1

I am trying to do ssh communication to an IP but I get the following error messages in logs.

Jun  5 11:36:50 thetemplate my-sshd[26346]: Accepted password for user1 from 172.80.1.2 port 34278 ssh2
Jun  5 11:36:50 thetemplate my-sshd[26346]: User child is on pid 27078
Jun  5 11:36:50 thetemplate my-sshd[27078]: ssh_selinux_change_context: setcon failed with Invalid argument
Jun  5 11:36:50 thetemplate my-sshd[27078]: Changed root directory to "/test//ssh/home/user1"
Jun  5 11:36:50 thetemplate my-sshd[26346]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument

According to this answer, I tried changing the context for my-sshd by doing

chcon system_u:object_r:sshd_exec_t:s0  /test/bin/my-sshd
service sshd  restart

The error messages still comes in /var/log/messages while doing ssh.

On doing ps -eZ | grep sshd I see that my-sshd has a different context to /usr/sbin/sshd

unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 24012 ? 00:00:00 sshd
unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 24272 ? 00:00:00 sshd
unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 29923 ? 00:00:00 sshd
unconfined_u:unconfined_r:unconfined_java_t:s0-s0:c0.c1023 32487 ? 00:00:00 my-sshd

Could this be the reason for these error messages, if yes how to proceed with this?

Edit:

On level 3 debug, the setcon fails on setting context for the following:

debug3: ssh_selinux_change_context: setting context from 'unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023' to 'unconfined_u:unconfined_r:chroot_user_t:s0-s0:c0.c1023'
ssh_selinux_change_context: setcon failed with Invalid argument

This context change happens before changing the root directory of the server. It does not affect any functionality as root directory is changed and I can ssh into the server. It just clutters my /var/log/messages with these error messages. Is there any way the calling of ssh_selinux_change_context method can be avoided? I can't figure out when exactly is this method triggered. Any other help to identify a solution would also be highly appreciated.

0

Use command

audit2allow -w -a

and at the bottom of output You have got linux command what to use for resolve Your problem.

  • Hi, on using level 3 debug I found that setcon is failing for the fillowing reason: debug3: ssh_selinux_change_context: setting context from 'unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023' to 'unconfined_u:unconfined_r:chroot_user_t:s0-s0:c0.c1023' ssh_selinux_change_context: setcon failed with Invalid argument – rayindrane2l Aug 8 '18 at 6:41
  • audit2allow -M mysshd < /var/log/audit/audit.log and then semodule -i mysshd.pp – debek Aug 9 '18 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.