SSHD Failing on OpenVMS 8.2

[Jon Bartelson]

I'm running HP TCPIP V5.5-11 on OpenVMS 8.2; trying to get the SSH server running. The service starts, but when someone connects to it, the connection hangs, then drops. The error reported in the log is:

WARNING: sys$creprc() failed with status 10804

Has anyone seen this error and/or know of how to repair it?

Thanks!
/Jon

[David Jones_21]

VMS code 10804 is the "EXPRCLM, exceeded process limit" condition. Check the maxdetach quota in the UAF for user TCPIP$SSH (or whatever user the SSH server is using).

[Jon Bartelson]

David,

Thanks for the quick response. The maxdetach value for the TCPIP$SSH user is 0, so this user should be able to create an unlimited number of detached processes. However, the SSH server is still failing with the same error. Any other ideas?

Thanks so much!
/Jon

[Veli Körkkö]

Whilst

$ exit 10804
%SYSTEM-F-EXPRCLM, exceeded process limit

could it possible be

$ exit %x10804
%RMS-F-ACCONFLICT, file access conflict


I.e. are the status codes reported in logfile
decimal or as much more usual, hexadecimal?

IF latter case, do

$ set audit/alarm/enable=file=fail=all
$ set audit/audit/enable=file=fail=all
$ set process/privilege=all
$ reply/enable

and retry the ssh conn and maybe you will be told with which file there is access conflict

_veli

[Volker Halle · Accepted solution]

Veli,

no, the system service failure code is printed in decimal - as the following command will easily tell ;-)

$ search sys$system:tcpip$ssh_sshd2.exe sys$creprc

Jon,

Port 22 (SSH) is owned by TCPIP$INETACP, which seems to create a TCPIP$SS_BGxxxx network process (running as user TCPIP$SSH !) for a SSH connect, running
TCPIP$SSH_RUN.COM and image TCPIP$SSH_SSHD2.EXE - this process writes the TCPIP$SSH_RUN.LOG file and also seems to write the 'sys$creprc() failed with status' error message, most likely when it's trying to create the detached interactive user process AFTER successful authentication.

You could audit $CREPRC calls with:

$ SET AUDIT/ALARM/ENA=PROCESS=CREPRC

SS$_EXPRCLM is only declared from the $CREPRC system service, if MAXACCTJOBS or MAXDETACH are exceeded (UAF attributes of the USER for the NEW process, i.e. your interactive user session).

- in which logfile did you find the EXPRCLM error message ?
- did you get a Authentication successful. message on the node from which you initiated the SSH login ?

Volker.

[Veli Körkkö]

volker,

I stand corrected, thanks. Anyway, I tested this thing modifying my own account to MAXACCTJOBS=4, MAXDETACH=2 and in addition to my initial TELNET session, it allowed three subseqeuent SSH sessions.

Though I do not get the error in SSH log file but rather get VMS audits

%%%%%%%%%%% OPCOM 7-AUG-2005 21:56:01.33 %%%%%%%%%%%
Message from user AUDIT$SERVER on VELI
Security alarm (SECURITY) and security audit (SECURITY) on VELI, system id: 5166
Auditable event: Detached process login failure
Event time: 7-AUG-2005 21:56:01.33
PID: 20201ED5
Process name: _FTA46:
Username: KORKKO
Process owner: [IS,KORKKO]
Terminal name: FTA46:
Image name: DSA100:[SYS0.SYSCOMMON.][SYSEXE]LOGINOUT.EXE
Posix UID: -2
Posix GID: -2 (%XFFFFFFFE)
Status: %LOGIN-F-ACNTEXC, you are at maximum allowed processee

so maybe I am not hitting the same issue here because messages are different and sort of expected.

_veli

[Jon Bartelson]

Volker,

That did the trick. I adjusted MAXACCTJOBS upwards a bit, and SSH is now functional. Thanks to everyone for your responses!

Best,
/Jon

[Jon Bartelson]

My problem is solved, so I'm closing this thread. Thanks again to everyone!

Best,
/Jon

[David Jones_21]

I'd check your other TCPIP service accounts and make sure their not subject to breakage due the same issue. On my system, the accounts were all created with 0 maxacctjobs.