ordinary users unable to login on the SSH server

[Maaz]

SSH Server OS: SLES 10 SP 1 x86_64
SSH Server IP: 192.168.0.1

# rpm -q openssh
openssh-4.2p1-18.25

# ssh -V
OpenSSH_4.2p1, OpenSSL 0.9.8a 11 Oct 2005

every thing is default.

root can login on the ssh server, no problem.

but ordinary(non-root accounts) users are unable to login on the SSH server from any ssh-client machine.

from ssh client
# ssh -v bilal@192.168.0.1
OpenSSH_4.2p1, OpenSSL 0.9.8a 11 Oct 2005
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to 192.168.0.1 [192.168.0.1] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: Remote protocol version 1.99, remote software version OpenSSH_4.2
debug1: match: OpenSSH_4.2 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_4.2
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '192.168.0.1' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/identity
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Next authentication method: keyboard-interactive
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: No more authentication methods to try.
Permission denied (publickey,keyboard-interactive).


from ssh server
# tail -f /var/log/messages
Sep 9 11:48:26 gateway sshd[10164]: error: PAM: Authentication failure for bilal from 192.168.0.6


I append in the /etc/ssh/sshd_config
#LogLevel INFO
LogLevel DEBUG3

# tail -f /var/log/messages
Sep 9 11:49:27 gateway sshd[10190]: debug3: fd 4 is not O_NONBLOCK
Sep 9 11:49:27 gateway sshd[10192]: debug1: rexec start in 4 out 4 newsock 4 pipe 6 sock 7
Sep 9 11:49:27 gateway sshd[10190]: debug1: Forked child 10192.
Sep 9 11:49:27 gateway sshd[10190]: debug3: send_rexec_state: entering fd = 7 config len 403
Sep 9 11:49:27 gateway sshd[10190]: debug3: ssh_msg_send: type 0
Sep 9 11:49:27 gateway sshd[10190]: debug3: send_rexec_state: done
Sep 9 11:49:27 gateway sshd[10192]: debug1: inetd sockets after dupping: 3, 3
Sep 9 11:49:27 gateway sshd[10192]: debug3: Normalising mapped IPv4 in IPv6 address
Sep 9 11:49:27 gateway sshd[10192]: Connection from 192.168.0.6 port 27704
Sep 9 11:49:27 gateway sshd[10192]: debug1: Client protocol version 2.0; client software version OpenSSH_4.2
Sep 9 11:49:27 gateway sshd[10192]: debug1: match: OpenSSH_4.2 pat OpenSSH*
Sep 9 11:49:27 gateway sshd[10192]: debug1: Enabling compatibility mode for protocol 2.0
Sep 9 11:49:27 gateway sshd[10192]: debug1: Local version string SSH-1.99-OpenSSH_4.2
Sep 9 11:49:27 gateway sshd[10192]: debug2: fd 3 setting O_NONBLOCK
Sep 9 11:49:27 gateway sshd[10192]: debug2: Network child is on pid 10193
Sep 9 11:49:27 gateway sshd[10192]: debug3: preauth child monitor started
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_request_receive entering
Sep 9 11:49:27 gateway sshd[10192]: debug3: monitor_read: checking request 0
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_answer_moduli: got parameters: 1024 1024 8192
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_request_send entering: type 1
Sep 9 11:49:27 gateway sshd[10192]: debug2: monitor_read: 0 used once, disabling now
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_request_receive entering
Sep 9 11:49:27 gateway sshd[10192]: debug3: monitor_read: checking request 4
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_answer_sign
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_answer_sign: signature 0x5555556c4460(143)
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_request_send entering: type 5
Sep 9 11:49:27 gateway sshd[10192]: debug2: monitor_read: 4 used once, disabling now
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_request_receive entering
Sep 9 11:49:27 gateway sshd[10192]: debug3: monitor_read: checking request 6
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_answer_pwnamallow
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_request_send entering: type 7
Sep 9 11:49:27 gateway sshd[10192]: debug2: monitor_read: 6 used once, disabling now
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_request_receive entering
Sep 9 11:49:27 gateway sshd[10192]: debug3: monitor_read: checking request 45
Sep 9 11:49:27 gateway sshd[10192]: debug1: PAM: initializing for "bilal"
Sep 9 11:49:27 gateway sshd[10192]: debug3: Normalising mapped IPv4 in IPv6 address
Sep 9 11:49:27 gateway sshd[10192]: debug3: Trying to reverse map address 192.168.0.6.
Sep 9 11:49:27 gateway sshd[10192]: debug1: PAM: setting PAM_RHOST to "192.168.0.6"
Sep 9 11:49:27 gateway sshd[10192]: debug1: PAM: setting PAM_TTY to "ssh"
Sep 9 11:49:27 gateway sshd[10192]: debug2: monitor_read: 45 used once, disabling now
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_request_receive entering
Sep 9 11:49:27 gateway sshd[10192]: debug3: monitor_read: checking request 3
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_answer_authserv: service=ssh-connection, style=
Sep 9 11:49:27 gateway sshd[10192]: debug2: monitor_read: 3 used once, disabling now
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_request_receive entering
Sep 9 11:49:27 gateway sshd[10192]: debug3: monitor_read: checking request 48
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_answer_pam_init_ctx
Sep 9 11:49:27 gateway sshd[10192]: debug3: PAM: sshpam_init_ctx entering
Sep 9 11:49:27 gateway sshd[10194]: debug3: ssh_msg_send: type 7
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_request_send entering: type 49
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_request_receive entering
Sep 9 11:49:27 gateway sshd[10192]: debug3: monitor_read: checking request 50
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_answer_pam_query
Sep 9 11:49:27 gateway sshd[10192]: debug3: PAM: sshpam_query entering
Sep 9 11:49:27 gateway sshd[10192]: debug3: ssh_msg_recv entering
Sep 9 11:49:27 gateway sshd[10192]: debug3: PAM: PAM_AUTH_ERR
Sep 9 11:49:27 gateway sshd[10192]: error: PAM: Authentication failure for bilal from 192.168.0.6
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_request_send entering: type 51
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_request_receive entering
Sep 9 11:49:27 gateway sshd[10192]: debug3: monitor_read: checking request 54
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_answer_pam_free_ctx
Sep 9 11:49:27 gateway sshd[10192]: debug3: PAM: sshpam_free_ctx entering
Sep 9 11:49:27 gateway sshd[10192]: debug3: PAM: sshpam_thread_cleanup entering
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_request_send entering: type 55
Sep 9 11:49:27 gateway sshd[10192]: debug2: monitor_read: 54 used once, disabling now
Sep 9 11:49:27 gateway sshd[10192]: Failed unknown for bilal from 192.168.0.6 port 27704 ssh2
Sep 9 11:49:27 gateway sshd[10192]: debug3: mm_request_receive entering
Sep 9 11:49:27 gateway sshd[10192]: debug1: do_cleanup
Sep 9 11:49:27 gateway sshd[10192]: debug1: PAM: cleanup
Sep 9 11:49:27 gateway sshd[10192]: debug3: PAM: sshpam_thread_cleanup entering

