为什么每次启动后都缺少/ var / run / sshd？

我正在Proxmox 5.2-11下运行Ubuntu 16.04容器。在应用最新一轮补丁1之后，我无法在控制台或ssh上登录。

我将容器根FS安装在虚拟机管理程序上，并添加pts/0到/etc/security/access.conf（我们运行pam_access），这允许根登录到控制台。我们已经root : lxc/tty0 lxc/tty1 lxc/tty2在access.conf，我认为是足够的，为什么我需要pts/0现在是令人费解。

我注意到ssh没有运行，因此尝试手动启动（/usr/sbin/sshd -DDD -f /etc/ssh/sshd_config）并收到此错误：

Missing privilege separation directory: /var/run/sshd

我手动创建了目录，启动ssh并终于可以登录，但是重新启动后，问题仍然存在。未创建目录。唯一有用的journalctl部分，唯一有趣的部分是有关“不允许操作”的内容，但没有更多信息。

我对16.04不太熟悉，所以想知道如何才能找到有关该问题的更多信息。我没有/var/log/syslog或/var/log/messages只有kern.log这样的迷路。

1个

systemd-sysv 229-4ubuntu21.9
libpam-systemd 229-4ubuntu21.9
libsystemd0 229-4ubuntu21.9
systemd 229-4ubuntu21.9
udev 229-4ubuntu21.9
libudev1 229-4ubuntu21.9
iproute2 4.3.0-1ubuntu3.16.04.4
libsasl2-modules-db 2.1.26.dfsg1-14ubuntu0.1
libsasl2-2 2.1.26.dfsg1-14ubuntu0.1
ldap-utils 2.4.42dfsg-2ubuntu3.4
libldap-2.4-2 2.4.42dfsg-2ubuntu3.4
libsasl2-modules 2.1.26.dfsg1-14ubuntu0.1
libgs9-common 9.25dfsg1-0ubuntu0.16.04.3
ghostscript 9.25dfsg1-0ubuntu0.16.04.3
libgs9 9.25dfsg1-0ubuntu0.16.04.3

[2]

