ssh版本后open files失效导致gbase8a服务重启报错
某项目在安全漏洞扫描中,发现ssh版本过低,按照安全要求统一做ssh升级。
系统和环境
操作系统:CentOS 7.5
CPU:Intel(R) Xeon(R) Sliver 4114
内存:256GB
磁盘:30TB
升级过程
原SSH版本为:OpenSSH_7.4p1
升级后SSH版本为:OpenSSH_9.0p1
升级过程为源码包编译升级,按照客户提供的升级指导文档进行,升级过程需要提前安装并打开telnet服务,通过telnet登录,执行ssh升级,完成后需要重启ssh服务。
问题现象
升级后服务器root和gbase用户telnet登录和ssh登录正常,但是执行gcluster_services all restart 报错,gcluster服务无法正常停止和启动,报错为
Starting gcware : /opt/gcluster/server/bin/gcluster_services: line 399: ulimit: open files: cannot modify limit: Operation not permitted
[ FAIL ]
[gcware]ulimit is error,smaller than 655360
Starting gcluster : /opt/gcluster/server/bin/gcluster_services: line 399: ulimit: open files: cannot modify limit: Operation not permitted
[ FAIL ]
[gcluster]ulimit is error,smaller than 655360
Starting gcrecover : /opt/gcluster/server/bin/gcluster_services: line 399: ulimit: open files: cannot modify limit: Operation not permitted
[ FAIL ]
[gcrecover]ulimit is error,smaller than 655360
Starting gbase : /opt/gcluster/server/bin/gcluster_services: line 399: ulimit: open files: cannot modify limit: Operation not permitted
[ FAIL ]
[gbase]ulimit is error,smaller than 655360
Starting syncserver : /opt/gcluster/server/bin/gcluster_services: line 399: ulimit: open files: cannot modify limit: Operation not permitted
[ FAIL ]
[syncserver]ulimit is error,smaller than 655360
Starting GCMonit success!
执行ulimit -a 查看,
core file size (blocks, -c) 0
data seg size (kbytes, -d) unlimited
scheduling priority (-e) 0
file size (blocks, -f) unlimited
pending signals (-i) 7152
max locked memory (kbytes, -l) 64
max memory size (kbytes, -m) unlimited
open files (-n) 1024
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority (-r) 0
stack size (kbytes, -s) 8192
cpu time (seconds, -t) unlimited
max user processes (-u) 7152
virtual memory (kbytes, -v) unlimited
file locks (-x) unlimited
open files为1024,查看配置文件/etc/security/limits.conf,其内容为
gbase soft nofile 655360
gbase hard nofile 655360
即ssh升级之后,/etc/security/limits.conf 配置文件失效。
解决过程
通过查询资料,发现系统参数失效和ssh版本升级后机制变化有关,多次尝试后,按照下面办法可以恢复:
a.安装pam-devel
yum install -y pam-devel
b.重新编译openssh包,并增加参数 with-pam,之后执行安装
./configure --prefix=/usr/ --sysconfdir=/etc/ssh --with-pam
c.修改/etc/ssh/sshd_config
添加UsePAM yes 或者去掉该行之前的注释。
d.修改/etc/pam.d/sshd,找不到该文件的话新建一个,文件内容参考下面:
#%PAM-1.0
auth include system-auth
account required pam_nologin.so
account include system-auth
password include system-auth
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_loginuid.so
session required pam_limits.so
之后重启ssh服务,测试root和gbase用户下ulimit -a 显示均恢复正常,gcluster_services all restart 命令也可以正常执行。
热门帖子
- 12025-12-01浏览数:182759
- 22023-05-09浏览数:25044
- 42023-09-25浏览数:18519
- 52020-05-11浏览数:17526