nova_ssh container does not let login - pam issue

[Vladislav Belogrudov]

with some versions of PAM inside nova_ssh ssh connections are closed right after logging in. This leads to failed cold and live migration.

More on the problem:

        https://github.com/docker/docker/issues/5663
        https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=726661
        https://git.fedorahosted.org/cgit/linux-pam.git/tree/modules/pam_loginuid/pam_loginuid.c#n61

There are two ways to fix this - update PAM to the latest or change PAM settings for sshd inside nova_ssh.

[Jeffrey Zhang (jeffrey4l)]

i do not see this issue on centos+source. does this only happen on Ubuntu?

[Vladislav Belogrudov (vlad-belogrudov)]

it happens on centos 6.5 for me

[Jeffrey Zhang (jeffrey4l)]

centos 6.5 is too old for docker. could u upgrade to centos 7 to have a try?

> Docker requires a 64-bit OS and version 3.10 or higher of the Linux kernel.

https://docs.docker.com/engine/installation/linux/centos/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/413030
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=aae9193675ed214f7a4455708409532ea1665255
Submitter: Jenkins
Branch: master

commit aae9193675ed214f7a4455708409532ea1665255
Author: Vladislav Belogrudov <email address hidden>
Date: Tue Dec 20 13:53:33 2016 +0300

    Containerized sshd does not work with older PAM

    sshd containers don't let logins on some systems with older
    PAM library because /proc/self/loginuid is not always readable
    or writeable. Examples of possible failures on such systems are
    erroneous cold and live migrations.

    This fix does not upgrade PAM but makes pam_loginuid optional
    for nova_ssh and keystone_ssh.

    More information:
      https://github.com/docker/docker/issues/5663
      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=726661
      https://git.fedorahosted.org/cgit/linux-pam.git/tree/modules/pam_loginuid/pam_loginuid.c#n61

    Change-Id: Ic14255b042ceedcff536c062bdcba00502af7a87
    Closes-Bug: #1651395

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla 4.0.0.0rc1 release candidate.