System is booting up. Unprivileged users are not permitted Connection closed by 172.19.0.2 port 22

1.环境

1.1一台服务器，两个docker容器，内容如下：

gpdb_a(主机）:

docker run --privileged=true -itd \
  --name gpdb_a \
  --hostname gpdb_a \
  --network gpnet \
  --ip 172.19.0.2  \
  -v gpmaster_a:/opt/greenplum/data \
  -v gpdata_a:/data \
  -v /sys/fs/cgroup:/sys/fs/cgroup \
  -p 5433:5432 \
  -p 2222:22 \
  -p 28080:28080 \
  -e TZ=Asia/Shanghai \
  lhrbest/greenplum:7.2.0 \
  bash -c "systemctl disable systemd-modules-load.service dnf-makecache.service && /usr/sbin/sshd  && tail -f /dev/null"

gpdb_b:

docker run --privileged=true -itd \
  --name gpdb_b \
  --hostname gpdb_b \
  --network gpnet \
  --ip 172.19.0.3 \
  -v gpdata_b:/data \
  -v gpmaster_b:/opt/greenplum/data \
  -v /sys/fs/cgroup:/sys/fs/cgroup \
  -p 5434:5432 \
  -p 2224:22 \
  -p 28081:28080 \
  -e TZ=Asia/Shanghai \
  lhrbest/greenplum:7.2.0 \
  bash -c "systemctl disable systemd-modules-load.service dnf-makecache.service && /usr/sbin/sshd  && tail -f /dev/null"

1. 1.2更新 /etc/hosts 文件

echo "172.19.0.2 gpdb_a" >> /etc/hosts

echo "172.19.0.3 gpdb_b" >> /etc/hosts

echo "172.19.0.2 gpdb7" >> /etc/hosts

1.3修改sshd_config 配置

#vi /etc/ssh/sshd_config

 # 启用 root 登录（默认可能被禁用）

PermitRootLogin yes

# AllowUsers 是白名单机制：只有列出的用户才能通过 SSH 登录。用户名之间用 空格 分隔。

AllowUsers gpadmin root

PasswordAuthentication yes

ChallengeResponseAuthentication yes

# 使用 PAM 进行认证（通常保持开启）

UsePAM yes

2.现象

执行如下命令：

gpinitsystem -c  /home/gpadmin/gpinitsystem_config  -h /home/gpadmin/hostfile_exkeys

报如下错误：

20250702:17:31:54:000548 gpinitsystem:gpdb_a:gpadmin-[INFO]:-Checking configuration parameters, please wait...

20250702:17:31:54:000548 gpinitsystem:gpdb_a:gpadmin-[INFO]:-Reading Greenplum configuration file /home/gpadmin/gpinitsystem_config

20250702:17:31:54:000548 gpinitsystem:gpdb_a:gpadmin-[INFO]:-Locale has not been set in /home/gpadmin/gpinitsystem_config, will set to default value

20250702:17:31:54:000548 gpinitsystem:gpdb_a:gpadmin-[INFO]:-No DATABASE_NAME set, will exit following template1 updates

20250702:17:31:54:000548 gpinitsystem:gpdb_a:gpadmin-[INFO]:-COORDINATOR_MAX_CONNECT not set, will set to default value 250

20250702:17:31:54:000548 gpinitsystem:gpdb_a:gpadmin-[INFO]:-Coordinator IP address array = ::1

20250702:17:31:54:000548 gpinitsystem:gpdb_a:gpadmin-[INFO]:-Checking configuration parameters, Completed

20250702:17:31:54:000548 gpinitsystem:gpdb_a:gpadmin-[INFO]:-Commencing multi-home checks, please wait...

The authenticity of host 'gpdb_a (172.19.0.2)' can't be established.

ECDSA key fingerprint is SHA256:t/o0ocQEdpVTyNMR/4kG3JA58LBiopwBQV/IZpiFC/U.

Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

Warning: Permanently added 'gpdb_a,172.19.0.2' (ECDSA) to the list of known hosts.

"System is booting up. Unprivileged users are not permitted to log in yet. Please come back later. For technical details, see pam_nologin(8)."

Connection closed by 172.19.0.2 port 22

The authenticity of host 'gpdb_b (172.19.0.3)' can't be established.

ECDSA key fingerprint is SHA256:t/o0ocQEdpVTyNMR/4kG3JA58LBiopwBQV/IZpiFC/U.

Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

Warning: Permanently added 'gpdb_b,172.19.0.3' (ECDSA) to the list of known hosts.

"System is booting up. Unprivileged users are not permitted to log in yet. Please come back later. For technical details, see pam_nologin(8)."

