topic Re: Making progress, but OpenSSH still won't work. in Server Management - Systems Insight Manager

Making progress, but OpenSSH still won't work.

Jason Balinski — Fri, 29 Oct 2004 11:45:51 GMT

After heavily searching these forums I've gotten most of Insight Manager configured. I'm still having trouble with the initial psp deployment due to the Open SSH software.

I've done the 2003 workaround and I'm finally able to do an "mxagentconfig", but it only works if I use either "localhost" or 127.0.0.1 as the Hostname. If I use the external address, the hostname or the DNS name of the server it fails every time with "Failed to establish connection to [hostname]". I'm running this from the CMS.

From SIM, I no longer get the authentication errors, I now get:
EXCEPTION CLASS: com.hp.mx.dtf.sshClient.MxSshFailedConnectionException
EXCEPTION: Unable to contact the SSH server on node "host.domain.com".

Can someone please point me in the right direction? I'm growing extermely tired of this process - at this point there's no way I could duplicate the install on another box if I had to. (sorry for the venting...)

Maybe there's a security policy that's causing these problems for me? I'd greatly appreciate any help.

Re: Making progress, but OpenSSH still won't work.

Aravindh Rajaram — Sat, 30 Oct 2004 05:17:07 GMT

see attachment

Re: Making progress, but OpenSSH still won't work.

Scott_278 — Mon, 01 Nov 2004 09:08:00 GMT

AMicSys is right - install OpenSSH on the target machine. If you're using the local Administrator account and have renamed it, there are additional steps that need to be taken.

Re: Making progress, but OpenSSH still won't work.

Jason Balinski — Mon, 01 Nov 2004 09:35:51 GMT

I'm using an administrative account, but not the real administrative account as it's been renamed. I believe I have done the extra steps required to get the alternate admin account to work, using:

mkpasswd -l -u *admin* > c:\progra~1\openssh\etc\passwd

For now I'm trying to use the CMS as the target just to get SOMETHING working. From the console on the CMS when I use mxagentconfig, I can connect as long as I use 127.0.0.1 or localhost. When I use the CMS's external IP address or hostname, still from the CMS console, mxagentconfig fails.

I don't believe this is an ID/password issue, it's more like a security setting that's too tight not allowing me to go to the network redirector and back.

Thanks for the help so far and any more you can provide is greatly appreciated.

Re: Making progress, but OpenSSH still won't work.

Scott_278 — Mon, 01 Nov 2004 09:39:41 GMT

So your the account you used to install OpenSSH is *admin* ? If so, what's the path of the user's profile? Is it C:\Documents and Settings\Administrator? If so, edit the C:\Program Files\OpenSSH\etc\passwd file with Notepad. At the end of the line, you will see an etry like /home/admin. If the user's profile is C:\Documents and Settings\Administrator, edit the password entry to be /home/Administrator. Restart the OpenSSH service, and try mxagentconfig again.

Re: Making progress, but OpenSSH still won't work.

Jason Balinski — Mon, 01 Nov 2004 10:56:34 GMT

The *admin* login is not the default administrator account, it's a new account that I created and added to the administrator's group. I also added that account to the local security policies where the OpenSSH readme file says to for the 2003 workaround.

Let me just restate that I am able to successfully use mxagentconfig to login when i use the loopback address, but the real IP of the CMS does not work.

Re: Making progress, but OpenSSH still won't work.

Scott_278 — Mon, 01 Nov 2004 12:09:31 GMT

Re: Making progress, but OpenSSH still won't work.

Scott_278 — Mon, 01 Nov 2004 12:17:56 GMT

I meant if mxagentconfig is failing on a machine other than the CMS, then:

If this is the case, are you giving MXAGENTCONFIG the *administrator* or *admin* credentials? And what are the contents of the C:\program files\openssh\etc\passwd file?

Re: Making progress, but OpenSSH still won't work.

Jason Balinski — Mon, 01 Nov 2004 12:18:02 GMT

Let me get this straight...you're running mxagentconfig from the CMS, trying to connect to a target machine? Or is this all about using mxagentconfig to connect to the CMS using something other than the loopback?

If this is the case, are you giving MXAGENTCONFIG the *administrator* or *admin* credentials? And what are the contents of the C:\program files\openssh\etc\passwd file?

I am running mxagentconfig from the CMS trying to connect to the CMS. It works if I use the loopback, but not if I use the CMS IP address - both should point to the same place. Very wierd problem, like I said I think it might point to more of a security policy issue, but I don't even know where to start in that area.

I've added three id's to the passwd file using the command:

mkpasswd -l -u [id] > c:\progra~1\openssh\etc\passwd

I can login using all of them as long as I use that loopback address.

Re: Making progress, but OpenSSH still won't work.

Scott_278 — Mon, 01 Nov 2004 12:23:07 GMT

If it were me, I'd be inclined not to worry about it. Once you've made the connection, then you've got the certificates in place.

I've never bothered to look at which addresses I could connect to on the CMS, so I won't be of much help. If you have trouble connecting to other boxes, then I may be of assistance.

Re: Making progress, but OpenSSH still won't work.

Jason Balinski — Mon, 01 Nov 2004 12:29:26 GMT

Scott, Thanks for your help so far! Anyhow, the reason I'm worried about it is that I cannot run any tools from the web interface because the CMS cannot use OpenSSH to "shell out" to run the commands. I.E. I can't do an initial push of a support paq, nor can I even run a simple NetStat command.

The reason for all of this is that the CMS uses the DNS name which resolves to the external IP when it tries to connect to OpenSSH. If I could somehow make it use the 127.0.0.1 address then it would be a non-issue, although I doubt that would work anyway.

Re: Making progress, but OpenSSH still won't work.

Scott_278 — Mon, 01 Nov 2004 12:31:22 GMT

Someone else should confirm, but I don't think SIM allows you do update or run any of these tools against the CMS anyhow.

Re: Making progress, but OpenSSH still won't work.

Jason Balinski — Mon, 01 Nov 2004 12:45:26 GMT

I can't run the tools against any box though, because SIM can't talk to the OpenSSH service. I get this error:

EXCEPTION CLASS: com.hp.mx.dtf.sshClient.MxSshFailedConnectionException
EXCEPTION: Unable to contact the SSH server on node "host.domain.com".

Thanks...

Re: Making progress, but OpenSSH still won't work.

Scott_278 — Mon, 01 Nov 2004 12:53:07 GMT

So we're back to where we started. OK, forget about the CMS not connecting to the IP of the CMS. Let's focus on the target machine.

This is the deal...the C:\program files\openssh\etc\passwd file has an entry that points to the "home" directory of the user who installed OpenSSH. Let's assume that account was the local "administrator". The passwd file would have /home/administrator in it. The "/home" part equates to the base folder of that user's profile - in this case, C:\documents and Settings\Administrator.

So...what account did you install openssh with, what is the profile path for that user (type SET and look at the USERPROFILE variable), what are the contents of the passwd file?

Re: Making progress, but OpenSSH still won't work.

Jason Balinski — Mon, 01 Nov 2004 13:09:27 GMT

Here are the contents of that file:

boxster:unused_by_nt/2000/xp:1003:513:boxster,U-EITINFRA02\boxster,S-1-5-21-3935383152-2057740328-1672152018-1003:/home/boxster:/bin/switch
lightning:unused_by_nt/2000/xp:1008:513:lightning,U-EITINFRA02\lightning,S-1-5-21-3935383152-2057740328-1672152018-1008:/home/lightning:/bin/switch
corvette:unused_by_nt/2000/xp:1007:513:Service Account,U-EITINFRA02\corvette,S-1-5-21-3935383152-2057740328-1672152018-1007:/home/corvette:/bin/switch

I used a completely different account to install the software. However, I believe as part of the 2003 workaround I deleted the file that was originally placed here and recreated it with the mkpasswd command.

Re: Making progress, but OpenSSH still won't work.

Scott_278 — Mon, 01 Nov 2004 13:32:00 GMT

I should have stated this - is this the passwd file on the target server or the CMS? And what is the account you used to install SSH on the target server?

Re: Making progress, but OpenSSH still won't work.

Jason Balinski — Mon, 01 Nov 2004 13:49:09 GMT

The ID I logged in with to install this software was a domain ID, it shows up nowhere in the passwd file.

I haven't even gotten to any target servers yet. My problem is that I cannot connect to that service on the CMS. Because I can't connect to it on the CMS, I cannot do an initial push of a support pack to any other boxes.

Re: Making progress, but OpenSSH still won't work.

Scott_278 — Mon, 01 Nov 2004 14:12:18 GMT

I'm sorry, but you keep losing me. Hopefully someone else can help you.

Re: Making progress, but OpenSSH still won't work.

Scott_278 — Thu, 11 Nov 2004 11:29:01 GMT

Jason - are you will watching this thread?

Re: Making progress, but OpenSSH still won't work.

Jason Balinski — Thu, 11 Nov 2004 12:56:46 GMT

Yes, but I've moved the CMS to another machine. After the new install, I'm running more smoothly. I'm not having the network name vs. IP issue anymore. I am still having issues, but I can make an SSH connection to the server now. MXagentconfig also works fine. I've checked the passwd file and the correct path is there, and I have the .ssh folder under the user it's running as. My only remaining issue is that SIM itself still won't run anything from the command line.