topic Re: Connection closed by IP in ssh under AIX TSM server in Operating System - HP-UX

Connection closed by IP in ssh under AIX TSM server

3r — Wed, 17 Jan 2018 09:06:49 GMT

Hi All,

Need help in logging in tsmacct user for client server (hpux 11.31) in AIX TSM server. What I'm trying to do is to log into hpux server in TSM server using tsmacct account created in hpux server but it is not working. But when I try to do a direct root log in TSM server going to my hpux client server it's working.

AIX server # uname -a
AIX bcv50s1c 3 5 0003B058D700

direct root log in from TSM server to HPUX client server:

bcv50s1c:/ # ssh fr70vhvmh002
Last successful login: Wed Jan 17 09:58:44 MET 2018 bcv50s1c.dc-m.alcatel-lucent.com
Last authentication failure: Wed Jan 3 14:07:05 MET 2018 frmrs081.dc-m.alcatel-lucent.com
Last login: Wed Jan 17 09:58:45 2018 from bcv50s1c.dc-m.alcatel-lucent.com
###########################################################################

Value of TERM has been set to "xterm".
WARNING: YOU ARE SUPERUSER !!

fr70vhvmh002#

tsmacct user log in from TSM server to HPUX client server:

# ssh tsmacct@fr70vhvmh002
Connection closed by 135.120.64.50

# ssh -vvv tsmacct@fr70vhvmh002
OpenSSH_4.1p1, OpenSSL 0.9.7d 17 Mar 2004
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Failed dlopen: /usr/krb5/lib/libkrb5.a(libkrb5.a.so): Could not load module /usr/krb5/lib/libkrb5.a(libkrb5.a.so).
System error: No such file or directory

debug1: Error loading Kerberos, disabling Kerberos auth.
debug2: ssh_connect: needpriv 0
debug1: Connecting to fr70vhvmh002 [135.120.64.50] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /.ssh/identity type -1
debug3: Not a RSA1 key file /.ssh/id_rsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /.ssh/id_rsa type 1
debug3: Not a RSA1 key file /.ssh/id_dsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /.ssh/id_dsa type 2
debug1: Remote protocol version 1.99, remote software version OpenSSH_7.3p1+sftpfilecontrol-v1.3-hpn14v11
debug1: match: OpenSSH_7.3p1+sftpfilecontrol-v1.3-hpn14v11 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_4.1
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
debug2: kex_parse_kexinit: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: kex_parse_kexinit: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: kex_parse_kexinit: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: kex_parse_kexinit: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_init: found hmac-sha1
debug1: kex: server->client aes128-ctr hmac-sha1 none
debug2: mac_init: found hmac-sha1
debug1: kex: client->server aes128-ctr hmac-sha1 none
debug2: dh_gen_key: priv key bits set: 163/320
debug2: bits set: 1014/2048
debug1: sending SSH2_MSG_KEXDH_INIT
debug1: expecting SSH2_MSG_KEXDH_REPLY
debug3: check_host_in_hostfile: filename /.ssh/known_hosts
debug3: check_host_in_hostfile: match line 4242
debug3: check_host_in_hostfile: filename /.ssh/known_hosts
debug3: check_host_in_hostfile: match line 4247
debug1: Host 'fr70vhvmh002' is known and matches the RSA host key.
debug1: Found key in /.ssh/known_hosts:4242
debug2: bits set: 1027/2048
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /.ssh/identity (0)
debug2: key: /.ssh/id_rsa (20055e18)
debug2: key: /.ssh/id_dsa (20055e38)
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug3: start over, passed a different list publickey,password,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /.ssh/identity
debug3: no such identity: /.ssh/identity
debug1: Offering public key: /.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 149
debug2: input_userauth_pk_ok: fp ce:da:48:4f:ac:7f:09:3b:a7:dd:29:52:be:5e:ce:90
debug3: sign_and_send_pubkey
debug1: read PEM private key done: type RSA
Connection closed by 135.120.64.50

Re: Connection closed by IP in ssh under AIX TSM server

Steven Schweda — Wed, 17 Jan 2018 14:38:16 GMT

> [...]
> debug1: read PEM private key done: type RSA
> Connection closed by 135.120.64.50

That looks abrupt. I'd want to look at the logs on the server side.

Re: Connection closed by IP in ssh under AIX TSM server

3r — Thu, 18 Jan 2018 09:05:04 GMT

Hi Steven,

Hope the below log files can help.