Connection closed by 172.19.0.3 port 22

20250702:17:32:32:000548 gpinitsystem:gpdb_a:gpadmin-[INFO]:-Configuring build for multi-home array

/usr/local/greenplum-db-7.2.0/bin/gpinitsystem: line 576: ((: REMAINDER=2 % 0: division by 0 (error token is "0")

/usr/local/greenplum-db-7.2.0/bin/gpinitsystem: line 577: ((: MULTIPLE=2 / 0: division by 0 (error token is "0")

/usr/local/greenplum-db-7.2.0/bin/gpinitsystem: line 578: [: -ne: unary operator expected

/usr/local/greenplum-db-7.2.0/bin/gpinitsystem: line 578: [: -eq: unary operator expected

/usr/local/greenplum-db-7.2.0/bin/gpinitsystem: line 586: [: -gt: unary operator expected

20250702:17:32:32:000548 gpinitsystem:gpdb_a:gpadmin-[INFO]:-Commencing multi-home checks, Completed

20250702:17:32:32:000548 gpinitsystem:gpdb_a:gpadmin-[INFO]:-Building primary segment instance array, please wait...

20250702:17:32:32:000548 gpinitsystem:gpdb_a:gpadmin-[INFO]:-Checking Coordinator host

20250702:17:32:32:000548 gpinitsystem:gpdb_a:gpadmin-[INFO]:-Checking new segment hosts, please wait...

"System is booting up. Unprivileged users are not permitted to log in yet. Please come back later. For technical details, see pam_nologin(8)."

Connection closed by 172.19.0.2 port 22

/usr/local/greenplum-db-7.2.0/bin/gpinitsystem: line 683: [: -lt: unary operator expected

"System is booting up. Unprivileged users are not permitted to log in yet. Please come back later. For technical details, see pam_nologin(8)."

Connection closed by 172.19.0.2 port 22

20250702:17:32:33:000548 gpinitsystem:gpdb_a:gpadmin-[WARN]:-Postgres version does not match. [postgres (Greenplum Database) 7.2.0 build commit:e1b98a3b5ee92c7ed5faf1cd2b356e6c6446539c != ]

20250702:17:32:33:000548 gpinitsystem:gpdb_a:gpadmin-Postgres version does not match Script Exiting!

3.原因

 其他因素导致 PAM（Pluggable Authentication Modules）阻止了非 root 用户的 SSH 登录。 

3.1检查 /etc/pam.d/sshd 文件

注释掉或删除以下行（如果存在）：

auth       required     pam_nologin.so

保存并退出，然后重启 SSHD 服务：

pkill -f /usr/sbin/sshd

/usr/sbin/sshd

再执行gpinitsystem -c  /home/gpadmin/gpinitsystem_config  -h /home/gpadmin/hostfile_exkeys就可以

4.SSHD文件内容解读

PAM 提供了一种动态认证机制，允许系统管理员通过修改配置文件来控制服务如何进行用户认证、账户管理、密码管理和会话管理。 

认证模块 (auth)

auth       substack     password-auth

这一行表示在处理认证请求时，将使用 password-auth 文件中定义的所有认证模块。substack 指令允许一个 PAM 配置文件包含另一个配置文件的内容。

auth       include      postlogin

使用 include 语句引入 postlogin 文件中的所有认证规则。这通常用于确保用户登录后执行特定的操作或检查。

账户管理模块 (account)

account    required     pam_sepermit.so

这个模块根据 SELinux 的策略来决定是否允许用户的访问。如果 SELinux 策略不允许，则拒绝访问。

account    required     pam_nologin.so

在 /etc/nologin 文件存在的情况下阻止非 root 用户登录。这可以用于系统维护期间临时禁止普通用户登录。

account    include      password-auth

引入 password-auth 文件中的账户管理模块。这有助于集中管理账户验证规则。

密码管理模块 (password)

password   include      password-auth

引入 password-auth 文件中的密码管理模块。这使得可以在一处统一设置密码策略，并应用于多个服务。

会话管理模块 (session)

session    required     pam_selinux.so close

在会话结束时关闭 SELinux 相关的安全上下文。这是确保安全上下文正确管理的重要步骤。

session    required     pam_loginuid.so

设置登录 UID，这对于审计和追踪用户活动非常重要。

session    required     pam_selinux.so open env_params

打开 SELinux 安全上下文，并根据环境参数调整它。这一步通常紧跟在用户登录之后进行。

session    required     pam_namespace.so

提供命名空间支持，可以用来隔离用户的文件系统视图，增加安全性。

session    optional     pam_keyinit.so force revoke

管理用户会话密钥。force revoke 参数强制撤销用户的密钥，以防止潜在的安全风险。

session    optional     pam_motd.so

显示消息日志（Message of the Day），即当用户登录时显示的消息。这个模块是可选的。

session    include      password-auth

引入 password-auth 文件中的会话管理模块。这样做的好处是可以复用已有的配置，减少重复劳动。

session    include      postlogin

再次引入 postlogin 文件中的会话管理模块，确保用户登录后的任何必要操作都被执行。