topic Re: any incompatibility issues with HP-Secure Shell? in Operating System - HP-UX

any incompatibility issues with HP-Secure Shell?

Nivesh Patnaik — Fri, 10 Sep 2004 13:24:49 GMT

I am unable to connect to HP's secure shell daemon using a client from another vendor such as F-Secure.
Has anyone else encountered such an issue?
I can connect from one system using HP's ssh client to another system with the same product.
Is there something that needs to go in sshd_config to enable compatibility?

Here is some debug info:
debug1: Server will not fork when running in debugging mode.
Connection from A.B.C.D port 1075
debug1: Client protocol version 1.99; client software version 3.1.0 F-SECURE SSH
debug1: no match: 3.1.0 F-SECURE SSH
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.7.1p2-pwexp26
debug1: permanently_set_uid: 106/101
debug1: list_hostkey_types: ssh-rsa,ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: client->server aes128-cbc hmac-sha1 none
debug1: kex: server->client aes128-cbc hmac-sha1 none
debug1: expecting SSH2_MSG_KEXDH_INIT
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
debug1: userauth-request for user joe service ssh-connection method none
debug1: attempt 0 failures 0
debug1: allowed_user: entering
debug1: PAM: initializing for "joe"

Re: any incompatibility issues with HP-Secure Shell?

Sridhar Bhaskarla — Fri, 10 Sep 2004 13:32:57 GMT

Hi Nirvesh,

Can you send client's debug portion. I don't see any issues so far. Though the version didn't match, it did pass that section as the protocol versions are compatible.

ssh -vvv hp-server

-Sri

Re: any incompatibility issues with HP-Secure Shell?

RAC_1 — Fri, 10 Sep 2004 13:37:17 GMT

sshd -ddd
would be better to investigate the problem.

Also is UsePAM set to yes in sshd_config file?? What version of HP SSH are you running??

Anil

Re: any incompatibility issues with HP-Secure Shell?

Nivesh Patnaik — Fri, 10 Sep 2004 14:09:37 GMT

The server is running
Secure_Shell A.03.71.000 HP-UX Secure Shell

There are two HP-UX 10.20 clients that I am trying to connect from.

The first has F-Secure SSH3.1. I tried:
ssh2 -v -d99 -l joe hpserver

On the client side I see this and it just sits there for about 3 minutes:
debug: SshAppCommon/sshappcommon.c:133: Allocating global SshRegex context.
joe's password:
joe's password:
joe's password:

It doesn't validate on the password and exits.

On the server, the setting was UsePam yes.

When I change that to UsePam no, the difference that I notice is that, when attempting the cleint connection, I instantly get asked for the password. However, it doesn't validate on the password.

The user account and password are not an issue as I can connect from another HP system that has A.03.71 on it, to this hpserver.

The other client I use has OpenSSH_3.5p1.
I am able to connect with this.

Re: any incompatibility issues with HP-Secure Shell?

Nivesh Patnaik — Fri, 10 Sep 2004 14:22:21 GMT

Another fact:

I can connect from the F-Secure 3.1 client to a server running OpenSSH 3.5p1.

Re: any incompatibility issues with HP-Secure Shell?

Sridhar Bhaskarla — Fri, 10 Sep 2004 14:27:36 GMT

Hi Nivesh,

Do you see any errors|messages in syslog.log when the user password is not being accepted such as "illegal user" etc.?

-Sri

Re: any incompatibility issues with HP-Secure Shell?

Nivesh Patnaik — Fri, 10 Sep 2004 14:33:03 GMT

Only this:

Sep 10 14:01:06 hpserver sshd[26123]: Failed password for joe from A.B.C.D port 1074 ssh2

And it is from the times when I'm trying the password three times to no avail.

Re: any incompatibility issues with HP-Secure Shell?

Sridhar Bhaskarla — Fri, 10 Sep 2004 14:38:30 GMT

Well, can you attach the complete outputs of 'sshd -ddd' and 'ssh -vvv' ?. We have only half the information.

-Sri

Re: any incompatibility issues with HP-Secure Shell?

Nivesh Patnaik — Fri, 10 Sep 2004 14:46:34 GMT

Sorry, just had to sensor the output.
The result from sshd -d -d -d is attached.

I really don't get anything on the F-Secure client side other than what I have already posted with the -d 99 option. I'll see if I can get any more client side debug, but in the mean time...

Re: any incompatibility issues with HP-Secure Shell?

Steven E. Protter — Fri, 10 Sep 2004 14:48:17 GMT

I have seen no issues in a mixed Linux HP-UX shop. The Linux is a PITA to upgrade so I don't bother. HP-UX is at 3.8 version.

Thats worth going to on the HP-UX side.

http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA

My setup is currently mixed in the HP-UX side as i roll an upgrade through the server farm. I've run into no issues thus far.

SEP

Re: any incompatibility issues with HP-Secure Shell?

Nivesh Patnaik — Fri, 10 Sep 2004 14:52:29 GMT

I'll try the upgrade and see if it makes a difference.

Re: any incompatibility issues with HP-Secure Shell?

Sridhar Bhaskarla — Fri, 10 Sep 2004 14:52:40 GMT

From the -ddd output, obviously the password is not getting recognized. I wonder if F-secure is sending some garbage along with the password. It's tough to identify as the communication is encrypted. Try using few other clients to connect to HP system like putty and see if they work. If so, then the problem would be with F-secure.

-Sri

Re: any incompatibility issues with HP-Secure Shell?

Nivesh Patnaik — Fri, 10 Sep 2004 14:56:42 GMT

I just used Cygwin's SSH client (OpenSSH_3.9p1) and was able to connect to the HP Secure Shell daemon.

You may have a point about F-Secure being the oddball.

Re: any incompatibility issues with HP-Secure Shell?

Geoff Wild — Fri, 10 Sep 2004 15:39:22 GMT

Yes - same issue - yhogh havn't tested with 3.81 HP Secure Shell yet.

Rgds...Geoff

Re: any incompatibility issues with HP-Secure Shell?

Nivesh Patnaik — Fri, 10 Sep 2004 17:01:01 GMT

I just upgraded to Secure_Shell A.03.81.002 and tried connecting with the F-Secure client.

It works! Will post another message if I find anything else on Monday.

Re: any incompatibility issues with HP-Secure Shell?

Darrell Tschakert — Tue, 05 Oct 2004 13:52:15 GMT

Just loaded Secure ShellA.03.81.002 on a 11.00 HP-UX and can access the sshd with SecureCRT client, Cygwin ssh, and SSH Tectia Client.

However, we do have a problem with all of these clients once I get logged in. The stty intr character does not work. Does not work whether I set it to ^C, DEL, or ^A. The intrupt character works fine when I ssh into a linux sshd, but they will not work with the HP-UX sshd.

Darrell Tschakert