Below is the logs from hpux server:

# tail -f /var/adm/syslog/syslog.log
Jan 18 08:57:26 fr70vhvmh002 sshd[9243]: SSH: Server;Ltype: Authname;Remote: 139.54.50.28-52149;Name: tsmacct [preauth]
Jan 18 08:57:26 fr70vhvmh002 sshd[9243]: fatal: Access denied for user tsmacct by PAM account configuration [preauth]
Jan 18 09:16:44 fr70vhvmh002 sshd[10747]: SSH: Server;Ltype: Version;Remote: 139.54.50.28-53310;Protocol: 2.0;Client: OpenSSH_4.1
Jan 18 09:16:44 fr70vhvmh002 sshd[10747]: SSH: Server;Ltype: Kex;Remote: 139.54.50.28-53310;Enc: aes128-ctr;MAC: hmac-sha1;Comp: none [preauth]
Jan 18 09:16:44 fr70vhvmh002 sshd[10747]: SSH: Server;Ltype: Authname;Remote: 139.54.50.28-53310;Name: tsmacct [preauth]
Jan 18 09:16:44 fr70vhvmh002 sshd[10747]: fatal: Access denied for user tsmacct by PAM account configuration [preauth]
Jan 18 09:48:31 fr70vhvmh002 sshd[12914]: SSH: Server;Ltype: Version;Remote: 139.54.50.28-55119;Protocol: 2.0;Client: OpenSSH_4.1
Jan 18 09:48:31 fr70vhvmh002 sshd[12914]: SSH: Server;Ltype: Kex;Remote: 139.54.50.28-55119;Enc: aes128-ctr;MAC: hmac-sha1;Comp: none [preauth]
Jan 18 09:48:31 fr70vhvmh002 sshd[12914]: SSH: Server;Ltype: Authname;Remote: 139.54.50.28-55119;Name: tsmacct [preauth]
Jan 18 09:48:31 fr70vhvmh002 sshd[12914]: fatal: Access denied for user tsmacct by PAM account configuration [preauth]

below is the log from AIX server:

