login works via ssh but not via telnet

[Brett Simpson]

I created a user account and it works when loggin in via ssh. It doesn't work via telnet. I also just realized that root is accessible via ssh but not telnet. Any ideas?

Thanks

[Sunny123_1]

Hi

Check your /etc/inetd.conf file and look for telnet option i think it has # mark.

Also check /var/adm/inetd.sec file and look any telnet deny is there or not

Hope this help.

Regards
Sunny

[Basheer_2]

This is good.

Usually now a days sysadmins disable all the traditional insecure services to secure the system.

sunny has given all the correct steps.

[Basheer_2]

if you still need it.

follow Sunny's steps and also there should be entries in the /etc/services file.

[Steven E. Protter]

Shalom,

Check inetd.conf

Probably telnet is disabled.

netstat -an | grep ":23 "

See if telnet is listening.

If it is, see if inetd.sec is blocking telnet or TCP wrappers configuration is interfering.

Check logs /var/adm/syslog/syslog.log

SEP

[Brett Simpson]

I've checked /etc/inetd.conf and there are no commented lines regarding telnet. /var/adm/inetd.sec does not exist on this server.

I can also telnet to other non-root users without a problem.

[James R. Ferguson]

Hi Brett:

> I can also telnet to other non-root users without a problem.

Look for your '/etc/securetty' file. It undoubtedly exists and has a line with the word "console" in it. The presence of this file inhibits root logins to the listed devices.

Regards!

...JRF...

[Brett Simpson]

Telnet is not disabled at all. I can connect, just get a reply that login is incorrect. This only happens on root and certain other non-root users.

[Brett Simpson]

James,
Shouldn't that entry in /etc/securetty also disable root login via ssh? I can login to the root account via ssh. The console entry is in /etc/securetty, but doesn't stop login from ssh. I also commented it out and still the same results.

That also doesn't really explain why I can login via telnet to some non-root users, but can't with others.

This is also a system that I just inherited, so I didn't set it up.

[James R. Ferguson · Accepted solution]

Hi (again) Brett:

> Shouldn't that entry in /etc/securetty also disable root login via ssh? I can login to the root account via ssh.

No, 'ssh' uses 'PermitRootLogin' in '/opt/ssh/etc/sshd_config'. Change it to "no" (and remove the comment mark) and restart the 'sshd' daemon.

Regards!

...JRF...

[James R. Ferguson]

Hi:

By the way, Brett, you should read and honor:

http://forums13.itrc.hp.com/service/forums/helptips.do?#28

Evaluating the help you received not only says "thanks" but helps trollers find suitable solutions to their questions later.

Regards!

...JRF...

[Brett Simpson]

James,
Thanks and I will start doing that.

[Brett Simpson]

Still hasn't really addressed my non-root users issue. I've checked everything that's been suggested. Still don't know why I can login to some non-root users via telnet, but not others.

[Tingli]

Maybe you are lucky enough to find information from file /var/adm/syslog/syslog.log with the failed telnet login.

[James R. Ferguson]

Hi (again) Brett:

> Still don't know why I can login to some non-root users via telnet, but not others.

Ok, I missed the "non-root" subset. I would begin by comparing the profiles of non-root users who can sucessfully login with those who cannot.

Regards!

...JRF...

[Mel Burslan]

ssh might authenticate by means of a pass-phrase which is different than that of a password. If your ssh authentication is set up using pass-phrases and when you telnet, you are trying to use the same pass-phrase as password, you might be failing because your password is set as some other string on the failing accounts whereas it might be set to the same in working accounts.

Can you run the command below and post the debug output here:

ssh -vvv user@hostname

don't worry, the pass-phrase or password will not show in your screen capture.

[Brett Simpson]

There is nothing in syslog at all. James, that was my next step. Thanks.

[Brett Simpson]

Mel, Here goes:

