sftp fails for non-root user, ssh is OK

[Alan Solomon]

I have 2 HP-UX boxes loaded from the same DVD set a year ago, using HP-UX Secure Shell out-of-the-box config. These are servers & have only one user (non-root) account each, same username & same lines in /etc/passwd for each. I just noticed that this user can ssh between boxes & authenticate OK (not sharing keys) but sftp only works from box A to box B, not from box B to box A. Box A syslog.log reports this upon failure:

May 28 17:15:38 box-A sshd[5594]: error: PAM: Authentication failed for wcadmin from box-B

root can sftp either direction OK.
From my PC I cannot use sftp to get into box A as this ordinary user either.

I don't really use PAM, but each box sshd_config has "UsePAM yes". I set that to "no" and the error message went away but sftp still exits right away after the password is entered. Both systems' sshd_conf are otherwise identical. Both have "Subsystem sftp /opt/ssh/libexec/sftp-server".

sftp -v box-A gives this, in part, which does not seem to help:

... ...
debug1: Next authentication method: keyboard-interactive
Password:
debug1: Authentication succeeded (keyboard-interactive).
debug1: Final hpn_buffer_size = 131072
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
debug1: Sending subsystem: sftp
debug1: client_input_channel_req: channel 0 rtype exit-signal reply 0
debug1: channel 0: free: client-session, nchannels 1
debug1: fd 0 clearing O_NONBLOCK
debug1: fd 1 clearing O_NONBLOCK
debug1: Transferred: stdin 0, stdout 0, stderr 0 bytes in 0.0 seconds
debug1: Bytes per second: stdin 0.0, stdout 0.0, stderr 0.0
debug1: Exit status -1
Connection closed

Home directory permissions etc look OK. I'm at wits end on this one!

[johnsonpk]

Hi Alan,

Are you finding any differences on the values for below variables in the sshd_config

EnforceSecureTTY and PermitRootLogin ,

It seems the values for the above varible influence ssh sftp & scp diffently.. if possible paste the values from both server


BTW are you able to do scp ??

i hope the below link through some light :-)

http://docs.hp.com/en/5992-4213/ch04s07.html



Thanks!!
Johnson

[Alan Solomon]

As mentioned above both boxes sshd_config are identical & as out-of-the box from the system load. Specifically,

#EnforceSecureTTY no
and
#PermitRootLogin yes

Trying scp lead me to see that there was a difference in the .cshrc files on the 2 boxes. The problem box user's .cshrc had:

if ( $?prompt ) then
...

...
endif

but there must have been some extraneous characters somewhere in the if / then / endif lines, because my first try at scp into the problem box returned:

then: then/endif not found.

I removed & retyped those lines and all is OK now! scp runs with no complaint and sftp works fine. Thanks for advice to try scp !!!