# tail -50 syslog
Jul 13 15:01:48 bcv50s1c mail:info sendmail[2601158]: p6DD1lYL4555004: to=operations.backup-tsm@hp.com, ctladdr=root (0/0), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=120198, relay=mailhost.alcatel-lucent.com [135.3.39.10], dsn=2.0.0, stat=Sent (p6DD1lNV010463 Message accepted for delivery)
Jul 13 15:01:55 bcv50s1c mail:info sendmail[7397596]: p6DD1twi7397596: from=root, size=202, class=0, nrcpts=1msgid=<201107131301.p6DD1twi7397596@bcv50s1c.dc-m.alcatel-lucent.com>, relay=root@localhost
Jul 13 15:01:56 bcv50s1c mail:info sendmail[1196204]: p6DD1twi7397596: to=operations.backup-tsm@hp.com, ctladdr=root (0/0), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=120202, relay=mailhost.alcatel-lucent.com [135.3.39.10], dsn=2.0.0, stat=Sent (p6DD1tS0010551 Message accepted for delivery)
Jul 13 15:02:21 bcv50s1c mail:info sendmail[1196222]: p6DD2LLM1196222: from=root, size=153487, class=0, nrcpts=1msgid=<201107131302.p6DD2LLM1196222@bcv50s1c.dc-m.alcatel-lucent.com>, relay=root@localhost
Jul 13 15:02:23 bcv50s1c mail:info sendmail[3379360]: p6DD2LLM1196222: to=operations.backup-tsm@hp.com, ctladdr=root (0/0), delay=00:00:02, xdelay=00:00:02, mailer=relay, pri=273487, relay=mailhost.alcatel-lucent.com [135.3.39.9], dsn=2.0.0, stat=Sent (p6DD2L9K016815 Message accepted for delivery)
Jul 13 15:02:27 bcv50s1c mail:info sendmail[561248]: p6DD2RQS561248: from=root, size=203372, class=0, nrcpts=1msgid=<201107131302.p6DD2RQS561248@bcv50s1c.dc-m.alcatel-lucent.com>, relay=root@localhost
Jul 13 15:02:29 bcv50s1c mail:info sendmail[7397610]: p6DD2RQS561248: to=operations.backup-tsm@hp.com, ctladdr=root (0/0), delay=00:00:02, xdelay=00:00:02, mailer=relay, pri=323372, relay=mailhost.alcatel-lucent.com [135.3.39.9], dsn=2.0.0, stat=Sent (p6DD2RWY016855 Message accepted for delivery)
Jul 13 15:02:39 bcv50s1c mail:info sendmail[2277590]: p6DD2dV72277590: from=root, size=198, class=0, nrcpts=1msgid=<201107131302.p6DD2dV72277590@bcv50s1c.dc-m.alcatel-lucent.com>, relay=root@localhost
Jul 13 15:02:40 bcv50s1c mail:info sendmail[3379364]: p6DD2dV72277590: to=operations.backup-tsm@hp.com, ctladdr=root (0/0), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=120198, relay=mailhost.alcatel-lucent.com [135.3.39.9], dsn=2.0.0, stat=Sent (p6DD2dvi016914 Message accepted for delivery)
Jul 13 15:02:52 bcv50s1c mail:info sendmail[6951032]: p6DD2qNI6951032: from=root, size=119775, class=0, nrcpts=1msgid=<201107131302.p6DD2qNI6951032@bcv50s1c.dc-m.alcatel-lucent.com>, relay=root@localhost
Jul 13 15:02:55 bcv50s1c mail:info sendmail[5455930]: p6DD2qNI6951032: to=operations.backup-tsm@hp.com, ctladdr=root (0/0), delay=00:00:03, xdelay=00:00:03, mailer=relay, pri=239775, relay=mailhost.alcatel-lucent.com [135.3.39.12], dsn=2.0.0, stat=Sent (p6DD2rbw013877 Message accepted for delivery)
Jul 13 15:02:56 bcv50s1c mail:info sendmail[1392826]: p6DD2uSQ1392826: from=root, size=25692, class=0, nrcpts=1msgid=<201107131302.p6DD2uSQ1392826@bcv50s1c.dc-m.alcatel-lucent.com>, relay=root@localhost
Jul 13 15:02:58 bcv50s1c mail:info sendmail[2080784]: p6DD2uSQ1392826: to=operations.backup-tsm@hp.com, ctladdr=root (0/0), delay=00:00:02, xdelay=00:00:02, mailer=relay, pri=145692, relay=mailhost.alcatel-lucent.com [135.3.39.12], dsn=2.0.0, stat=Sent (p6DD2v7D013926 Message accepted for delivery)
Jul 13 15:02:58 bcv50s1c mail:info sendmail[2351146]: p6DD2wje2351146: from=root, size=1995, class=0, nrcpts=1msgid=<201107131302.p6DD2wje2351146@bcv50s1c.dc-m.alcatel-lucent.com>, relay=root@localhost
Jul 13 15:02:59 bcv50s1c mail:info sendmail[7397614]: p6DD2wje2351146: to=operations.backup-tsm@hp.com, ctladdr=root (0/0), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=121995, relay=mailhost.alcatel-lucent.com [135.3.39.12], dsn=2.0.0, stat=Sent (p6DD2x99013942 Message accepted for delivery)
Jul 13 15:03:02 bcv50s1c mail:info sendmail[1855650]: p6DD32Xj1855650: from=root, size=11081, class=0, nrcpts=1msgid=<201107131303.p6DD32Xj1855650@bcv50s1c.dc-m.alcatel-lucent.com>, relay=root@localhost
Jul 13 15:03:03 bcv50s1c mail:info sendmail[471058]: p6DD32Xj1855650: to=operations.backup-tsm@hp.com, ctladdr=root (0/0), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=131081, relay=mailhost.alcatel-lucent.com [135.3.39.12], dsn=2.0.0, stat=Sent (p6DD32D5013957 Message accepted for delivery)
Jul 13 15:03:05 bcv50s1c mail:info sendmail[2277600]: p6DD35Uw2277600: from=root, size=198, class=0, nrcpts=1msgid=<201107131303.p6DD35Uw2277600@bcv50s1c.dc-m.alcatel-lucent.com>, relay=root@localhost
Jul 13 15:03:06 bcv50s1c mail:info sendmail[3379374]: p6DD35Uw2277600: to=operations.backup-tsm@hp.com, ctladdr=root (0/0), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=120198, relay=mailhost.alcatel-lucent.com [135.3.39.12], dsn=2.0.0, stat=Sent (p6DD35lg013978 Message accepted for delivery)
