HTSyoTS523 (Couldn't exec requested command (Insecure directory in $ENV{PATH} while running with -T switch at... #141

New issue

Open

opened 2026-05-07 00:19:21 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-07 00:19:21 +02:00

Owner

Originally created by @juju4 on GitHub (Apr 13, 2025).
Original GitHub issue: https://github.com/ovh/the-bastion/issues/551

While running bastion install inside ansible, I get this error but at different part of the install

on github runner, at /opt/bastion/bin/admin/install --managed-upgrade on healtcheck account creation
https://github.com/juju4/ansible_the_bastion/actions/runs/14423697204/job/40449434291#step:8:1808

"cmd": "/opt/bastion/bin/admin/install --managed-upgrade\n",
[...]
        "*** Creating the healthcheck account",
        "\u001b[1;34m---fv-az1319-65-------------------------------------------the-bastion-3.13.01---",
        "\u001b[0m\u001b[34m=> create a new bastion account",
        "\u001b[0m\u001b[34m--------------------------------------------------------------------------------",
        "\u001b[0m\u001b[34m~ \u001b[0mPlease paste the SSH key you want to add. This bastion supports the following algorithms:",
        "\u001b[34m~ \u001b[0mED25519: strongness[#####] speed[#####], use `ssh-keygen -t ed25519' to generate one",
        "\u001b[34m~ \u001b[0mECDSA  : strongness[####.] speed[#####], use `ssh-keygen -t ecdsa -b 521' to generate one",
        "\u001b[34m~ \u001b[0mRSA    : strongness[###..] speed[#....], use `ssh-keygen -t rsa -b 4096' to generate one",
        "\u001b[34m~ \u001b[0m",
        "\u001b[34m~ \u001b[0mIn any case, don't save it without a passphrase (your paste won't be echoed).",
        "",
        "\u001b[31;1m~ \u001b[0m",
        "\u001b[31;1m~ [!] Unknown error (Couldn't read the fingerprint of /tmp/HTSyoTS523 (Couldn't exec requested command (Insecure directory in $ENV{PATH} while running with -T switch at /usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm line 176.))), please report to your sysadmin.\u001b[0m",
        "\u001b[1;34m-------------------------------------------------------------</accountCreate>---",
        "\u001b[0m",
        "`-> [\u001b[31mERR.\u001b[0m] Couldn't create the healthcheck account",
        "",
        "*** Ensuring bastionsync and healthcheck are in bastion-nopam group",
        "usermod: user 'healthcheck' does not exist",
        "",
        "`-> [\u001b[31mERR.\u001b[0m] ",
        "",

likely from https://github.com/ovh/the-bastion/blob/master/lib/perl/OVH/Bastion/ssh.inc#L344
from ansible setup
https://github.com/juju4/ansible_the_bastion/actions/runs/14423697204/job/40449434291#step:11:700

            "PATH": "/opt/hostedtoolcache/Python/3.13.2/x64/bin:/opt/hostedtoolcache/Python/3.13.2/x64:/snap/bin:/home/runner/.local/bin:/opt/pipx_bin:/home/runner/.cargo/bin:/home/runner/.config/composer/vendor/bin:/usr/local/.ghcup/bin:/home/runner/.dotnet/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin",

Here I was thinking to enforce PATH like done here https://github.com/ovh/the-bastion/blob/master/bin/proxy/osh-http-proxy-worker#L29
imho, no reason or nearly to have custom path for system account creation and can't clean github runner environment.
I tried adding it in my ansible play but that didn't help

on github runner inside docker, at initial admin account creation
https://github.com/juju4/ansible_the_bastion/actions/runs/14423697213/job/40449434297#step:7:368

"cmd": "/opt/bastion/bin/admin/setup-first-admin-account.sh admin auto\n"
[...]
[!] Unknown error (Couldn't read the fingerprint of /tmp/2p_95IqsOL (Command exited with status 255)), please report to your sysadmin.

manual run in lxc container gives me a different error and with a paste of ssh pub key needed

~ Creating group admin with GID 99998...
~ Creating user admin with UID 99998...
useradd warning: admin's uid 99998 outside of the UID_MIN 1000 and UID_MAX 60000 range.
useradd: warning: chown on `/home/admin' failed: Invalid argument
~ Creating tty group of account...
~ Adding account to potential supplementary groups...
~ Creating needed files and directories with proper permissions in home...

