From a9a1531d6bd9d08bde91c81825663ab5bc70a645 Mon Sep 17 00:00:00 2001 From: Om Singhal Date: Mon, 6 Jul 2026 22:23:56 -0400 Subject: [PATCH] Fix #307: pin sshd LoginGraceTime to cover the 2FA push window SSH logins into a container authenticate through sssd -> the LDAP gateway, which fires a push-notification 2FA and allows up to 60s for it to be answered (ldap_opt_timeout in sssd.conf.template). sshd's default LoginGraceTime can drop the connection before that window closes, so a user answering the push in time still gets disconnected. Add a dedicated sshd_config.d drop-in that sets LoginGraceTime to 75s -- above the 60s 2FA timeout, leaving headroom for the TCP and key-exchange handshake that precedes the LDAP bind -- and copy it into the base image. --- images/base/50-login-grace-time.conf | 7 +++++++ images/base/Dockerfile | 1 + 2 files changed, 8 insertions(+) create mode 100644 images/base/50-login-grace-time.conf diff --git a/images/base/50-login-grace-time.conf b/images/base/50-login-grace-time.conf new file mode 100644 index 00000000..81834c1e --- /dev/null +++ b/images/base/50-login-grace-time.conf @@ -0,0 +1,7 @@ +# Give SSH logins enough time to answer the push-notification 2FA prompt. +# Authentication flows through sssd -> the LDAP gateway, which allows up to +# 60s for a push to be responded to (see ldap_opt_timeout in sssd.conf.template). +# sshd's default LoginGraceTime can cut the connection before that window +# closes, so pin it above the 60s 2FA timeout, leaving headroom for the TCP +# and key-exchange handshake that precedes the LDAP bind. See issue #307. +LoginGraceTime 75 diff --git a/images/base/Dockerfile b/images/base/Dockerfile index d0d7a97c..c38641e7 100644 --- a/images/base/Dockerfile +++ b/images/base/Dockerfile @@ -28,6 +28,7 @@ RUN apt-get update && \ COPY --chmod=0440 sssd.conf.template /etc/sssd/sssd.conf.template COPY --chmod=0440 50-sssd-conf-template.conf /etc/systemd/system/sssd.service.d/50-sssd-conf-template.conf COPY --chmod=0644 50-sss-ssh-authorizedkeys.conf /etc/ssh/sshd_config.d/50-sss-ssh-authorizedkeys.conf +COPY --chmod=0644 50-login-grace-time.conf /etc/ssh/sshd_config.d/50-login-grace-time.conf COPY --chmod=0440 ldapusers /etc/sudoers.d/ldapusers COPY --chmod=0644 ldap.conf /etc/ldap/ldap.conf COPY --chmod=0755 git-identity.sh /etc/profile.d/git-identity.sh