Host key permissions 0777 for host key to open?

LSIO Discussion Container Support
1

Hi all,

thank you very much for creating an easy solution for creating an open ssh server via docker. :pray:

Unfortunately I can’t get the server to run.
When I try to run the server with a slightly modified Docker-Compose.YML I get the following errors:

openssh-server  | @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
openssh-server  | @         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
openssh-server  | @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
openssh-server  | Permissions 0777 for '/etc/ssh/ssh_host_ecdsa_key' are too open.
openssh-server  | It is required that your private key files are NOT accessible by others.
openssh-server  | This private key will be ignored.
openssh-server  | @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
openssh-server  | @         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
openssh-server  | @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
openssh-server  | Permissions 0777 for '/etc/ssh/ssh_host_ed25519_key' are too open.
openssh-server  | It is required that your private key files are NOT accessible by others.
openssh-server  | This private key will be ignored.
openssh-server  | sshd: no hostkeys available -- exiting.
openssh-server  | @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
openssh-server  | @         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
openssh-server  | @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
openssh-server  | Permissions 0777 for '/etc/ssh/ssh_host_rsa_key' are too open.
openssh-server  | It is required that your private key files are NOT accessible by others.
openssh-server  | This private key will be ignored.
openssh-server  | @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
openssh-server  | @         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
openssh-server  | @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
openssh-server  | Permissions 0777 for '/etc/ssh/ssh_host_ecdsa_key' are too open.
openssh-server  | It is required that your private key files are NOT accessible by others.
openssh-server  | This private key will be ignored.
openssh-server  | @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
openssh-server  | @         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
openssh-server  | @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
openssh-server  | Permissions 0777 for '/etc/ssh/ssh_host_ed25519_key' are too open.
openssh-server  | It is required that your private key files are NOT accessible by others.
openssh-server  | This private key will be ignored.
openssh-server  | sshd: no hostkeys available -- exiting.

That’s why I can’t log in:

ssh test@xxx -p 2222
kex_exchange_identification: Connection closed by remote host
Connection closed by xxx port 2222

Here is my docker-compose.yml:

services:
  openssh-server:
    image: lscr.io/linuxserver/openssh-server:latest
    container_name: openssh-server
    hostname: openssh-server #optional
    environment:
      - PUID=1027
      - PGID=100
      - TZ=Europe/Berlin
      # - PUBLIC_KEY=yourpublickey #optional
      #- PUBLIC_KEY_FILE=/path/to/file #optional
      #- PUBLIC_KEY_DIR=/path/to/directory/containing/_only_/pubkeys #optional
      #- PUBLIC_KEY_URL=https://github.com/username.keys #optional
      - SUDO_ACCESS=false #optional
      - PASSWORD_ACCESS=true #optional
      - USER_PASSWORD=pass #optional
      #- USER_PASSWORD_FILE=/path/to/file #optional
      - USER_NAME=test #optional
      - LOG_STDOUT=true #optional
    volumes:
      - ./config:/config
      - /volume1/Backup/:/var/local/test
    ports:
      - 2222:2222
    restart: unless-stopped

The host keys are stored in the config volume.

What’s wrong? :thinking:

2

Well I found a solution by manually changing the permissions on the host.

But now I’m wondering whether this could be solved via the entrypoint script in general? Otherwise, I would suggest adding to the documentation. It is very clear, but I couldn’t find anything on this point at Docker.

What do you think?

3

It’s in the documentation of openssh already

4

This topic was automatically closed 5 days after the last reply. New replies are no longer allowed.