topic Re: SSH key generation multiple usernames in Operating System - OpenVMS

SSH key generation multiple usernames

Tom Wetty — Fri, 13 Jan 2017 18:41:57 GMT

Hi I am looking for a "how to" document for SSH and SFTP on OpenVMS. I tried the standard TCPIP documents but there appears to be some unique variables by UAF username that is not explained in any of the documentation.

I was able to generate a key using my personal account but when I used the generic testing account on the same server I received an error message from KEYGEN.

The error message that was generated was ; and I have been unsuccessfull in finding out what the message even means.

$ssh_keygen
sapdev$dkb0:[sys0.syscommon.][sysexe]tcpip$ssh_ssh-keygen2.exe: FATAL: ssh_user
file_open: using non-current uid but not initialized (uid=35848192, path=/dkb1/u
ser/wmspqa/ssh2/random_seed.)

Any pointers would be appreciated. Regards, Tom

OpenVMS V8.4 I have no idea how to see any ECO versions on the system.

HP TCP/IP Services for OpenVMS Industry Standard 64 Version V5.7 - ECO 3
on an HP rx2660 (1.59GHz/12.0MB) running OpenVMS V8.4

# File name: SSH2_CONFIG.
# Product: HP TCP/IP Services for OpenVMS
# Version: V5.7-ECO3
#
# © Copyright 1976, 2009 Hewlett-Packard Development Company, L.P.
#

#
# ssh 3.2 client configuration information
#

Re: SSH key generation multiple usernames

David R. Lennon — Fri, 13 Jan 2017 21:00:32 GMT

Hi,

Did you find this on your google searching?:

http://www3.sympatico.ca/n.rieck/docs/openvms_notes_ssh2.html

In the past, I've found that to be a great overview and reference.

Also, are you sure the directory file exists with proper protections for the user's SYS$LOGIN directory as defined in the SYSUAF? It seems to me like the error might be complaining abou creating the SSH2 subdirectory in: /dkb1/user/wmspqa/

Regards,

Dave

Re: SSH key generation multiple usernames

Steven Schweda — Fri, 13 Jan 2017 23:12:21 GMT

> $ssh_keygen
> sapdev$dkb0:[sys0.syscommon.][sysexe]tcpip$ssh_ssh-keygen2.exe: FATAL: ssh_user
> file_open: using non-current uid but not initialized (uid=35848192, path=/dkb1/u
> ser/wmspqa/ssh2/random_seed.)

I know nothing, but I'd guess that there's an owner/permissions
problem with the user's home directory itself an/or the "ssh2" sub-dir.
"FATAL: ssh_user file_open:" is suspicious. Whether that "uid=35848192"
means anything to anyone is another question. Perhaps in octal you'd
recognize something.

My Web search for:
"using non-current uid but not initialized"
found, among other things:

https://community.hpe.com/t5/x/x/td-p/4265638

If it's still not obvious, then you might post some useful info, like
who's who (UIC), who owns what (DIRE /SECU), and so on.

Re: SSH key generation multiple usernames

abrsvc — Sun, 15 Jan 2017 13:38:11 GMT

While my experiencewith SSH is limited, I agree with Steven, the problem here is one of Uic matching.

The account UIC must match the UIC of the directories and files. Otherwise there is a potential security hole which is what SSH is set up to avoid.

Verify that the owner of the directory and filesis the correct UIC of the account being used. Update this with more specifics if they are indeed the same. Post a log of your attempts including SHOW commands to view the account being used and the directory/file specifics.

Dan

Re: SSH key generation multiple usernames

black_cat — Fri, 20 Jan 2017 09:03:30 GMT

I just like to make you aware that if you're planning to use SSH and/or SFTP that you should be using Version V5.7-ECO5G (build date of the images: 26-NOV-2015) rather than Version: V5.7-ECO3. There was an update to the ciphers and the key exchange algorithm. Contact your friendly HP Support.