SSHD errors in event log when the HP SIM service starts

[Sean Wheeler]

I get the following errors in the event log of the CMS when I start the HP SIM service:

Time: 12:04:43 HP Systems Insight Manager started.
Time: 12:05:00 sshd : PID 1932 : Did not receive identification string from
Time: 12:05:01 sshd : PID 4660 : Illegal user root from .
Time: 12:05:01 sshd : PID 4660 : input_userauth_request: illegal user root.
Time: 12:05:01 sshd : PID 4660 : Failed none for illegal user root from port 2802 ssh2.
Time: 12:05:01 sshd : PID 4660 : Received disconnect from : 11: The user disconnected the application.

I have successfully logged using putty through SSH with both the local administrator account and the domain administrator account I used to install HP SIM.

I am running the Central Management Server
on a Windows 2000 Server box. The version is HP SIM 5 SP 4.

Has anybody else seen these error in event logs?

[Numy]

Sean, just to give you a quick reply, I am seeing this in my Application Event logs as well. Didn't even notice them until you pointed them out. Same thing happening here and I cannot find the associated PIDs that it references at all either.

I'm also running SIM 5.4 but on W2K3.

[Sean Wheeler]

Thanks Numy,
I couldn't find the Process IDs either I assume the processes terminate after failing to log in.

I have checked the "\Program Files\OpenSSH\etc\sshd_config" file and PermitRootLogin is set to yes. So root should be able to login.

I have tried to log in with the root account but I dont know the password I have tried the Local admin password and "rootme".

Does anyone know why HPSIM is trying to log onto the server through ssh as root?

[Daniyar]

I have these errors during HP SIM start (ver 5.0 latest patch) and then once an hour. It looks like it also use my admin account and because I changed it, it locks it every hour of so. It is a real pain. I check all WEB GUI settings, but can not find a place where a can alter this setting.

[Daniyar]

There a document that explains how to alter some SSH settings from command line.

http://h10018.www1.hp.com/wwsolutions/misc/hpsim-helpfiles/hpsim_5_ssh.pdf

I think the problem is somewhere in bypass user settings, because I discovered my admin account there.