Jul 13 15:03:09 bcv50s1c mail:info sendmail[6951042]: p6DD396R6951042: from=root, size=492, class=0, nrcpts=1msgid=<201107131303.p6DD396R6951042@bcv50s1c.dc-m.alcatel-lucent.com>, relay=root@localhost
Jul 13 15:03:10 bcv50s1c mail:info sendmail[4554754]: p6DD3AFa4554754: from=root, size=201, class=0, nrcpts=1msgid=<201107131303.p6DD3AFa4554754@bcv50s1c.dc-m.alcatel-lucent.com>, relay=root@localhost
Jul 13 15:03:10 bcv50s1c mail:info sendmail[7397618]: p6DD396R6951042: to=operations.backup-tsm@hp.com, ctladdr=root (0/0), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=120492, relay=mailhost.alcatel-lucent.com [135.3.39.12], dsn=2.0.0, stat=Sent (p6DD3AiC014002 Message accepted for delivery)
Jul 13 15:03:11 bcv50s1c mail:info sendmail[3379378]: p6DD3AFa4554754: to=operations.backup-tsm@hp.com, ctladdr=root (0/0), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=120201, relay=mailhost.alcatel-lucent.com [135.3.39.12], dsn=2.0.0, stat=Sent (p6DD3Afa014004 Message accepted for delivery)
Jul 13 15:04:49 bcv50s1c user:notice root: .CASH_I_0799 JOBTERM record being written for job 'TSM30_FRMRS081_FS'
Jul 13 15:10:55 bcv50s1c user:notice root: .CASH_I_0799 JOBTERM record being written for job 'TSM20_BCV50S4A_AD_FS'
Jul 13 15:12:50 bcv50s1c mail:info sendmail[4624610]: p6DDCo384624610: from=root, size=337, class=0, nrcpts=1msgid=<201107131312.p6DDCo384624610@bcv50s1c.dc-m.alcatel-lucent.com>, relay=root@localhost
Jul 13 15:12:52 bcv50s1c mail:info sendmail[1253384]: p6DDCo384624610: to=operations.backup-tsm@hp.com, ctladdr=root (0/0), delay=00:00:02, xdelay=00:00:02, mailer=relay, pri=120337, relay=mailhost.alcatel-lucent.com [135.3.39.11], dsn=2.0.0, stat=Sent (p6DDCpTU021106 Message accepted for delivery)
Jul 13 15:19:30 bcv50s1c mail:info sendmail[2052162]: p6DDJUTX2052162: from=root, size=1685, class=0, nrcpts=1msgid=<201107131319.p6DDJUTX2052162@bcv50s1c.dc-m.alcatel-lucent.com>, relay=root@localhost
Jul 13 15:19:32 bcv50s1c mail:info sendmail[4440254]: p6DDJUTX2052162: to=operations.backup-tsm@hp.com, ctladdr=root (0/0), delay=00:00:02, xdelay=00:00:02, mailer=relay, pri=121685, relay=mailhost.alcatel-lucent.com [135.3.39.11], dsn=2.0.0, stat=Sent (p6DDJVbW026477 Message accepted for delivery)
Jul 13 15:30:07 bcv50s1c user:notice root: .CASH_I_0120 Submitting TSM7_CONSOSQL_FS TSM7_BE_SQL15_FS 0001 1301 at node bcv50s1c (from node FRVELSSCH09)
Jul 13 15:30:07 bcv50s1c user:notice root: .CASH_I_0120 Submitting TSM50_FRMRSSUDB007_FS TSM50_FRMRSSUDB007_FS 0001 1301 at node bcv50s1c (from node FRVELSSCH09)
Jul 13 15:30:07 bcv50s1c user:notice root: .CASH_I_0798 JOBINIT record being written for job 'TSM7_BE_SQL15_FS'
Jul 13 15:30:07 bcv50s1c user:notice root: .CASH_I_0120 Submitting TSM50_FRMRSSUDB006_FS TSM50_FRMRSSUDB006_FS 0001 1301 at node bcv50s1c (from node FRVELSSCH09)
Jul 13 15:30:07 bcv50s1c user:notice root: .CASH_I_0798 JOBINIT record being written for job 'TSM50_FRMRSSUDB007_FS'
Jul 13 15:30:07 bcv50s1c user:notice root: .CASH_I_0120 Submitting TSM71_FRMRSSPKI01P_WIN_FS TSM71_FRMRSSPKI01P_WIN_FS 0001 1301 at node bcv50s1c (from node FRVELSSCH09)
Jul 13 15:30:07 bcv50s1c user:notice root: .CASH_I_0798 JOBINIT record being written for job 'TSM50_FRMRSSUDB006_FS'
Jul 13 15:30:07 bcv50s1c user:notice root: .CASH_I_0120 Submitting TSM71_FRMRSSPKI02P_WIN_FS TSM71_FRMRSSPKI02P_WIN_FS 0001 1301 at node bcv50s1c (from node FRVELSSCH09)
Jul 13 15:30:07 bcv50s1c user:notice root: .CASH_I_0798 JOBINIT record being written for job 'TSM71_FRMRSSPKI01P_WIN_FS'
Jul 13 15:30:07 bcv50s1c user:notice root: .CASH_I_0120 Submitting TSM50_FRMRSSUUCM01_FS TSM50_FRMRSSUUCM01_FS 0001 1301 at node bcv50s1c (from node FRVELSSCH09)
Jul 13 15:30:07 bcv50s1c user:notice root: .CASH_I_0798 JOBINIT record being written for job 'TSM71_FRMRSSPKI02P_WIN_FS'
Jul 13 15:30:07 bcv50s1c user:notice root: .CASH_I_0798 JOBINIT record being written for job 'TSM50_FRMRSSUUCM01_FS'
Jul 13 15:30:07 bcv50s1c user:notice root: .CASH_I_0120 Submitting TSM50_FRMRSSUUCM02_FS TSM50_FRMRSSUUCM02_FS 0001 1301 at node bcv50s1c (from node FRVELSSCH09)
Jul 13 15:30:07 bcv50s1c user:notice root: .CASH_I_0120 Submitting TSM41_FRILLSWDD03_WIN_FS TSM41_FRILLSWDD03_WIN_FS 0001 1301 at node bcv50s1c (from node FRVELSSCH09)
Jul 13 15:30:07 bcv50s1c user:notice root: .CASH_I_0798 JOBINIT record being written for job 'TSM50_FRMRSSUUCM02_FS'
Jul 13 15:30:08 bcv50s1c user:notice root: .CASH_I_0120 Submitting TSM30_BCV50SE7_FS BCV50SE7_FS 0001 1301 at node bcv50s1c (from node FRVELSSCH09)
Jul 13 15:30:08 bcv50s1c user:notice root: .CASH_I_0798 JOBINIT record being written for job 'TSM41_FRILLSWDD03_WIN_FS'
Jul 13 15:30:09 bcv50s1c user:notice root: .CASH_I_0798 JOBINIT record being written for job 'BCV50SE7_FS'
Jul 13 15:30:23 bcv50s1c user:notice root: .CASH_I_0799 JOBTERM record being written for job 'TSM7_BE_SQL15_FS'
Jul 13 15:31:22 bcv50s1c syslog:err|error syslogd: Good Bye

