We're seeing the following errors when attempting to SFTP to a HP-UX system running B.11.31 from VMS Blade and other HP-UX servers (but are able to successfully SFTP to the same server using other accounts), and wondering whether issue is permission related (As note the user Agritkon on destination server is setup with restricted login shell of /usr/bin/false
Error seen when connecting from another HP-UX server
ukxxxx:/#sftp agritkon@ukxxxx
Password:
Password:
Password:
agritkon@ukxxxx's password:
Permission denied, please try again.
Error seen when connecting from VMS O/S Blade server
ftp agritkon@ukxxxx
warning: Authentication failed.
Disconnected; no more authentication methods available (No further authenticatio
n methods available.).
FATAL: ssh2 client failed to authenticate. (or you have too old ssh2 installed, check with ssh2 "-V")%TCPIP-F-SSH_FATAL, non-specific fatal error condition
Error displayed in syslog.log on destination server
Dec 2 11:07:24 ukxxxx sshd[19657]: error: PAM: Authentication failed for agritkon from ukxxxx.xxx.xxx.com
Dec 2 11:08:06 ukxxxx sshd[19657]: Failed password for agritkon from 10.x.x.x port 55197 ssh2
As i mentioned above, we can SFTP and SSH to the same server using other accounts , but note that none of the accounts have a restricted shell like Agritkon below. My understanding was that provided the associated login shell is included in /etc/shells (which it is) then SFTP should work under that account ?
ukxxxxx:/#cat /etc/passwd | grep agritkon
agritkon:*:4001:4001:xxxxxxxxxxxxx,,:/agritkon/./:/usr/bin/false
The SFTP subsystem is setup as follows ...
ukxxxxx:/#cat sshd_config | grep Sub
Subsystem sftp /opt/ssh/libexec/sftp-server
I have seen a couple of posts in which they mention that sshd_config should include the following line ?
Subsystem sftp internal-sftp
but not sure whether that is the correct fix and/or how that fits in with our current configuration of below ?
Subsystem sftp /opt/ssh/libexec/sftp-server
