HA Docker (Not Hassio): Are Shell Commands Possible?

Configuration
1

Hi,

I am running HA in Docker on Windows 10, using Linux containers. I also have Portainer running as a seperate container so I have root access to my HA container via Exec Console. I use docker-compose to run my containers and in my docker-compose file I have my HA config directory mapped to a local windows directory.

What I want to Do:
ssh to a pi zero w on my LAN, without having to enter a password, and then execute a python script on said pi, from inside home assistant using a shell command.

How I Am Doing It:
Via Portainer, I launch a bash shell as root and create my ssh keys.
I save the private key to my HA config folder.
I copy the contents of the public key to my raspberry pi using the command

nano /home/pi/.ssh/authorized_keys

What Actually Happens:
When I run:

ssh -i id_rsa -o 'StrictHostKeyChecking=no' [email protected]./switchbot-cmd.py xx:99:xx:xx:xx:xx on

I get the following error:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0755 for 'id_rsa' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "id_rsa": bad permissions

I tried to chmod 600 id_rsa inside the bash shell but the change didn’t take.
Similarly I performed chmod 600 id_rsa inside Cywgin64. Weirdly in Cywgin64 it shows the correct (600) permissions but in Portainer it just shows the original incorrect permissions.

I have tried everything that I can think of at this point. Can anyone help me fix this?

Thanks

2

This may be due to the different way windows and linux handle file permissions. You have a file on a windows system which is mapped into a linux docker container - I suspect that this situatin will be described somewhere in the docker docs

3

I read this is related to sshd strictmodes.
Disabling this may prevent error but i don’t know security implications

StrictModes Specifies whether sshd(8) should check file modes and ownership of the user’s files and home directory before accepting login. This is normally desirable because novices sometimes accidentally leave their directory or files world-writable. The default is yes . Note that this does not apply to ChrootDirectory , whose permissions and ownership are checked unconditionally.

And yes, probably cannot change permissions because linux docker in windows host but could change sshd config if desired

4

I saw this too and I think that’s why all my ssh nodes begin -o StrickHostChecking=no. Include that right after the ssh and see what happens.

Also, I also run core in docker with portainer and used the same method to enter the container shell and generate and share keys with a remote computer.

5

Hi guys,

Thanks a lot for the input, this has been driving me nuts for 2 days! I suspected that it was probably a Windows Docker related issue.

@nickrout thanks for the info - I’ll keep trying to search the docs, not found anything fruitful yet.

@tmjpugh I tried changing StrictModes to no on the pi by editing /etc/ssh/sshd_config but I still experience the same issue as described previously.

@andynbaker the command that I am trying to run is

ssh -i id_rsa -o 'StrictHostKeyChecking=no' [email protected]./switchbot-cmd.py xx:99:xx:xx:xx:xx on

Is the StrictHostKeyChecking=no part what you were referring to? I tried changing the command to

ssh -i id_rsa -o 'StrictHostChecking=no' [email protected]./switchbot-cmd.py xx:99:xx:xx:xx:xx on

but Docker spits out this error suggesting that this isn’t a valid option:

command-line: line 0: Bad configuration option: stricthostchecking

In your post you seem to suggest that we have similar setups - are you also using Docker Windows (with linux containers)?

Do you have an example of a working command? Can you remember if you changed any other settings?

Thanks

6

Sorry, that was an error on my part. Yeah, here’s what I put at the start of all my ssh commands:

ssh -o StrictHostKeyChecking=no -i /data/ssh-node-red [USERNAME]@[IP_ADDRESS]

In my case, my key is named ssh-node-red. I preshared this key from the container shell with all the hosts I planned to ssh into. Note I do not have it in quotes, so maybe try that? Edit: try adding the “/data/” in the keypath. Here’s where mine are stored given my keypath above:

image

Edit edit: I’m just running Docker on Ubuntu 20.04, not windows.

7

Changing stuff on the pi will make no difference whatsoever. The error is coming from the ha docker container inside windows.

Research shows that changing permissions (which is needed here) is not possible (as I read it) https://stackoverflow.com/questions/46597290/cant-change-the-permissions-of-files-folders-on-a-volume-with-docker-windows

8

Hi guys.

Apologies for the delay in getting back to you.

After a couple more days of investigation I finally just bit the bullet and got rid of Windows and I am now running docker on Ubuntu. I can now successfully execute my shell commands. Happy days!

Thanks a lot for your assistance