azure - 在 Azure 应用服务上为容器启用 SSH 会将垃圾转储到日志流中，我做错了什么吗？

Question

按照文档启用 SSH 控制台以在 Azure 门户中使用 Linux 容器工作，会导致容器将大量垃圾转储到日志流，最终重新启动 Web 应用。

https://learn.microsoft.com/en-us/azure/app-service/containers/configure-custom-container#enable-ssh

我尝试了几个不同的 sshd_config 选项，但似乎没有任何帮助。文档说使用这个配置文件

Port            2222
ListenAddress       0.0.0.0
LoginGraceTime      180
X11Forwarding       yes
Ciphers aes128-cbc,3des-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr
MACs hmac-sha1,hmac-sha1-96
StrictModes         yes
SyslogFacility      DAEMON
PasswordAuthentication  yes
PermitEmptyPasswords    no
PermitRootLogin     yes
Subsystem sftp internal-sftp

我正在使用

生成 key

ssh-keygen -A 

docker 文件

FROM centos

# Timezone 
ENV TZ America/New_York

# openssh-server, nginx and supervisor
RUN yum -y update && \
    yum -y install epel-release \
    http://rpms.remirepo.net/enterprise/remi-release-7.rpm \
    openssh-server && \
    yum-config-manager --enable remi-php72 && \
    yum install -y nginx \
    supervisor && \
    echo "root:Docker!" | chpasswd  && \
    ssh-keygen -A 

# ssh configuration
COPY sshd_config /etc/ssh/

# Setup Supervisor 
COPY nginx.ini ssh.ini /etc/supervisord.d/

EXPOSE 2222 80

ENTRYPOINT ["supervisord", "-n", "-c", "/etc/supervisord.conf"]

nginx.ini

[program:nginx]
command=/usr/sbin/nginx -g 'daemon off;'
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0

ssh.ini

[program:sshd]
command=/usr/sbin/sshd -D
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0

只是期望启用此功能并在 azure 门户中使用 SSH 选项，而无需关闭容器。任何使这项工作可行的想法

这是日志流中抛出的内容的示例

2019-05-17T15:34:21  Welcome, you are now connected to log-streaming service.DEBUG: Outgoing: Writing CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:28,padLen:17,remainLen:16DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)DEBUG: Outgoing: Writing CHANNEL_DATA (0)DEBUG: Outgoing: Writing CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:28,padLen:17,remainLen:16DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:28,padLen:16,remainLen:16DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:60,padLen:10,remainLen:48DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)DEBUG: Outgoing: Writing CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:28,padLen:17,remainLen:16DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)DEBUG: Outgoing: Writing CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:28,padLen:17,remainLen:16DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)DEBUG: Outgoing: Writing CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:28,padLen:17,remainLen:16DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)DEBUG: Outgoing: Writing CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:28,padLen:17,remainLen:16DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)DEBUG: Outgoing: Writing CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:28,padLen:17,remainLen:16DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)DEBUG: Outgoing: Writing CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:28,padLen:17,remainLen:16DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)DEBUG: Outgoing: Writing CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:28,padLen:17,remainLen:16DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)DEBUG: Outgoing: Writing CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:44,padLen:7,remainLen:32DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)DEBUG: Outgoing: Writing CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:28,padLen:17,remainLen:16DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)DEBUG: Outgoing: Writing CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:28,padLen:17,remainLen:16DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)DEBUG: Outgoing: Writing CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:28,padLen:16,remainLen:16DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)DEBUG: Parser: IN_PACKETDEBUG: Parser: DecryptingDEBUG: Parser: pktLen:2972,padLen:11,remainLen:2960DEBUG: Parser: IN_PACKETDATADEBUG: Parser: DecryptingDEBUG: Parser: HMAC size:20DEBUG: Parser: IN_PACKETDATAVERIFYDEBUG: Parser: Verifying MACDEBUG: Parser: IN_PACKETDATAVERIFY (Valid HMAC)DEBUG: Parser: IN_PACKETDATAAFTER, packet: CHANNEL_DATA (0)DEBUG: Parser: IN_PACKETBEFORE (expecting 16)

Answer 1

最终为此向 MS 开具了票证，显然日志流在启用 SSH 的情况下执行此操作。他们说这是他们捕获 std/out 日志以在 azure 门户中显示它们的方式。我们结束了对 CentOS、Debian 和 Alpine 的尝试，它们都将垃圾转储到日志流中。通过 kudu/api 可用的 docker-logs 不会捕获垃圾，因此至少日志保持干净。

我最终无法使用我们制作的 PoC 容器重新启动，因此我关闭了票证，没有问题。