을 실행하면 chmod g+s /var/www/갑자기 사용자가 로그아웃됩니다. 하지만 강제 로그아웃 없이
명령을 실행할 수 있었습니다 . 다른 디렉터리/사용자/루트를 시도했습니다.. 동일한 동작을 보이는 것 같습니다..chmod g+r /var/www/
이 문제를 어떻게 디버깅할 수 있나요? 내 auth.log를 기록하려고 했습니다.. tail -n300 /var/log/auth.log | grep ssh.
모든 게 정상인 것 같은데..
나는 ..를 사용해 보았습니다 ssh -vvv example.com. 실행 후의 디버그 로그는 다음과 같습니다.chmod g+s test/
[email protected]:~$ chmod g+s test/
[email protected]:~$ debug3: receive packet: type 96
debug2: channel 0: rcvd eof
debug2: channel 0: output open -> drain
debug2: channel 0: obuf empty
debug2: channel 0: chan_shutdown_write (i0 o1 sock -1 wfd 5 efd 6 [write])
debug2: channel 0: output drain -> closed
debug3: receive packet: type 98
debug1: client_input_channel_req: channel 0 rtype exit-signal reply 0
debug3: receive packet: type 98
debug1: client_input_channel_req: channel 0 rtype [email protected] reply 0
debug2: channel 0: rcvd eow
debug2: channel 0: chan_shutdown_read (i0 o3 sock -1 wfd 4 efd 6 [write])
debug2: channel 0: input open -> closed
debug3: receive packet: type 97
debug2: channel 0: rcvd close
debug3: channel 0: will not send data after close
debug2: channel 0: almost dead
debug2: channel 0: gc: notify user
debug2: channel 0: gc: user detached
debug2: channel 0: send close
debug3: send packet: type 97
debug2: channel 0: is dead
debug2: channel 0: garbage collecting
debug1: channel 0: free: client-session, nchannels 1
debug3: channel 0: status: The following connections are open:
#0 client-session (t4 r0 i3/0 o3/0 e[write]/0 fd -1/-1/6 sock -1 cc -1)
debug3: send packet: type 1
debug3: fd 1 is not O_NONBLOCK
Connection to 191.168.0.175 closed.
Transferred: sent 4336, received 5004 bytes, in 11.2 seconds
Bytes per second: sent 388.3, received 448.1
debug1: Exit status -1
로그는 다음과 같습니다.sudo journalctl --since="-5 minutes"
Sep 29 11:55:43 example.com sudo[376272]: pam_unix(sudo:session): session opened for user root by zigang(uid=0)
Sep 29 11:55:45 example.com kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:15:5d:a1:98:04:00:15:5d:00:11:04:08:00 SRC=191.168.0.15 DST=191.168.0.175 LEN=52 TOS=0x02 PREC=0x00 TTL=128 ID=54632 DF PROTO=T>
Sep 29 11:56:02 example.com kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:15:5d:a1:98:04:00:15:5d:00:11:04:08:00 SRC=191.168.0.15 DST=191.168.0.175 LEN=52 TOS=0x02 PREC=0x00 TTL=128 ID=54636 DF PROTO=T>
Sep 29 11:56:06 example.com sudo[376272]: pam_unix(sudo:session): session closed for user root
Sep 29 11:56:22 example.com sshd[376250]: Received disconnect from 192.168.14.185 port 59923:11: disconnected by user
Sep 29 11:56:22 example.com sshd[376250]: Disconnected from user zigang 192.168.14.185 port 59923
Sep 29 11:56:22 example.com sshd[376164]: pam_unix(sshd:session): session closed for user zigang
Sep 29 11:56:22 example.com systemd[1]: session-99.scope: Succeeded.
Sep 29 11:56:22 example.com systemd-logind[987]: Session 99 logged out. Waiting for processes to exit.
Sep 29 11:56:22 example.com systemd-logind[987]: Removed session 99.
Sep 29 11:56:23 example.com kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:15:5d:a1:98:04:00:15:5d:00:11:04:08:00 SRC=191.168.0.15 DST=191.168.0.175 LEN=52 TOS=0x02 PREC=0x00 TTL=128 ID=54643 DF PROTO=T>
Sep 29 11:56:24 example.com sshd[376535]: Accepted publickey for zigang from 192.168.14.185 port 59961 ssh2: RSA SHA256:J9nGAkrCD2NDm/IoUI8rKiVPjmBKCy4iqQYRGGiJ3fo
Sep 29 11:56:24 example.com sshd[376535]: pam_unix(sshd:session): session opened for user zigang by (uid=0)
Sep 29 11:56:24 example.com systemd-logind[987]: New session 100 of user zigang.
Sep 29 11:56:24 example.com systemd[1]: Started Session 100 of user zigang.
Sep 29 11:56:30 example.com sudo[376655]: pam_unix(sudo:auth): Couldn't open /etc/securetty: No such file or directory
Sep 29 11:56:32 example.com sudo[376655]: pam_unix(sudo:auth): Couldn't open /etc/securetty: No such file or directory
Sep 29 11:56:32 example.com sudo[376655]: zigang : TTY=pts/6 ; PWD=/home/zigang ; USER=root ; COMMAND=/usr/bin/journalctl --since=-5 minutes
Sep 29 11:56:32 example.com sudo[376655]: pam_unix(sudo:session): session opened for user root by zigang(uid=0)
내 sshd_config는/etc/ssh/sshd_config
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.
Include /etc/ssh/sshd_config.d/*.conf
#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key
# Ciphers and keying
#RekeyLimit default none
# Logging
#SyslogFacility AUTH
#LogLevel INFO
# Authentication:
#LoginGraceTime 2m
#PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10
#PubkeyAuthentication yes
# Expect .ssh/authorized_keys2 to be disregarded by default in future.
#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2
#AuthorizedPrincipalsFile none
#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# To disable tunneled clear text passwords, change to no here!
# PasswordAuthentication yes
#PermitEmptyPasswords no
# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 120
#ClientAliveCountMax 5
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none
# no default banner path
#Banner none
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
# override default of no subsystems
Subsystem sftp /usr/lib/openssh/sftp-server
# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# PermitTTY no
# ForceCommand cvs server
PasswordAuthentication no