From 9a10513a9592f2ce35e4faf5ede2d0e6d86a5de1 Mon Sep 17 00:00:00 2001 From: Arseney300 Date: Fri, 20 Feb 2026 04:25:07 +0700 Subject: Fix git-server: unlock git account for SSH key auth adduser --disabled-password sets password field to '!' in /etc/shadow, which OpenSSH 10.0 treats as a locked account, rejecting all logins including pubkey auth. Setting password to '*' via usermod marks the account as "no password login" without locking it, allowing SSH key authentication to work. Co-Authored-By: Claude Opus 4.6 --- git-server/Dockerfile | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/git-server/Dockerfile b/git-server/Dockerfile index 3fdf26b..580c78d 100644 --- a/git-server/Dockerfile +++ b/git-server/Dockerfile @@ -12,6 +12,12 @@ WORKDIR /git-server/ # -s flag changes user's shell RUN mkdir /git-server/keys \ && adduser --disabled-password --shell /usr/bin/git-shell git \ + # Set password to '*' to unlock the account for SSH key auth. + # adduser --disabled-password sets '!' which OpenSSH 10.0 treats as locked, + # rejecting even valid pubkey logins. '*' means "no password login possible" + # but the account is not locked. + && usermod -p '*' git \ + # git-shell must be in /etc/shells or OpenSSH rejects login && echo /usr/bin/git-shell >> /etc/shells \ && mkdir /home/git/.ssh -- cgit v1.2.3