SSH problem

[Willem Grooters]

Dear friends,

On behalf of a collegue (who may now get to know this forum exists):

Environment is VMS 7.3-1, TCPIP 5.4
Installed SSH, no porblem doing ssh system@node

After this, the system has been rebooted several times, buiklt a cluster with a shared system disk, and on the second node, enabled SSH as well.

But now, it doesn't work anymore. He gets a message : Warning, Authentication failed. Using the -v option, there is more info, but that doesn't tell a story either.

Willem

[Martin P.J. Zinser]

Hello Willem,

in tcpip$ssh_home:[ssh2] ssh keeps a key for the local host. Is it possible there has been a mixup between the keys and he might need to generate a new key (ssh_keygen). I do not have my 5.4 system handy right now to verify this.

Greetings, Martin

[Willem Grooters]

Martin,

Keygen did indeed create a new key but still the messages keep appearing.
Also, as my collegue specified (I cannot confirm the correctness) : "stop/disable" and "enable/start" don't work either.

Is there more (configuration) info you need - ask what you need. Since he's on customer's premises, it may take a day to get it (and I'll miss the cake next Monday....)

[Bob Kortlandt]

Hi, As soon as Willem told me about this forum, I joined it.
Problem is reduced now to the following:
TCPIP$SSH account in installed with RESTICTED flag.
SSH connection is denied.
In the log there is some blabber about captive account not allowed to do something. When I remove the flag, it works fine.
Any ideas anyone?

[Jan van den Ende · Accepted solution]

Welkom in dit forum Bob !!!

May you bring us lots of wisdom, then we will try to be of some help to you :-)

Well, you already found out the circumstances that make the difference between functioning and non-functioning, so I guess most of the hard work has been done.

I think I smell some availability of a system you can play around with, and that's what you will need.

In SYS$SYLOGIN of your remote system, try and catch your oncoming process. (to avoid frustrating other logins, select for it and then: )
Switch on ANY tracing you got.
Set verify
Turn on accounting.
Look at accountng for any process(es?) in the time-interval of interest and their final status(ses)
Do you generate subprocesses if not captive?
(just a guess). If so, and you don't if captive, turn on bit 6 of SYSGEN SECURITY_POLICY.

If that's no help:
SET WATCH file/class= all (CMKRNL needed)
This will most probably tell you WHAT image causes failure, and after accessing WHAT file.
Turn on Image Accounting for that image
Any info? Post it, and we will take it from there.

fwiw,

jpe

[Bob Kortlandt]

Hi Jan, and others,

I managed to ban every user from the system,
and SET AUDIT/ALARM/ENABLE=ACCESS=ALL

and found out that the (non-default) sylogin.com dit not have W:RE.
After correcting this, everything works fine!

Jan, Thanks for the SET WATCH tip, which triggered me to do above.

Bob :-)