2

I am trying to do ssh communication to an IP but I get the following error messages in logs.

Jun  5 11:36:50 thetemplate my-sshd[26346]: Accepted password for user1 from 172.80.1.2 port 34278 ssh2
Jun  5 11:36:50 thetemplate my-sshd[26346]: User child is on pid 27078
Jun  5 11:36:50 thetemplate my-sshd[27078]: ssh_selinux_change_context: setcon failed with Invalid argument
Jun  5 11:36:50 thetemplate my-sshd[27078]: Changed root directory to "/test//ssh/home/user1"
Jun  5 11:36:50 thetemplate my-sshd[26346]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument

According to this answer, I tried changing the context for my-sshd by doing

chcon system_u:object_r:sshd_exec_t:s0  /test/bin/my-sshd
service sshd  restart

The error messages still comes in /var/log/messages while doing ssh.

On doing ps -eZ | grep sshd I see that my-sshd has a different context to /usr/sbin/sshd

unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 24012 ? 00:00:00 sshd
unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 24272 ? 00:00:00 sshd
unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 29923 ? 00:00:00 sshd
unconfined_u:unconfined_r:unconfined_java_t:s0-s0:c0.c1023 32487 ? 00:00:00 my-sshd

Could this be the reason for these error messages, if yes how to proceed with this?

Edit:

On level 3 debug, the setcon fails on setting context for the following:

debug3: ssh_selinux_change_context: setting context from 'unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023' to 'unconfined_u:unconfined_r:chroot_user_t:s0-s0:c0.c1023'
ssh_selinux_change_context: setcon failed with Invalid argument

This context change happens before changing the root directory of the server. It does not affect any functionality as root directory is changed and I can ssh into the server. It just clutters my /var/log/messages with these error messages. Is there any way the calling of ssh_selinux_change_context method can be avoided? I can't figure out when exactly is this method triggered. Any other help to identify a solution would also be highly appreciated.

1 Answer 1

1

Use command

audit2allow -w -a

and at the bottom of output You have got linux command what to use for resolve Your problem.

2
  • Hi, on using level 3 debug I found that setcon is failing for the fillowing reason: debug3: ssh_selinux_change_context: setting context from 'unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023' to 'unconfined_u:unconfined_r:chroot_user_t:s0-s0:c0.c1023' ssh_selinux_change_context: setcon failed with Invalid argument Aug 8, 2018 at 6:41
  • audit2allow -M mysshd < /var/log/audit/audit.log and then semodule -i mysshd.pp
    – debek
    Aug 9, 2018 at 11:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .