topic Re: Still getting "Authentication Failed" in Server Management - Systems Insight Manager

Still getting "Authentication Failed"

Daniel_262 — Mon, 04 Oct 2004 14:43:59 GMT

On a new installation, I'm having difficulty running the initial Support Pack Install.

Right now I'm working with only the Insight Manager server and another server with agents loaded. I am set up to "trust all" until I get things running, then I'll tighten up security and deploy to the rest of my servers.

When I run my job, I fails with "EXCEPTION CLASS: com.hp.mx.exceptions.MxFailedAuthenticationException
EXCEPTION: Authentication failed."

The trust exists between the servers.

I read through the SSH white paper and feel I have followed that pretty closely. From the SSH command prompt on the Insight manager server I can log into the managed server.

However, when I do log into the managed server from the SSH command prompt, I getting a "cannot CHDIR to home directory" message.

I'm surprised to see the chdir happening.

1.)Who is making the CHDIR happen?
2.)What do I need to do to make this work correctly?
3.)Is this the reason for the deployment job failure?

DWM

Re: Still getting "Authentication Failed"

Daniel_262 — Mon, 04 Oct 2004 14:58:08 GMT

...we're talking about Windows boxes here, by the way...

Re: Still getting "Authentication Failed"

Rob Buxton — Mon, 04 Oct 2004 22:02:32 GMT

I'm no expert on SSH, but I think there's a login path, it seems as though that is incorrect.
I've a feeling you can see the path in one of the files stored in the SSH directory structure on the HPSIM Server.

Perhaps it's trying to access a device that is not mapped on that Server.

Re: Still getting "Authentication Failed"

Christian Mentschik — Tue, 05 Oct 2004 01:10:58 GMT

hi,
i think it works only with trust by certificate. after installing this trust it works (on my servers without SSH).
maybe you try it.

hope it helps

christian

Re: Still getting "Authentication Failed"

Daniel_262 — Tue, 05 Oct 2004 13:17:19 GMT

Documentation has lead me to believe that an SSH server must be running the Insight Manager server as well as each target system (see the "SSH Whitepaper", last paragraph of page 3).

Have I misunderstood what that means? Is the SSH server required?

Regardless of if "trusting all" or "trusting by certificate", after what I think is proper setup, I get the same message when running the deployment job: "EXCEPTION CLASS: com.hp.mx.exceptions.MxFailedAuthenticationException
EXCEPTION: Authentication failed."

Any help you can offer is appreciated.

Re: Still getting "Authentication Failed"

Christian Mentschik — Wed, 06 Oct 2004 00:47:59 GMT

sorry, the SIM-server is running SSH. the managed server are without SSH.

christian

Re: Still getting "Authentication Failed"

Scott_278 — Wed, 06 Oct 2004 07:52:02 GMT

I'm laughing because I spent two weeks on this problem, and I think I've run into every possible issue one can run into with this SSH thing (on Windows at least).

Couple of questions:
1) Windows 2000 or 2003
2) Have you renamed the local administrator account?

Re: Still getting "Authentication Failed"

Daniel_262 — Wed, 06 Oct 2004 08:26:27 GMT

It is almost silly, isn't it. It sure seemed simple enough when I started. I thought dropping back to no security at all would allow me to at least get it working and then figured I could tighten it up from that point.

The Insight manager server is 2003.

I typically do not rename the "Administrator" account on my servers.

The first server I'm concentrating on with getting agents and monitoring working is 2000 and the "administrator" account is not available on this particular box.

The rest of my servers are a mix of 2000 and 2003.

If you can offer any hints, I would sincerely appreciate it!

DWM

Re: Still getting "Authentication Failed"

Daniel_262 — Wed, 06 Oct 2004 08:28:26 GMT

...one more thing. I'm pretty sure the version I am installing is 4.0.

Should I go to 4.1? Is there much difference?

DWM

Re: Still getting "Authentication Failed"

Scott_278 — Wed, 06 Oct 2004 09:15:37 GMT

I'm not experienced enough with the whole SIM product to tell you the differences between the two. So I can't really address that aspect, other than to say I'm working with 4.1

OK, so the SIM box is W2K3. Is the SSH service running under the credentials of the local adminstrator account?

On the managed server...there is a file called "passwd" in the /etc directory. Open it with notepad and look toward the end of the string - there should be an entry like /home/administrator. This path has to match the profile path of the user account which installed openssh. So for example let's say my local administrative account was named "NEWADMIN", but the profile directory for this account was C:\Documents and Settings\Administrator. OpenSSH would fail, because when it was installed, the passwd file assumes the "home directory" path was /home/newadmin. But there is no C:\documents and settings\newadmin path. So you have to edit the passwd file to match the profile path of the account used to install openssh, then restart the OpenSSH service. On ALL W2K3 boxes, the OpenSSH service must run under the credentials of an account that has administrative rights on the server as documented in the HPSIM README.

Let me know what happens, or how your config differs.

Re: Still getting "Authentication Failed"

Daniel_262 — Wed, 06 Oct 2004 15:53:21 GMT

I appreciate your help.

The Userid I utilize to admin the 23k box has local admin rights and is the ID I used to install openssh.

The "home" path specified in the passwd file is /home/"username". I think it is seeing that OK. Is there a way for me to test?

On the managed server the "home" path specified in the passwd file appears to be correct as a home file is specified on the profile for this user and the paths match. It's a UNC path to a user folder on another server. I don't necessarily feel confident this is being seen properly.

Please help me understand how these paths should be properly specified. And how I can test it.

When I attempt to log into the managed server from the Insight Manager server from an SSH command prompt, I see a message about a missing key. maybe I'm close than I think.

I tried mxagentconfig. It just sits there forever. I have to kill the process.

DWM

Re: Still getting "Authentication Failed"

Scott_278 — Wed, 06 Oct 2004 16:04:35 GMT

You didn't confirm that the OpenSSH Server Service on the SIM server is running as something other than the Local System account. That is the first thing to check - it has to be running under the credentials of an actual user account - local or domain. This process is described in the SIM README.

Assuming you have that configured properly, the next thing to check is that the passwd file matches the profile path for the user account. So if the user is MYADMIN1, and the profile path is C:\Documents and Settings\MYADMIN1, then the passwd file should have /home/MYADMIN1. Once you have this configured properly, restart the "OpenSSH Server Service" service.

Where I had a problem was the profile path for MYADMIN1 was C:\Documents and Settings\Administrator. But the path in the passwd file was /home/MYADMIN1.

Anyway, do this same configuration check on both servers - the SIM and the managed server. Next, ssh from a command line both ways: from SIM to managed, then managed to SIM. Once you make a successful connection, you should se a .ssh/ folder in the root of the user's profile directory with a file named "known_hosts". That tells you that the SSH is communcating properly. Again, you should do this both ways - SIM to managed, then managed to SIM.

So, these are the things to check:
1) Make sure the "OpenSSH Server Service" service on your Windows 2003 server is running under valid user credentials and not LOCAL SYSTEM.
2) Make sure the passwd home directory entry matches the actual user's profile directory name.
3) Restart the OpenSSH Server Service so it re-reads the passwd file.
4) Do a two-way SSH from a command-line.
5) Try running mxagentconfig.

Re: Still getting "Authentication Failed"

Scott_278 — Thu, 07 Oct 2004 07:45:53 GMT

I just re-read your last response, and noticed you said on the managed machine, that the profile resides on another server. What you are referring to is that the user has a roaming profile. However, when that user logs into the server, a locally cached copy of the profile is created. The locally cached profile is the path that the passwd file needs - not the roaming profile path. Change the passwd file to point at the locally cached profile path i.e. C:\Documents and Settings\, then restart the SSH service.

Re: Still getting "Authentication Failed"

Daniel_262 — Wed, 13 Oct 2004 15:48:09 GMT

I'm still chopping away at this issue but had to step back from it for a few days.

Your recent post mentioned an item from the SIM Readme, which I somehow missed.

The OpenSSH service is/was logging in on the Local System Account. When I change it to another account, Local or Domain, the service won't start.

A message appears saying (basically) that the service started then stopped, this may be normal.

Suggestions?

DWM

Re: Still getting "Authentication Failed"

Scott_278 — Wed, 13 Oct 2004 15:50:23 GMT

OK good, we're getting somewhere. What you now have to do is delete the files in C:\Program Files\OpenSSH\var\log. Then try to restart the service. If it starts, then try to run mxagentconfig from the SIM server.

Re: Still getting "Authentication Failed"

Daniel_262 — Thu, 14 Oct 2004 08:25:20 GMT

Things appear to be looking better!

I'm not certain if this is true or my imagination but after deleting the log file I was able to sucessfully reset the "log in as" ID.

The service now starts properly with the domain ID and password.

When I attempt to log into the managed server from the Insight Manager server from an SSH command prompt I am seeing login prompt and messages regarding authentication. I also see the message "Failed to add the host to the list of known hosts".

I take this to mean that I still don't have the path entered correctly in the passwd file.

Re: Still getting "Authentication Failed"

Scott_278 — Thu, 14 Oct 2004 09:02:47 GMT

Beauty - ok we need to go back to this passwd file. I didn't realize you were using a domain account. Let's say the domain account you installed SSH as is \henry. The first thing you have to do is make sure Henry has actually logged in at the console of the managed server. This is because a locally-cached profile has to exist. Assuming you have done that, you should have this folder structure: "C:\Documents and Settings\Henry". The passwd file should point at the locally cached profile - in this case it would be /home/Henry. the "/home" part really equates to "C:\Documents and Settings". In fact if you look at the registry key HKLM\Software\Cygnus Solutions\Cygwin\mounts v2\/home, you'll see that /home explicitly stands for C:\Documents and Settings.

Once the passwd file has been edited, restart the OpenSSH service (may not actually be required, but just in case...) and then run MXAGENTCONFIG.

Re: Still getting "Authentication Failed"

Daniel_262 — Thu, 14 Oct 2004 11:28:59 GMT

I know I'm making progress...I'm just so confused. I'm loosing track of what makes an impact and what doesn't.

I rebooted the Insight Manager server and things started to click a bit more.

I can see that the Openssh service (I guess) created the .ssh folder and the known_hosts file in the /home/ folder of the administrative user on the Insight Manager Server. The date/time stamp is today.

When I ssh command line to the managed server, I'm promopted to login, that's ok. I get "Could not chdir to home directory /home/BackUpdude: No such file or directory"

The managed server is running and logged in as the user I have specified. I verfied that the home folder exists and is accessible. The user I am logging in as is a domain ID with administrative rights. In AD users and computers, the home folder is specified as "\\server1\Users\is\BackUpdude"

Re: Still getting "Authentication Failed"

Scott_278 — Thu, 14 Oct 2004 11:39:48 GMT

From what you state, it seems the SIM server is OK. The problem is with the managed server. Is the managed server W2K or W2K3?

Just FYI, the .ssh folder is created when you first run the SSH command from the command-line, not when the service is started.

I'll assume the user ID you're using on the managed server is BackupDude. Tell me these things:
1) Is there a C:\Documents and Settings\BackupDude folder on the managed server?
2) Paste the contents of the passwd file on the managed server, or at least the part of the line which includes the "/home" string.

What I am afraid of is that you are thinking of the term "home directory" in a literal sense - that is wrong. The passwd file wants the path to the locally-cached profile of BackupDude - not the actual home directory. The passwd file should contain the line /home/BackupDude.

If this doesn't work, we should probably delete the passwd file on the managed system and re-create it using this command: mkpasswd -l -u BackupDude << "C:\Program Files\OpenSSH\etc\passwd"

Re: Still getting "Authentication Failed"

Daniel_262 — Fri, 15 Oct 2004 07:33:13 GMT

The managed server is W2k.

There is a c:\documents and settings\backupdude folder on the managed server. NTUSER.DAT exists in this folder and time stamp is current.

The passwd file on the managed server appears as so:

BackUpdude:unused_by_nt/2000/xp:1374:513:BackUpdude,U-HHS-INC\BackUpdude,S-1-5-21-299502267-220523388-1801674531-1374:/home/BackUpdude:/bin/switch
BackUpdude:unused_by_nt/2000/xp:11374:10513:BackUpdude,U-HHS-INC\BackUpdude,S-1-5-21-299502267-220523388-1801674531-1374:/home/BackUpdude:/bin/switch