 <Arseney300@gmail.com> | 2026-02-20 04:25:07 +0700 |
| commit | 9a10513a9592f2ce35e4faf5ede2d0e6d86a5de1 (patch) | |
| tree | ed5541b5f01be89834bad1c40a516cf9cd4e04c2 | |
| parent | b7f1b1435ad5edc572a58694d642e00103179813 (diff) | |
Fix git-server: unlock git account for SSH key auth
adduser --disabled-password sets password field to '!' in /etc/shadow,
which OpenSSH 10.0 treats as a locked account, rejecting all logins
including pubkey auth. Setting password to '*' via usermod marks the
account as "no password login" without locking it, allowing SSH
key authentication to work.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
| -rw-r--r-- | git-server/Dockerfile | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/git-server/Dockerfile b/git-server/Dockerfile index 3fdf26b..580c78d 100644 --- a/git-server/Dockerfile +++ b/git-server/Dockerfile @@ -12,6 +12,12 @@ WORKDIR /git-server/ # -s flag changes user's shell RUN mkdir /git-server/keys \ && adduser --disabled-password --shell /usr/bin/git-shell git \ + # Set password to '*' to unlock the account for SSH key auth. + # adduser --disabled-password sets '!' which OpenSSH 10.0 treats as locked, + # rejecting even valid pubkey logins. '*' means "no password login possible" + # but the account is not locked. + && usermod -p '*' git \ + # git-shell must be in /etc/shells or OpenSSH rejects login && echo /usr/bin/git-shell >> /etc/shells \ && mkdir /home/git/.ssh |