Nov 27 10:13:48 host16 systemd[1]: Starting OpenBSD Secure Shell server...
Nov 27 10:13:48 host16 sshd[474]: Missing privilege separation directory: /var/run/sshd
Nov 27 10:13:48 host16 systemd[1]: ssh.service: Control process exited, code=exited status=255
Nov 27 10:13:48 host16 systemd[1]: Failed to start OpenBSD Secure Shell server.
Nov 27 10:13:48 host16 systemd[1]: ssh.service: Unit entered failed state.
Nov 27 10:13:48 host16 systemd[1]: ssh.service: Failed with result 'exit-code'.
Nov 27 10:13:48 host16 mysqld_safe[495]: Starting mysqld daemon with databases from /var/lib/mysql/mysql
Nov 27 10:13:48 host16 mysqld[500]: 181127 10:13:48 [Note] /usr/sbin/mysqld (mysqld 10.0.36-MariaDB-0ubuntu0.16.04.1) starting as process 499 ...
Nov 27 10:13:48 host16 systemd[1]: ssh.service: Service hold-off time over, scheduling restart.
Nov 27 10:13:48 host16 systemd[1]: Stopped OpenBSD Secure Shell server.
Nov 27 10:13:48 host16 systemd[1]: Failed to reset devices.list on /system.slice/ssh.service: Operation not permitted
Nov 27 10:13:48 host16 systemd[1]: Starting OpenBSD Secure Shell server...
Nov 27 10:13:48 host16 sshd[502]: Missing privilege separation directory: /var/run/sshd
Nov 27 10:13:48 host16 systemd[1]: ssh.service: Control process exited, code=exited status=255
Nov 27 10:13:48 host16 systemd[1]: Failed to start OpenBSD Secure Shell server.
Nov 27 10:13:48 host16 systemd[1]: ssh.service: Unit entered failed state.
Nov 27 10:13:48 host16 systemd[1]: ssh.service: Failed with result 'exit-code'.
Nov 27 10:13:48 host16 systemd[1]: ssh.service: Service hold-off time over, scheduling restart.
Nov 27 10:13:48 host16 systemd[1]: Stopped OpenBSD Secure Shell server.
Nov 27 10:13:48 host16 systemd[1]: Failed to reset devices.list on /system.slice/ssh.service: Operation not permitted
Nov 27 10:13:48 host16 systemd[1]: Starting OpenBSD Secure Shell server...
Nov 27 10:13:48 host16 sshd[503]: Missing privilege separation directory: /var/run/sshd
Nov 27 10:13:48 host16 systemd[1]: ssh.service: Control process exited, code=exited status=255
Nov 27 10:13:48 host16 systemd[1]: Failed to start OpenBSD Secure Shell server.
Nov 27 10:13:48 host16 systemd[1]: ssh.service: Unit entered failed state.
Nov 27 10:13:48 host16 systemd[1]: ssh.service: Failed with result 'exit-code'.
Nov 27 10:13:48 host16 systemd[1]: ssh.service: Service hold-off time over, scheduling restart.
Nov 27 10:13:48 host16 systemd[1]: Stopped OpenBSD Secure Shell server.
Nov 27 10:13:48 host16 systemd[1]: Failed to reset devices.list on /system.slice/ssh.service: Operation not permitted
Nov 27 10:13:48 host16 systemd[1]: Starting OpenBSD Secure Shell server...
Nov 27 10:13:48 host16 sshd[504]: Missing privilege separation directory: /var/run/sshd
Nov 27 10:13:48 host16 systemd[1]: ssh.service: Control process exited, code=exited status=255
Nov 27 10:13:48 host16 systemd[1]: Failed to start OpenBSD Secure Shell server.
Nov 27 10:13:48 host16 systemd[1]: ssh.service: Unit entered failed state.
Nov 27 10:13:48 host16 systemd[1]: ssh.service: Failed with result 'exit-code'.
Nov 27 10:13:49 host16 systemd[1]: ssh.service: Service hold-off time over, scheduling restart.
Nov 27 10:13:49 host16 systemd[1]: Stopped OpenBSD Secure Shell server.
Nov 27 10:13:49 host16 systemd[1]: ssh.service: Start request repeated too quickly.
Nov 27 10:13:49 host16 systemd[1]: Failed to start OpenBSD Secure Shell server.
Nov 27 10:13:49 host16 systemd[1]: ssh.service: Unit entered failed state.
Nov 27 10:13:49 host16 systemd[1]: ssh.service: Failed with result 'start-limit-hit'.
Nov 27 10:13:49 host16 systemd[1]: Started /etc/rc.local Compatibility.
Nov 27 10:13:49 host16 systemd[1]: Failed to reset devices.list on /system.slice/plymouth-quit.service: Operation not permitted
Nov 27 10:13:49 host16 systemd[1]: Starting Terminate Plymouth Boot Screen...
Nov 27 10:13:49 host16 systemd[1]: Failed to reset devices.list on /system.slice/plymouth-quit-wait.service: Operation not permitted
Nov 27 10:13:49 host16 systemd[1]: Starting Hold until boot process finishes up...
Nov 27 10:13:49 host16 systemd[1]: Failed to reset devices.list on /system.slice/rc-local.service: Operation not permitted
Nov 27 10:13:49 host16 systemd[1]: Started Hold until boot process finishes up.
Nov 27 10:13:49 host16 systemd[1]: Started Container Getty on /dev/pts/1.
Nov 27 10:13:49 host16 systemd[1]: Started Container Getty on /dev/pts/0.
Nov 27 10:13:49 host16 systemd[1]: Failed to reset devices.list on /system.slice/console-getty.service: Operation not permitted
Nov 27 10:13:49 host16 systemd[1]: Started Console Getty.
Nov 27 10:13:49 host16 systemd[1]: Reached target Login Prompts.
Nov 27 10:13:49 host16 systemd[1]: Started Terminate Plymouth Boot Screen.
Nov 27 10:13:52 host16 nslcd[338]: accepting connections
Nov 27 10:13:52 host16 nslcd[275]:    ...done.
Nov 27 10:13:52 host16 systemd[1]: Started LSB: LDAP connection daemon.
Nov 27 10:13:52 host16 systemd[1]: Failed to reset devices.list on /system.slice/cron.service: Operation not permitted
Nov 27 10:13:52 host16 systemd[1]: Started Regular background program processing daemon.
Nov 27 10:13:52 host16 systemd[1]: Failed to reset devices.list on /system.slice/atd.service: Operation not permitted

