From initial investigation seems AWS does this automagically, we should revert this change to mitigate suprises to test

AWS alters a single directive in the /etc/ssh/sshd_config at launch.  AWS alters this file at launch, regardless of its state on disk or backup.  This prevents any user from using PAM password login.  Only ssh public key authentication (based on the ec2-user) key used to launch the instance) can take place.

Match Address localhost,127.0.0.1,::1
      PasswordAuthentication yes

should prevent remote users from using passwords while it allows tests to use password on localhost

@plautrba this seems something for the test. If we will do anything on our side, it will be just removing that line AWS seems to be adding.

Or you could revert all changes to default openssh configuration, i.e. rpm -qV openssh-server would not report any changes.

@plautrba, thanks, yeah, I guess that will be the safest thing to do, will add a playbook for it

ping?

@plautrba sorry forgot a bit, thanks for pinging, will do it today

@mvadkert Are you going to update ZUUL images? https://fedora.softwarefactory-project.io/zuul/build/5bdcba9188114a9fa6f4521513187c08/logs

@plautrba zuul images? how is that related to the issue?

@mvadkert Are you going to update ZUUL images? https://fedora.softwarefactory-project.io/zuul/build/5bdcba9188114a9fa6f4521513187c08/logs

I haven't really investigated but ^^ seems like the same problem - https://fedora.softwarefactory-project.io/zuul/build/5bdcba9188114a9fa6f4521513187c08/log/artifacts/FAIL-selinux-selinux-policy-pam_console-and-related-err.log

@mmalik ^^ could you confirm?

As you can see in the following file, password authentication is not allowed, which means that ssh.exp command fails:
* https://fedora.softwarefactory-project.io/zuul/build/5bdcba9188114a9fa6f4521513187c08/log/artifacts/FAIL-selinux-selinux-policy-pam_console-and-related.log

For comparison purposes, the following automated test enables the password authentication on its own and ssh.exp command is successful:
* https://fedora.softwarefactory-project.io/zuul/build/5bdcba9188114a9fa6f4521513187c08/log/artifacts/FAIL-selinux-selinux-policy-perf_event-and-related-err.log
* https://fedora.softwarefactory-project.io/zuul/build/5bdcba9188114a9fa6f4521513187c08/log/artifacts/FAIL-selinux-selinux-policy-perf_event-and-related.log

@plautrba agreed, but for that you will need I guess @fbo to get it fixed in ZUUL, not sure where to fix it there ....

Hi @mmalik and @plautrba,

Thanks @mvadkert to redirect the issue to me. Fedora cloud images used by the Zuul CI are defined here: https://softwarefactory-project.io/cgit/config/tree/nodepool/virt_images and the sshd_config we provide does not allow PasswordAuth https://softwarefactory-project.io/cgit/config/tree/nodepool/virt_images/roles/sshd-config/files/sshd_config

The CI user on the test node can sudo to root to change default if needed. So I guess the test should change the sshd-config and reload sshd. Could it be something you can add to your test script ?

I don't think the images should allow PasswordAuth by default.

Unfortunately it's not the only test, but a set of different tests which expects default sshd configuration and I don't think it's feasible to have tests which prepare the environment on their own.

Could you, at least, allow PasswordAuth from localhost - https://pagure.io/fedora-ci/general/issue/192#comment-706321?

I read to fast the issue thread ...
Yes allowing it from localhost seems ok to me.
I did the proposal here https://softwarefactory-project.io/r/20919 then let's wait a bit to let time for review. Then I'll make sure the Fedora images are well rebuilt and published on the provider.
I'll keep you updated.

@plautrba: Images have been rebuilt and published on the provider. So please retry and let me know if you still have the issue.

@plautrba should be resolved also in Fedora CI

@plautrba should be resolved also in Fedora CI

@plautrba: Images have been rebuilt and published on the provider. So please retry and let me know if you still have the issue.

@mmalik please test

Logging into localhost via SSH with password works correctly. Example:
* https://src.fedoraproject.org/tests/selinux/pull-request/187

\o/