Secure Shell: sftp connection fails for non-root-user

[Fritz MAYER]

I have two identically installed rp2600 servers (HP-UX 11i v2.0) with HP-UX Secure Shell T1471AA (A.04.00.001). Until now I didn't modify the original sshd_config files. It is not possible for a non-root-user to connect per sftp from one server to the other. For root user the connection works fine. Connections per ssh and scp work for all users. I can't realize any permission conflict on sftp-server file or directories. After typing the correct password the client says only "Connection closed". Switching between UsePAM yes/no doesn't change behaviour.

syslog.log on server:

Aug 23 14:30:36 mail1 sshd[8805]: Accepted keyboard-interactive/pam for jimmy from 128.130.35.38 port 55660 ssh2
Aug 23 14:30:36 mail1 sshd[8807]: subsystem request for sftp


Server:

# /opt/ssh/sbin/sshd -ddd
debug2: load_server_config: filename /opt/ssh/etc/sshd_config
debug2: load_server_config: done config len = 290
debug2: parse_server_config: config /opt/ssh/etc/sshd_config len 290
debug1: sshd version OpenSSH_3.9 [ HP-UX Secure Shell-A.03.91.003 ]
debug3: Not a RSA1 key file /opt/ssh/etc/ssh_host_rsa_key.
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug3: Not a RSA1 key file /opt/ssh/etc/ssh_host_dsa_key.
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: rexec_argv[0]='/opt/ssh/sbin/sshd'
debug1: rexec_argv[1]='-ddd'
debug2: fd 4 setting O_NONBLOCK
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug2: fd 5 setting O_NONBLOCK
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug3: fd 6 is not O_NONBLOCK
debug1: Server will not fork when running in debugging mode.
debug3: send_rexec_state: entering fd = 9 config len 290
debug3: ssh_msg_send: type 0
debug3: send_rexec_state: done
debug1: rexec start in 6 out 6 newsock 6 pipe -1 sock 9

Client:

# sftp -v jimmy@mail1
Connecting to mail1...
OpenSSH_4.1, OpenSSL 0.9.7e 25 Oct 2004
HP-UX Secure Shell-A.04.00.001, HP-UX Secure Shell version
debug1: Reading configuration data /opt/ssh/etc/ssh_config
debug1: Connecting to mail1 [128.130.35.37] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/3
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_3.9
debug1: match: OpenSSH_3.9 pat OpenSSH_3.*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_4.1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'mail1' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Next authentication method: keyboard-interactive
Password:
debug1: Authentication succeeded (keyboard-interactive).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
debug1: Sending subsystem: sftp
debug1: client_input_channel_req: channel 0 rtype exit-signal reply 0
debug1: channel 0: free: client-session, nchannels 1
debug1: fd 0 clearing O_NONBLOCK
debug1: fd 1 clearing O_NONBLOCK
debug1: Transferred: stdin 0, stdout 0, stderr 0 bytes in 0.6 seconds
debug1: Bytes per second: stdin 0.0, stdout 0.0, stderr 0.0
debug1: Exit status -1
Connection closed

Any ideas?

Fritz

[Derek Whigham_1]

Check that the create users default shell is in the /etc/shells file.

more /etc/passwd will show you

[Fritz MAYER]

Very interesting hint, Derek, thankyou. The user's login shell is /usr/bin/tcsh and is included in /etc/shells (otherwise I couldn't login per ssh). But after changing the login shell to /usr/bin/sh the sftp-login works suddenly! Why this? It's apparently a problem with tcsh (6.12).

[Michael_356]

Hi there,

maybe there's no entry for tcsh in /etc/shells.

Michael

[Derek Whigham_1]

I had the same problem when I moved to SSH A.04.00, Moving to tcsh Version 6.14 seemed to fix my problem in some instances

http://www.tcsh.org/MostRecentRelease

[Fritz MAYER]

@Michael:

As I've mentioned /etc/shells contains the login shell /usr/bin/tcsh. But this is only a symbolic link to /usr/local/bin/tcsh. In /etc/PATH /usr/local/bin is found before /usr/bin (I don't know why, but sometime the order must have changed). So the only thing to do is to correct the order in /etc/PATH or add /usr/local/bin/tcsh to /etc/shells or better to make both. It's interesting that ssh-logins were satisfied by the existing entry in /etc/shells. Thank you for the helpful hint!

Fritz

[Fritz MAYER]

@Derek:

As you can read in my answer to Michael it was not a matter of tcsh version. But nevertheless I upgraded to tcsh 6.13 (part of latest TC-OpenSource package). But after invoking it shows this annoying "tcsh: using dumb terminal settings". Therfore I exchanged the binary with a PA-RISC 1.1 binary which starts "silently". But I should eventually open a new thread about this item.

[Ranjith_5]

Hi Fritz,

Can you please post your /opt/ssh/etc/sshd_config. Wud like to look into the configuration.

Regards,
Syam

[Fritz MAYER]

It's still the original file.
See attachment.

[Ranjith_5]

You have enabled the KerberosAuthentication in your machine. Is this goin to help any way in your environment? Can you try disabling this and restart sshd ?

Regards,
Syam

[Ranjith_5]

Hi fritz,

hash the following lines in your sshd_config and restart sshd.


KerberosAuthentication yes
UsePAM yes
X11Forwarding yes
X11UseLocalhost no


Regards,
Syam

[Fritz MAYER]

Syam, you are right, Kerberos Authentication is not used in my environment. But the sftp-Problem is finally solved by changing PATH-order respectivley /etc/shells! So, what's the goal of your suggestions for sshd_config? Actually I could close the thread, but I don't want to cut off your contributions ;-)

Fritz

[Fritz MAYER]

My conclusions where too rushy. sftp still didn't work with tcsh (or csh) as login shell. The problem was caused by an alias definition at the end of the file .cshrc. Now I moved the line within the 'if ( $?prompt ) then' statement and sftp-login finally works with tcsh!


BTW the "dumb terminal settings" problem has been solved too, see this thread: http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=910389