Packer构建启用OpenScap的RHEL8模板时SSH连接因密码重置失败

我在创建启用OpenSCAP安全配置文件的RHEL8模板时遇到问题：激活CIS配置文件后，系统强制要求重置密码，导致Packer构建失败。尝试改用SSH密钥登录后，仍被要求修改密码，问题未解决。

HCL配置 #

packer {
  required_plugins {
    vmware = {
      version = ">= 1.0.3"
      source = "github.com/hashicorp/vmware"
    }
  }
}
variable "boot_wait" {
  type    = string
  default = "15s"
}
variable "disk_size" {
  type    = string
  default = "40960"
}
variable "iso_checksum" {
  type    = string
  default = "sha256:8CB0DFACC94B789933253D5583A2FB7AFCE26D38D75BE7C204975FE20B7BDF71"
}
variable "iso_url" {
  type    = string
  default = "D:\\isos\\rhel-8.6-x86_64-dvd.iso"
}
variable "memsize" {
  # type    = int
  default = 2048
}
variable "numvcpus" {
  # type    = int
  default = 2
}
variable "ssh_password" {
  type    = string
  default = "admin123"
}
variable "ssh_ppk" {
  type    = string
  default = "E:\\Workspace\\Packer\\RHEL8\\ssh\\id_rsa"
}
variable "ssh_username" {
  type    = string
  default = "admin"
}
variable "vm_name" {
  type    = string
  default = "RHEL8-x86_64"
}

source "vmware-iso" "rhel8-template" {
  boot_command            = ["<tab><bs><bs><bs><bs><bs>inst.text inst.ks=http://{{ .HTTPIP }}:{{ .HTTPPort }}/ks.cfg<enter><wait>"]
  boot_wait               = "${var.boot_wait}"
  cpus                    = "${var.numvcpus}"
  memory                  = "${var.memsize}"
  disk_adapter_type       = "nvme"
  disk_size               = "${var.disk_size}"
  disk_type_id            = "0"
  guest_os_type           = "rhel8-64"
  headless                = false
  http_directory          = "http"
  iso_checksum            = "${var.iso_checksum}"
  iso_url                 = "${var.iso_url}"
  shutdown_command        = "echo 'admin123'|sudo -S /sbin/halt -h -p"
  #ssh_password           = "${var.ssh_password}"
  remote_private_key_file = "${var.ssh_ppk}"
  ssh_port                = 22
  ssh_timeout             = "30m"
  ssh_username            = "${var.ssh_username}"
  ssh_certificate_file    = "${var.ssh_ppk}"
  vm_name                 = "${var.vm_name}"
  vmx_data = {
    "ethernet0.addressType" = "generated"
    "ethernet0.present"     = "TRUE"
    "ethernet0.virtualDev"  = "vmxnet3"
    "virtualHW.version"     = "15"
  }
}
build {
  sources = ["source.vmware-iso.rhel8-template"]

}

Kickstart配置 #

cdrom

lang en_US.UTF-8
keyboard --xlayouts='de (nodeadkeys)'
timezone --utc Europe/Berlin

network --onboot yes --device eth0 --bootproto dhcp --noipv6

rootpw --iscrypted $6$3AKU...c.w0
rootpw --lock

user --name=admin --groups=wheel --password=$6$3AN....c.w0 --iscrypted
sshkey --username=admin "ssh-rsa AAAAB3N...QteU="

firewall --enabled --ssh

authselect select sssd
selinux --enforcing

bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBA...s5qNto0
zerombr

clearpart --linux --initlabel
part /boot --fstype=xfs --size=512
part pv.01 --grow --size=1
volgroup rhel --pesize=4096 pv.01

logvol / --fstype=xfs --name=root --vgname=rhel --size=10240 --grow
logvol /home --fstype=xfs --name=home --vgname=rhel --size=1024 --fsoptions="nodev"
logvol /tmp --fstype=xfs --name=tmp --vgname=rhel --size=1024 --fsoptions="nodev,noexec,nosuid"
logvol /var/tmp --fstype=xfs --name=var_tmp --vgname=rhel --size=1024 --fsoptions="nodev,nosuid,noexec"
logvol /var --fstype=xfs --name=var --vgname=rhel --size=3072
logvol /var/log --fstype=xfs --name=var_log --vgname=rhel --size=1024
logvol /var/log/audit --fstype=xfs --name=var_log_audit --vgname=rhel --size=512
logvol swap --name=swap --vgname=rhel --size=2016

%addon org_fedora_oscap
        content-type = scap-security-guide
        profile = xccdf_org.ssgproject.content_profile_cis
%end

%packages

@^minimal-environment
kexec-tools
python38
# Exclude unnecessary firmwares
-iwl*firmware
-aic94xx-firmware*
-alsa-*

%end 

reboot --eject

错误信息 #

==> vmware-iso.rhel8-template: Error waiting for SSH: Packer experienced an authentication error when trying to connect via SSH. This can happen if your username/password are wrong. You may want to double-check your credentials as part of your debugging process. original error: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none], no supported methods remain

解决方法 #

问题根源是CIS安全配置文件强制要求用户首次登录修改密码，阻断了Packer的SSH自动登录流程，同时部分CIS规则可能限制了SSH密钥认证。

1. 在Kickstart中跳过冲突的OpenSCAP规则
   修改%addon org_fedora_oscap块，跳过强制密码重置和SSH密钥认证限制的规则：

   %addon org_fedora_oscap
           content-type = scap-security-guide
           profile = xccdf_org.ssgproject.content_profile_cis
           # 禁用首次登录强制改密码相关规则
           skip-rule = xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
           skip-rule = xccdf_org.ssgproject.content_rule_accounts_passwords_pam_unix_remember
           # 确保SSH密钥认证被允许
           skip-rule = xccdf_org.ssgproject.content_rule_sshd_disable_password_auth
   %end
   

   注：规则ID需匹配你的SSG版本，可通过oscap info /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml查看完整规则列表。

2. 在Kickstart的%post阶段调整SSH配置
   强制开启SSH密钥认证，关闭挑战响应式认证：

   %post
   # 确保SSH服务允许密钥认证
   sed -i 's/^PubkeyAuthentication no/PubkeyAuthentication yes/' /etc/ssh/sshd_config
   sed -i 's/^ChallengeResponseAuthentication yes/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config
   systemctl restart sshd
   %end
   

3. 修正Packer的SSH配置
   移除错误的ssh_certificate_file配置（该字段应指向公钥证书而非私钥），仅保留私钥配置：

   source "vmware-iso" "rhel8-template" {
     # ... 其他配置保持不变 ...
     remote_private_key_file = "${var.ssh_ppk}"
     ssh_port                = 22
     ssh_timeout             = "30m"
     ssh_username            = "${var.ssh_username}"
     # 移除以下错误配置
     # ssh_certificate_file    = "${var.ssh_ppk}"
     # ... 其他配置保持不变 ...
   }
   

内容的提问来源于stack exchange，提问作者zwerg82