OpenSSH_3.9, OpenSSL 0.9.7d 17 Mar 2004
HP-UX Secure Shell-A.03.91.002, HP-UX Secure Shell version
debug1: Reading configuration data /opt/ssh/etc/ssh_config
debug3: RNG is ready, skipping seeding
debug2: ssh_connect: needpriv 0
debug1: Connecting to cbpux30 [164.103.219.11] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/3
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_4.5p1+sftpfilecontrol-v1.1-hpn12v14
debug1: match: OpenSSH_4.5p1+sftpfilecontrol-v1.1-hpn12v14 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.9
debug2: fd 4 setting O_NONBLOCK
debug3: RNG is ready, skipping seeding
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_init: found hmac-md5
debug1: kex: server->client aes128-cbc hmac-md5 none
debug2: mac_init: found hmac-md5
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 125/256
debug2: bits set: 491/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: check_host_in_hostfile: filename /root/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 8
debug3: check_host_in_hostfile: filename /root/.ssh/known_hosts
debug3: check_host_in_hostfile: filename /opt/ssh/etc/ssh_known_hosts
debug1: Host 'cbpux30' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:8
Warning: Permanently added the RSA host key for IP address '164.103.219.11' to the list of known hosts.
debug2: bits set: 509/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /root/.ssh/id_rsa (00000000)
debug2: key: /root/.ssh/id_dsa (00000000)
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug3: start over, passed a different list publickey,password,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug3: no such identity: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug3: no such identity: /root/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug2: we sent a keyboard-interactive packet, wait for reply
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
Password:
debug3: packet_send2: adding 32 (len 23 padlen 9 extra_pad 64)
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 0
debug3: packet_send2: adding 48 (len 10 padlen 6 extra_pad 64)
debug1: Authentication succeeded (keyboard-interactive).
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug1: Entering interactive session.
debug2: callback start
debug2: client_session2_setup: id 0
debug2: channel 0: request pty-req confirm 0
debug3: tty_make_modes: ospeed 9600
debug3: tty_make_modes: ispeed 0
debug3: tty_make_modes: 1 3
debug3: tty_make_modes: 2 28
debug3: tty_make_modes: 3 127
debug3: tty_make_modes: 4 21
debug3: tty_make_modes: 5 4
debug3: tty_make_modes: 6 0
debug3: tty_make_modes: 7 255
debug3: tty_make_modes: 8 17
debug3: tty_make_modes: 9 19
debug3: tty_make_modes: 10 26
debug3: tty_make_modes: 11 255
debug3: tty_make_modes: 13 255
debug3: tty_make_modes: 14 255
debug3: tty_make_modes: 16 255
debug3: tty_make_modes: 30 1
debug3: tty_make_modes: 31 0
debug3: tty_make_modes: 32 0
debug3: tty_make_modes: 33 1
debug3: tty_make_modes: 34 0
debug3: tty_make_modes: 35 0
debug3: tty_make_modes: 36 1
debug3: tty_make_modes: 37 0
debug3: tty_make_modes: 38 1
debug3: tty_make_modes: 39 0
debug3: tty_make_modes: 40 1
debug3: tty_make_modes: 41 0
debug3: tty_make_modes: 50 1
debug3: tty_make_modes: 51 1
debug3: tty_make_modes: 52 0
debug3: tty_make_modes: 53 1
debug3: tty_make_modes: 54 1
debug3: tty_make_modes: 55 1
debug3: tty_make_modes: 56 0
debug3: tty_make_modes: 57 0
debug3: tty_make_modes: 58 0
debug3: tty_make_modes: 59 0
debug3: tty_make_modes: 60 0
debug3: tty_make_modes: 61 0
debug3: tty_make_modes: 62 0
debug3: tty_make_modes: 70 1
debug3: tty_make_modes: 71 0
debug3: tty_make_modes: 72 1
debug3: tty_make_modes: 73 0
debug3: tty_make_modes: 74 0
debug3: tty_make_modes: 75 0
debug3: tty_make_modes: 90 1
debug3: tty_make_modes: 91 1
debug3: tty_make_modes: 92 1
debug3: tty_make_modes: 93 0
debug2: channel 0: request shell confirm 0
debug2: fd 4 setting TCP_NODELAY
debug2: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug2: channel 0: rcvd adjust 131072
Last successful login: Tue Jun 16 08:27:37 MDT 2009 localhost
Last authentication failure: Tue Jun 16 07:47:19 MDT 2009 localhost

[Mel Burslan]

Hmmm... so you are actually using the password authentication via ssh. And you are providing the same password to the telnet session and it won't work. Right ?

In this case I am going to go out on a limb and say something your terminal emulator doing is causing you this grief. What, I can not say, but a wrong terminal type emulation, might prevent some characters from being typed. Also, are you using any auto-login scripts on your terminal emulators ?

As a suggestion, did you try typing your password on a notepad (or other ascii editor) and pasting it to ssh and telnet sessions simultaneously ?

[Steven E. Protter]

Shalom again,

Off the wall suggestion.

Stop using telnet. Authentication is in clear text. ssh is a good replacement.

You might want to generate a new public ssh key without a pass phrase.

Check the permissions and ownership of the files in .ssh and the permissions and ownership of the .ssh folder

SEP

[Brett Simpson]

Mel,
I am using the same password on both. This is only helping with some user accounts. My personal non-root account works just fine via ssh or telnet.

I would think that rules out the emulator issue. I definitely need to check the .profile.

[Dennis Handly]

>I would think that rules out the emulator issue.

I.e. no uses of # or @.

[Steven E. Protter]

Shalom again Brett.

If both systems are under your control, safely eliminate the password (ssh only).

http://www.hpux.ws/?p=10

SEP

[Anoop P_2]

Check the entry in password file for those users who can login using ssh but not telnet:

user1:x:uid:gid:GECOS:home:shell

That x here would mean the account is not setup with a password at all, so they cant telnet.

check user home directory/.ssh folder for keys, mostly you'll find ssh keys that are setup, so user can login using keys.

[Shankar_6]

Hi,

check for ur /etc/profile..may be it has something that denies login to specific user (in ur case it is root)..

if there is a console entry in ur /etc/securetty file then u cannot do a direct root login ..(need use su or sudo ..).In this case u can login as root only on console and not by telnet..