~ 
~ [!] Couldn't chown ttyrec directory (Invalid argument)

Tested with v3.13.01 and v3.20.00

Originally created by @juju4 on GitHub (Apr 13, 2025). Original GitHub issue: https://github.com/ovh/the-bastion/issues/551 While running bastion install inside ansible, I get this error but at different part of the install * on github runner, at `/opt/bastion/bin/admin/install --managed-upgrade` on healtcheck account creation https://github.com/juju4/ansible_the_bastion/actions/runs/14423697204/job/40449434291#step:8:1808 ``` "cmd": "/opt/bastion/bin/admin/install --managed-upgrade\n", [...] "*** Creating the healthcheck account", "\u001b[1;34m---fv-az1319-65-------------------------------------------the-bastion-3.13.01---", "\u001b[0m\u001b[34m=> create a new bastion account", "\u001b[0m\u001b[34m--------------------------------------------------------------------------------", "\u001b[0m\u001b[34m~ \u001b[0mPlease paste the SSH key you want to add. This bastion supports the following algorithms:", "\u001b[34m~ \u001b[0mED25519: strongness[#####] speed[#####], use `ssh-keygen -t ed25519' to generate one", "\u001b[34m~ \u001b[0mECDSA : strongness[####.] speed[#####], use `ssh-keygen -t ecdsa -b 521' to generate one", "\u001b[34m~ \u001b[0mRSA : strongness[###..] speed[#....], use `ssh-keygen -t rsa -b 4096' to generate one", "\u001b[34m~ \u001b[0m", "\u001b[34m~ \u001b[0mIn any case, don't save it without a passphrase (your paste won't be echoed).", "", "\u001b[31;1m~ \u001b[0m", "\u001b[31;1m~ [!] Unknown error (Couldn't read the fingerprint of /tmp/HTSyoTS523 (Couldn't exec requested command (Insecure directory in $ENV{PATH} while running with -T switch at /usr/lib/x86_64-linux-gnu/perl-base/IPC/Open3.pm line 176.))), please report to your sysadmin.\u001b[0m", "\u001b[1;34m-------------------------------------------------------------</accountCreate>---", "\u001b[0m", "`-> [\u001b[31mERR.\u001b[0m] Couldn't create the healthcheck account", "", "*** Ensuring bastionsync and healthcheck are in bastion-nopam group", "usermod: user 'healthcheck' does not exist", "", "`-> [\u001b[31mERR.\u001b[0m] ", "", ``` likely from https://github.com/ovh/the-bastion/blob/master/lib/perl/OVH/Bastion/ssh.inc#L344 from ansible setup https://github.com/juju4/ansible_the_bastion/actions/runs/14423697204/job/40449434291#step:11:700 ``` "PATH": "/opt/hostedtoolcache/Python/3.13.2/x64/bin:/opt/hostedtoolcache/Python/3.13.2/x64:/snap/bin:/home/runner/.local/bin:/opt/pipx_bin:/home/runner/.cargo/bin:/home/runner/.config/composer/vendor/bin:/usr/local/.ghcup/bin:/home/runner/.dotnet/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin", ``` Here I was thinking to enforce PATH like done here https://github.com/ovh/the-bastion/blob/master/bin/proxy/osh-http-proxy-worker#L29 imho, no reason or nearly to have custom path for system account creation and can't clean github runner environment. I tried adding it in my ansible play but that didn't help * on github runner inside docker, at initial admin account creation https://github.com/juju4/ansible_the_bastion/actions/runs/14423697213/job/40449434297#step:7:368 ``` "cmd": "/opt/bastion/bin/admin/setup-first-admin-account.sh admin auto\n" [...] [!] Unknown error (Couldn't read the fingerprint of /tmp/2p_95IqsOL (Command exited with status 255)), please report to your sysadmin. ``` manual run in lxc container gives me a different error and with a paste of ssh pub key needed ``` ~ Creating group admin with GID 99998... ~ Creating user admin with UID 99998... useradd warning: admin's uid 99998 outside of the UID_MIN 1000 and UID_MAX 60000 range. useradd: warning: chown on `/home/admin' failed: Invalid argument ~ Creating tty group of account... ~ Adding account to potential supplementary groups... ~ Creating needed files and directories with proper permissions in home... ~ ~ [!] Couldn't chown ttyrec directory (Invalid argument) ``` Tested with v3.13.01 and v3.20.00