4

I have a server running a Gogs instance (a self-hosted github clone).

I recently did a manual upgrade, and moved a bunch of things around, including changing the username that the remote users log in as.

Somehow, now, I cannot ssh into the git user (it's named gogs):

Durr@DURRCOMP ~
$ ssh --noprofile [email protected]
PTY allocation request failed on channel 0
bash: /home/git/go/src/github.com/gogits/gogs/gogs: No such file or directory
Connection to 192.168.1.8 closed.

Something, somewhere, is executing (or trying to execute) the binary /home/git/go/src/github.com/gogits/gogs/gogs, which did exist before the changes.

However, I have no idea what is inserting that into the login process.

The shell for the gogs user:

root@vcsbox:/etc/gogs/conf# cat /etc/passwd | grep gogs
gogs:x:109:119::/home/gogs:/bin/bash
root@vcsbox:/etc/gogs/conf#

The gogs user has no .bashrc or .profile:

gogs@vcsbox:~$ pwd
/home/gogs
gogs@vcsbox:~$ ls -a
.  ..  .bash_history  .cache  .gitconfig  gogs-repositories  .nano_history  .ssh
gogs@vcsbox:~$

/etc/profile appears normal:

gogs@vcsbox:~$ cat /etc/profile
# /etc/profile: system-wide .profile file for the Bourne shell (sh(1))
# and Bourne compatible shells (bash(1), ksh(1), ash(1), ...).

if [ "$PS1" ]; then
  if [ "$BASH" ] && [ "$BASH" != "/bin/sh" ]; then
    # The file bash.bashrc already sets the default PS1.
    # PS1='\h:\w\$ '
    if [ -f /etc/bash.bashrc ]; then
      . /etc/bash.bashrc
    fi
  else
    if [ "`id -u`" -eq 0 ]; then
      PS1='# '
    else
      PS1='$ '
    fi
  fi
fi

# The default umask is now handled by pam_umask.
# See pam_umask(8) and /etc/login.defs.

if [ -d /etc/profile.d ]; then
  for i in /etc/profile.d/*.sh; do
    if [ -r $i ]; then
      . $i
    fi
  done
  unset i
fi
gogs@vcsbox:~$

And /etc/profile.d/ has no particularly suspicious contents:

gogs@vcsbox:/etc/profile.d$ ls
bash_completion.sh  Z97-byobu.sh
gogs@vcsbox:/etc/profile.d$ cat *
# Check for interactive bash and that we haven't already been sourced.
if [ -n "$BASH_VERSION" -a -n "$PS1" -a -z "$BASH_COMPLETION_COMPAT_DIR" ]; then

# Check for recent enough version of bash.
bash=${BASH_VERSION%.*}; bmajor=${bash%.*}; bminor=${bash#*.}
if [ $bmajor -gt 4 ] || [ $bmajor -eq 4 -a $bminor -ge 1 ]; then
    [ -r "${XDG_CONFIG_HOME:-$HOME/.config}/bash_completion" ] && \
        . "${XDG_CONFIG_HOME:-$HOME/.config}/bash_completion"
    if shopt -q progcomp && [ -r /usr/share/bash-completion/bash_completion ]; then
        # Source completion code.
        . /usr/share/bash-completion/bash_completion
    fi
fi
unset bash bmajor bminor

fi
#!/bin/sh
#    Z97-byobu.sh - allow any user to opt into auto-launching byobu
#    Copyright (C) 2011 Canonical Ltd.
#
#    Authors: Dustin Kirkland <[email protected]>
#
#    This program is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation, version 3 of the License.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program.  If not, see <http://www.gnu.org/licenses/>.

# Allow any user to opt into auto-launching byobu by setting LC_BYOBU=1
# Apologies for borrowing the LC_BYOBU namespace, but:
#  a) it's reasonable to assume that no one else is using LC_BYOBU
#  b) LC_* is sent and receieved by most /etc/ssh/ssh*_config
if [ -n "$LC_BYOBU" ] && [ "$LC_BYOBU" -gt 0 ] && [ -r "/usr/bin/byobu-launch" ]; then
        . /usr/bin/byobu-launch
elif [ "$LC_TERMTYPE" = "byobu" ] && [ -r "/usr/bin/byobu-launch" ]; then
        . /usr/bin/byobu-launch
elif [ "$LC_TERMTYPE" = "byobu-screen" ] && [ -r "/usr/bin/byobu-launch" ]; then
        export BYOBU_BACKEND="screen"
        . /usr/bin/byobu-launch
elif [ "$LC_TERMTYPE" = "byobu-tmux" ] && [ -r "/usr/bin/byobu-launch" ]; then
        export BYOBU_BACKEND="tmux"
        . /usr/bin/byobu-launch
fi

# vi: syntax=sh ts=4 noexpandtab
gogs@vcsbox:/etc/profile.d$

I've even resorted to a brute-force search of the whole filesystem for the path in question:

root@vcsbox:/etc/gogs/conf# find / -type f | xargs grep gogits 2>/dev/null
/etc/gogs/conf/app.ini:; More detail: https://github.com/gogits/gogs/issues/165
/etc/gogs/conf/app.ini:COOKIE_NAME = i_like_gogits
root@vcsbox:/etc/gogs/conf#

So. Given the above, where the heck could the command possibly be coming from?

System is Ubuntu 14.04 LTS (server edition).

1 Answer 1

13

It is possible to force a command by way of an option in your .ssh/authorized_keys file. This would then obviously only be ran if you tried to log in using that particular ssh key. Check that file, perhaps?

5
  • Yep, that's it. Apparently find / -type f doesn't recurse into hidden directories?
    – Fake Name
    Jan 19, 2016 at 21:06
  • or the forced command uses a variable that evaluates to "...gogits..."?
    – Jeff Schaller
    Jan 19, 2016 at 21:09
  • @JeffSchaller - I'd think the string would have to be somewhere?
    – Fake Name
    Jan 19, 2016 at 21:20
  • gogs.io/docs/intro/troubleshooting.html -- SSH section might apply?
    – Jeff Schaller
    Jan 19, 2016 at 21:26
  • @JeffSchaller - Yep, one click fix. Also, ARRRRGGGGHHHHH so much for my morning.
    – Fake Name
    Jan 19, 2016 at 21:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .