# Ssh with port 22 into k8s pod as non root user

**URL:** <https://discuss.kubernetes.io/t/ssh-with-port-22-into-k8s-pod-as-non-root-user/19405>\
**Category:** General Discussions\
**Created:** [March 21, 2022, 2:25am UTC](https://discuss.kubernetes.io/t/ssh-with-port-22-into-k8s-pod-as-non-root-user/19405 "2022-03-21T02:25:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ilango.dhandapani](https://avatars.discourse-cdn.com/v4/letter/i/ba8739/32.png) [@ilango.dhandapani](https://discuss.kubernetes.io/u/ilango.dhandapani)\
**Post date:** [March 21, 2022, 2:25am UTC](https://discuss.kubernetes.io/t/ssh-with-port-22-into-k8s-pod-as-non-root-user/19405/1 "2022-03-21T02:25:34Z")

</div>

Asking for help? Comment out what you need so we can get more information to help you!

### Cluster information:

Kubernetes version: 1.19  
Cloud being used: on-perm  
Installation method: i believe kubeadm  
Host OS: ubuntu

Hi, I have a business requirement to SSH as a non-root into kubernetes pod and this is already in traditional server setup, just moving the same to k8s.  
Have installed metallb. I created my set of private and public keys. Add the public key and sshd\_config ( PasswordAuthentication no  
ChallengeResponseAuthentication no  
UsePAM no) as configmap and mounted as volumes (/root/.ssh/authorized\_keys).  
Created a LB type service which bind the pod with metallb ip.  
Able to ssh using ssh root@metallbip.

Added the non-root user in /etc/group and /etc/passwd, public key under /home/xyz/.ssh/authorized\_keys.If i mount this using configmap, the ownership is root:root.  
So I added them in dockerimage itself, updated the ownership to xyz:xyz’s group and permission to 0600, created pod in k8s cluster. But getting “xyz@metallbip: Permission denied (publickey)”.  
I think am missing something when I want to ssh as a non root user. Am running the pod and openssh-server as root.

Please let me know if anyone can help with this.

---

<div class="post-metadata">

**Author:** ![ilango.dhandapani](https://avatars.discourse-cdn.com/v4/letter/i/ba8739/32.png) [@ilango.dhandapani](https://discuss.kubernetes.io/u/ilango.dhandapani)\
**Post date:** [March 21, 2022, 2:28am UTC](https://discuss.kubernetes.io/t/ssh-with-port-22-into-k8s-pod-as-non-root-user/19405/2 "2022-03-21T02:28:30Z")

</div>

## apiVersion: apps/v1 kind: Deployment metadata: name: application-deployment spec: selector: matchLabels: app: application replicas: 1 template: metadata: labels: app: application spec: containers: - name: application image: my-private-docker-registry/ssh-test:0.1.3 ports: - containerPort: 22 volumeMounts: - name: ssh-volume subPath: sshd\_config mountPath: /etc/ssh/sshd\_config volumes: - name: ssh-volume configMap: name: ssh-config imagePullSecrets: - name: image-pull-secret

apiVersion: v1  
kind: Service  
metadata:  
name: ssh-service  
spec:  
type: LoadBalancer  
ports:

- port: 22  
targetPort: 22  
selector:  
app: application

apiVersion: v1  
kind: ConfigMap  
metadata:  
name: ssh-config  
data:  
sshd\_config: |  
PasswordAuthentication no  
ChallengeResponseAuthentication no  
UsePAM no  
PermitRootLogin no  
AllowUsers xyz  
authorized\_keys: |  
ssh-rsa XXXXXXXXXX

---

<div class="post-metadata">

**Author:** ![ilango.dhandapani](https://avatars.discourse-cdn.com/v4/letter/i/ba8739/32.png) [@ilango.dhandapani](https://discuss.kubernetes.io/u/ilango.dhandapani)\
**Post date:** [March 21, 2022, 2:30am UTC](https://discuss.kubernetes.io/t/ssh-with-port-22-into-k8s-pod-as-non-root-user/19405/3 "2022-03-21T02:30:20Z")

</div>

my dockerfile…

FROM ubuntu  
RUN apt-get update  
RUN apt-get -y install openssh-server  
RUN apt-get -y install net-tools  
RUN apt-get -y install lsof  
RUN apt-get -y install iproute2  
COPY ./id\_rsa.pub /home/xyz/.ssh/authorized\_keys  
COPY ./group /etc/group  
COPY ./passwd /etc/passwd  
RUN mkdir -p /home/xyz/.ssh  
RUN chown -R xyz:xyz\_g /home/xyz/.ssh  
RUN chmod 0700 /home/xyz/.ssh  
RUN chmod 0600 /home/xyz/.ssh/authorized\_keys  
ENTRYPOINT service ssh restart -D  
EXPOSE 22

---

<div class="post-metadata">

**Author:** ![xavi](https://avatars.discourse-cdn.com/v4/letter/x/8e8cbc/32.png) [@xavi](https://discuss.kubernetes.io/u/xavi)\
**Post date:** [March 21, 2022, 6:57pm UTC](https://discuss.kubernetes.io/t/ssh-with-port-22-into-k8s-pod-as-non-root-user/19405/4 "2022-03-21T18:57:19Z")

</div>

Hi:

You should create the user `xyz:xyz_g` in the `Dockerfile`, otherwise, the only user inside the container is `root`.

Best regards,

Xavi

---

<div class="post-metadata">

**Author:** ![Shridhar\_Patil](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/shridhar_patil/32/14280_2.png) [@Shridhar\_Patil](https://discuss.kubernetes.io/u/Shridhar_Patil)\
**Post date:** [February 13, 2024, 9:07am UTC](https://discuss.kubernetes.io/t/ssh-with-port-22-into-k8s-pod-as-non-root-user/19405/5 "2024-02-13T09:07:25Z")

</div>

You can try,

OpenPubkey to SSH Without SSH Keys. Following are the links for more information.

[How to Use OpenPubkey to SSH Without SSH Keys | Docker](https://www.docker.com/blog/how-to-use-openpubkey-to-ssh-without-ssh-keys/)

[How to Handle Kubernetes Zero Trust Security | BastionZero](https://www.bastionzero.com/blog/why-you-should-use-bastionzero-to-secure-access-to-your-k8s-clusters?utm_content=248533620&utm_medium=social&utm_source=linkedin&hss_channel=lcp-71618213)