from ssh server
# cat /etc/pam.d/sshd
#%PAM-1.0
auth include common-auth
auth required pam_nologin.so
account include common-account
password include common-password
session include common-session
# Enable the following line to get resmgr support for
# ssh sessions (see /usr/share/doc/packages/resmgr/README)
#session optional pam_resmgr.so fake_ttyname

Regards
Maaz

[Ollie Rowland]

Hi,

It looks like you don't have any keys configured on the client:
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_dsa type -1

How has this been set up and what kind of authentication are you trying to use?

[Maaz]

Thanks Ollie Rowland for reply.

>How has this been set up and what kind of authentication are you >trying to use?
this is a default setup. no additional configuration. we use to login on the server using password, we didnt configure the password-less(automatic login) login... again this is just the default setup, without any additional configs.

[Maaz]

attached is /etc/ssh/sshd_config

[Ollie Rowland]

Hi,

The line
PasswordAuthentication no
looks a bit suspect.

Can you comment it out (or set it to yes), restart the sshd and try again?

[Maaz]

Hi Ollie Rowland thanks for continuous support.

either I put the "#" before PasswordAuthentication or set PasswordAuthentication to "no"

restart the sshd.

then now atleast I got the password prompt, but rejected with the same error i.e
Permission denied (publickey,keyboard-interactive).

# ssh bilal@192.168.0.1
bilal@192.168.0.1's password:
Permission denied, please try again.
bilal@192.168.0.1's password:
Permission denied, please try again.
bilal@192.168.0.1's password:
Permission denied (publickey,password,keyboard-interactive).

Regards
Maaz

[Ollie Rowland]

Hi,

I think be default the root user is not allowed to log in via SSH like this.

You have 2 choices:
* Log in as a non-root user and use su to switch to root

* Add the line "PermitRootLogin yes" to sshd and restart the sshd

For security purposes, I would personally choose the first option.

[Maxim Revutskiy]

Just in case, does ordinary users can login via local console?

And could you post your /etc/pam.d/sshd ?

[Maaz]

Thanks Maxim Revutskiy for support.
> Just in case, does ordinary users can login via local console?
YES,

# ssh root@192.168.0.1
gateway:~ # su - bilal
bilal@gateway:~>

>And could you post your /etc/pam.d/sshd ?
from ssh server
# cat /etc/pam.d/sshd
#%PAM-1.0
auth include common-auth
auth required pam_nologin.so
account include common-account
password include common-password
session include common-session
# Enable the following line to get resmgr support for
# ssh sessions (see /usr/share/doc/packages/resmgr/README)
#session optional pam_resmgr.so fake_ttyname

[Maxim Revutskiy]

Can you provide output of ls -l /dev/tty* ?