Re: Connection closed by IP in ssh under AIX TSM server

Steven Schweda — Thu, 18 Jan 2018 14:59:50 GMT

> [...] I'd want to look at the logs on the server side.

   At some relevant times.

> below is the log from AIX server:
> [...]

   What do you see in that mess which looks related? The times seem far
from the client times you reported before. "Jul 13"? Different time
zone (or different solar system)?

> Jul 13 15:31:22 bcv50s1c syslog:err|error syslogd: Good Bye

   Perhaps you should find an AIX forum where you can ask where sshd
logs its events, because this does not seem to be it.

Re: Connection closed by IP in ssh under AIX TSM server

Dennis Handly — Sun, 21 Jan 2018 01:33:43 GMT

> I'd want to look at the logs on the server side.

I've had to do that when -vvv isn't forthcoming. I.e. my putty version was using older ciphers.

For Linux it's in /var/log/auth.log.

In this user's case, Isn't the server side HP-UX? I.e. it works with root but not with tsmacct user?

Jan 18 09:48:31 fr70vhvmh002 sshd[12914]: SSH: Server;Ltype: Version;Remote: 139.54.50.28-55119;Protocol: 2.0;Client: OpenSSH_4.1
Jan 18 09:48:31 fr70vhvmh002 sshd[12914]: SSH: Server;Ltype: Kex;Remote: 139.54.50.28-55119;Enc: aes128-ctr;MAC: hmac-sha1;Comp: none [preauth]
Jan 18 09:48:31 fr70vhvmh002 sshd[12914]: SSH: Server;Ltype: Authname;Remote: 139.54.50.28-55119;Name: tsmacct [preauth]
Jan 18 09:48:31 fr70vhvmh002 sshd[12914]: fatal: Access denied for user tsmacct by PAM account configuration [preauth]

Re: Connection closed by IP in ssh under AIX TSM server

3r — Wed, 24 Jan 2018 08:00:09 GMT

H iDennis,

Below is the logs from hpux server:

below is the log from AIX server:

Re: Connection closed by IP in ssh under AIX TSM server

Dennis Handly — Sat, 27 Jan 2018 16:56:47 GMT

> Below is the logs from hp-ux server:

Jan 18 09:48:31 fr70vhvmh002 sshd[12914]: fatal: Access denied for user tsmacct by PAM account configuration [preauth]

Yes, same as originally. Don't those errors tell you something?

Re: Connection closed by IP in ssh under AIX TSM server

3r — Wed, 31 Jan 2018 15:01:54 GMT

Hi Dennis,

The issue was resolved by correcting the user tsmacct in /etc/shadow