增加systemd-tmpfiles --create输出

真的很奇怪。。。我检查了一下/tmp，发现这些文件不存在

您犯的一个错误是尝试sshd手动开始。

如果您改为sshd通过官方途径开始，那应该就可以了。该service命令知道在您的发行版上启动服务的正确方法是什么，这应该可行：

service ssh start

对于sysv初始化脚本，这就是您需要做的所有事情。目录丢失的原因是它/var/run是一个符号链接，/run并且/run是tmpfs安装点。这意味着每次启动时/var/run都将为空。使用该service命令时，/etc/init.d/ssh将使用脚本启动，sshd但在此之前，脚本将创建（/var/run/sshd如果脚本不存在）。

随着systemd工作的事情有点不同。将有一个/usr/lib/tmpfiles.d/sshd.conf包含以下内容的文件：

d /var/run/sshd 0755 root root

在启动过程中，这将导致/var/run/sshd创建目录。您需要验证文件是否存在以及内容是否正确。如果/var/run/sshd目录仍然丢失，则可以验证在systemd-tmpfiles --create手动运行时是否创建了该目录。

因此，/ run（和/ var / run符号链接到它）在每次重新启动时都会重新创建。除非systemd-tmpfiles对某些文件（包括（/ var）/ run / sshd）没有执行此操作。

显然，这是通过OpenVZ内核升级解决的。但是现在要真正修复它，您可以编辑/usr/lib/tmpfiles.d/sshd.conf并/var从行中删除d /var/run/sshd 0755 root root以读取： d /run/sshd 0755 root root

就是这样..！

并且，当openssh-server升级时，我们希望他们将解决此错误（或者它真的是systemd或openvz ??中的错误）–否则您可能会遇到相同的问题。

当运行OpenVZ内核2.6.32-042stab134.7或更高版本时，显然可以解决此问题。我感到奇怪的是，以某种方式在systemd启动脚本中无法修复。可能是一个丑陋的hack，例如在启动后自动创建/ run / sshd /，然后启动sshd会起作用。

我的输出systemd-tmpfiles --create：

[/usr/lib/tmpfiles.d/var.conf:14] Duplicate line for path "/var/log", ignoring.
fchownat() of /run/named failed: Invalid argument
Failed to openat(/dev/simfs): Operation not permitted
Failed to validate path /var/run/screen: Too many levels of symbolic links
Failed to validate path /var/run/sshd: Too many levels of symbolic links
Failed to validate path /var/run/sudo: Too many levels of symbolic links
Failed to validate path /var/run/sudo/ts: Too many levels of symbolic links
fchownat() of /run/systemd/netif failed: Invalid argument
fchownat() of /run/systemd/netif/links failed: Invalid argument
fchownat() of /run/systemd/netif/leases failed: Invalid argument
fchownat() of /run/log/journal failed: Invalid argument
fchownat() of /run/log/journal/e9e1d08bc42c48999865b96c250f40cc failed: Invalid argument
fchownat() of /run/log/journal/e9e1d08bc42c48999865b96c250f40cc/system.journal failed: Invalid argument

OpenVZ 2.6.32-042stab134.7的更新日志说：

使用systemd 229-4ubuntu21.9运行Ubuntu容器可能会导致服务无法启动，因为systemd-tmpfiles由于符号链接问题而无法验证路径。（PSBM-90038）

对于尽可能多的麻烦，因为我已经受够了systemd多年来，我必须承认这个问题，而不是源于Ansible 同步指令。

出于某种原因，在为该主机配置了我们的Ansbile脚本之后，它离开了/目录（以及/ etc，/ opt和其他目录），该目录由管理员用户拥有，而不是root用户。运行chown以纠正错误后，/var/run/sshd现在再次在启动时创建。

我真的很感谢所有输入，但是这里没有错误，至少在某种意义上说，对根目录应用不适当的所有权会导致未定义的系统行为。