topic SSH problem in Operating System - OpenVMS

SSH problem

Willem Grooters — Thu, 01 Apr 2004 15:29:18 GMT

Dear friends,

On behalf of a collegue (who may now get to know this forum exists):

Environment is VMS 7.3-1, TCPIP 5.4
Installed SSH, no porblem doing ssh system@node

After this, the system has been rebooted several times, buiklt a cluster with a shared system disk, and on the second node, enabled SSH as well.

But now, it doesn't work anymore. He gets a message : Warning, Authentication failed. Using the -v option, there is more info, but that doesn't tell a story either.

Willem

Re: SSH problem

Martin P.J. Zinser — Thu, 01 Apr 2004 16:23:55 GMT

Hello Willem,

in tcpip$ssh_home:[ssh2] ssh keeps a key for the local host. Is it possible there has been a mixup between the keys and he might need to generate a new key (ssh_keygen). I do not have my 5.4 system handy right now to verify this.

Greetings, Martin

Re: SSH problem

Willem Grooters — Fri, 02 Apr 2004 04:09:50 GMT

Martin,

Keygen did indeed create a new key but still the messages keep appearing.
Also, as my collegue specified (I cannot confirm the correctness) : "stop/disable" and "enable/start" don't work either.

Is there more (configuration) info you need - ask what you need. Since he's on customer's premises, it may take a day to get it (and I'll miss the cake next Monday....)

Re: SSH problem

Bob Kortlandt — Fri, 16 Apr 2004 02:40:17 GMT

Hi, As soon as Willem told me about this forum, I joined it.
Problem is reduced now to the following:
TCPIP$SSH account in installed with RESTICTED flag.
SSH connection is denied.
In the log there is some blabber about captive account not allowed to do something. When I remove the flag, it works fine.
Any ideas anyone?

Re: SSH problem

Jan van den Ende — Fri, 16 Apr 2004 05:14:58 GMT

Welkom in dit forum Bob !!!

May you bring us lots of wisdom, then we will try to be of some help to you :-)

Well, you already found out the circumstances that make the difference between functioning and non-functioning, so I guess most of the hard work has been done.

I think I smell some availability of a system you can play around with, and that's what you will need.

In SYS$SYLOGIN of your remote system, try and catch your oncoming process. (to avoid frustrating other logins, select for it and then: )
Switch on ANY tracing you got.
Set verify
Turn on accounting.
Look at accountng for any process(es?) in the time-interval of interest and their final status(ses)
Do you generate subprocesses if not captive?
(just a guess). If so, and you don't if captive, turn on bit 6 of SYSGEN SECURITY_POLICY.

If that's no help:
SET WATCH file/class= all (CMKRNL needed)
This will most probably tell you WHAT image causes failure, and after accessing WHAT file.
Turn on Image Accounting for that image
Any info? Post it, and we will take it from there.

fwiw,

jpe

Re: SSH problem

Bob Kortlandt — Fri, 16 Apr 2004 08:00:57 GMT

Hi Jan, and others,

I managed to ban every user from the system,
and SET AUDIT/ALARM/ENABLE=ACCESS=ALL

and found out that the (non-default) sylogin.com dit not have W:RE.
After correcting this, everything works fine!

Jan, Thanks for the SET WATCH tip, which triggered me to do above.

Bob :-)