About Adding SSH Server in Azure app serivce

[chris0203]

Hi Guys,

I am facing a issue when I try to add a SSH server for Azure App Service

I have already added a 00-custom-script.sh to /etc/entrypoint.d/,
then run on it, it's got error

Starting OpenBSD Secure Shell server: sshd/run/sshd must be owned by root and not group or world-writable.

It seems need running this command in root permission

service ssh start

Container start log:

--------------------------------------------------------------------
 ____                             ____  _     _        _   _
/ ___|  ___ _ ____   _____ _ __  / ___|(_) __| | ___  | | | |_ __
\___ \ / _ \  __\ \ / / _ \  __| \___ \| |/ _` |/ _ \ | | | |  _ \
 ___) |  __/ |   \ V /  __/ |     ___) | | (_| |  __/ | |_| | |_) |
|____/ \___|_|    \_/ \___|_|    |____/|_|\__,_|\___|  \___/| .__/
                                                            |_|

Brought to you by serversideup.net
--------------------------------------------------------------------

🙌 To support Server Side Up projects visit:
https://serversideup.net/sponsor

-------------------------------------
ℹ️ Container Information
-------------------------------------

OS:            Debian GNU/Linux 12 (bookworm)
Docker user:   www-data
Docker uid:    33
Docker gid:    33
OPcache:       ✅ Enabled
PHP Version:   8.3.13
Image Version: v3.4.6

(init-webserver-config): Processing /etc/nginx/nginx.conf.template → /etc/nginx/nginx.conf...
(init-webserver-config): Processing /etc/nginx/site-opts.d/http.conf.template → /etc/nginx/site-opts.d/http.conf...
(init-webserver-config): Processing /etc/nginx/site-opts.d/https.conf.template → /etc/nginx/site-opts.d/https.conf...
ℹ️ NOTICE (init-webserver-config): Enabling NGINX site with SSL "off"...
🚀 starting SSH server...
spawn su -c service ssh start
Password: 
[15-Nov-2024 04:20:39] NOTICE: fpm is running, pid 96
[15-Nov-2024 04:20:39] NOTICE: ready to handle connections
✅ NGINX + PHP-FPM is running correctly.

Dockerfile:

FROM serversideup/php:8.3-fpm-nginx

ARG APP_VERSION

# Switch to root so we can do root things
USER root

# Install the intl extension with root permissions
RUN install-php-extensions intl xsl gd

# Start and enable SSH
RUN apt-get update \
    && apt-get install -y --no-install-recommends dialog \
    && apt-get install -y --no-install-recommends openssh-server \
    && apt-get install -y --no-install-recommends expect

RUN mkdir -p /var/run/sshd
RUN echo "root:Docker!" | chpasswd

COPY --chmod=644 ./sshd_config /etc/ssh/
COPY --chmod=755 ./entrypoint.d/99-server-script.sh /etc/entrypoint.d/99-server-script.sh

WORKDIR /var/www/html
RUN composer install -n --no-scripts --optimize-autoloader --prefer-dist
ENV APP_VERSION=${APP_VERSION}

# Enable SSH for azure 
# https://learn.microsoft.com/en-us/azure/app-service/configure-custom-container?tabs=debian&pivots=container-linux#enable-ssh
EXPOSE 2222 22

# Drop back to our unprivileged user
USER www-data

99-server-script.sh

#!/bin/sh
echo "🚀 starting SSH server..."
expect -c 'spawn su -c "service ssh start"; expect "Password:"; send "Docker!\r"; interact'

then I go in container command line, run

service ssh status
sshd is not running ... failed!

Please help !! Many Thanks guys

[jaydrogers]

If you must run SSH in the same container, then you need to create a custom S6 "long run" service: https://github.com/just-containers/s6-overlay

If you're looking to run a separate SSH container, I'm working on a new version of this: https://github.com/serversideup/docker-ssh

Hope this helps!

[chris0203]

OK, Thanks a lot, let me try.

[bnussbau]

For others tackling this problem, my working, but unsatisfactory "solution"

Azure requires the user to be root and, as far as I know, you cannot change the user to be www-data, which means you need to run the ssh server with root privileges(?).

.
└── etc
    ├── s6-overlay
    │   └── s6-rc.d
    │       ├── ssh-server
    │       │   ├── run
    │       │   └── type
    │       └── user
    │           └── contents.d
    │               └── ssh-server
    └── ssh
        └── sshd_config

#/etc/s6-overlay/s6-rc.d/ssh-server/run

#!/command/execlineb -P
s6-setsid -q -- /bin/sh -c "echo Docker! | su -c '/usr/sbin/sshd -D -e'"

#/etc/s6-overlay/s6-rc.d/ssh-server/type

longrun

Dockerfile

# Add SSH Server for Azure
USER root

RUN apt-get update \
    && apt-get install -y --no-install-recommends dialog \
    && apt-get install -y --no-install-recommends openssh-server \
    && echo "root:Docker!" | chpasswd \
    && ssh-keygen -A \
    && chmod 600 /etc/ssh/ssh_host_*_key \
    && chmod 644 /etc/ssh/ssh_host_*_key.pub \
    && chown root:root /etc/ssh/ssh_host_*_key

RUN mkdir -p /var/run/sshd

COPY --chmod=644 ./docker/etc/ssh/sshd_config /etc/ssh/

COPY ./docker/etc/s6-overlay/s6-rc.d/ssh-server /etc/s6-overlay/s6-rc.d/ssh-server

USER www-data

sshd_config

Port 			2222
ListenAddress 		0.0.0.0
LoginGraceTime 		180
X11Forwarding 		yes
Ciphers aes128-cbc,3des-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr
MACs hmac-sha1,hmac-sha1-96
StrictModes 		yes
SyslogFacility 		DAEMON
PasswordAuthentication 	yes
PermitEmptyPasswords 	no
PermitRootLogin 	yes
Subsystem sftp internal-sftp

Verify that it works, the log should display on startup

Server listening on 0.0.0.0 port 2222.

I'm quite sure there is a better way to do this. If you know it, let me know ;)