ssh as root - requires no password despite my best efforts!

[Tony Walker_2]

Hi Guys,

I've come across a strange situation this morning. I'm running ssh root@servername and it logs me straight in! I can do this from any user account. I've checked the usual, rhostsauthentication, .ssh/authorized_keys etc and can't find anything. Comparing the results of ssh -vvv to this and another machine I've found the following: where a normal login returns this line: "1274: debug1: got SSH2_MSG_SERVICE_ACCEPT
1274: debug1: authentications that can continue: publickey,password"

I get this on the problem machine!:
"1198: debug1: got SSH2_MSG_SERVICE_ACCEPT
1198: debug1: ssh-userauth2 successful: method none"??

Grateful for any ideas...

Thanks,

Tony

[Eric Antunes]

Hi Tony,

Check if this thread is good to solve your issue:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=620367

Best Regards,

Eric Antunes

[Steven E. Protter]

Shalom tony,

Directory permissions commonly causes this issue.

I'm wondering what guide you used for setup.

http://www.hpuxconsulting.com/5004.ppt

It's power point, I recommend downloading and then opening it.

SEP

[Denver Osborn]

There's no ssh-agent running? Use "ssh-add -l" to check.

Have you compared the sshd_config between the working and non-working boxes?

If the sshd_config is identical, I'm not sure where else to look yet. Maybe the pam config between the nodes.

It might help if you could post the versions of ssh (client/server) and full output from ssh -vvv

-denver

[Matti_Kurkela]

"ssh-userauth2 successful: method none"?
And you get in as root with no password?

Are you sure that the root account *has* a password on that server?

It seems that the sshd server is set to accept an authentication method called "none". Did you check your /opt/ssh/etc/sshd_config file (if you are using HP's pre-packaged OpenSSH)? How about PAM configuration in /etc/pam.conf?

Which version of SSH are you using? Is this a locally-compiled version, which might have some debugging options active?

There is a possibility that your server has been cracked and the sshd has been replaced with a backdoored or otherwise tampered version.

SEP, did you really read the question? The problem is getting root access *way too easily*.

[Tony Walker_2]

Wow - this is a weird one. I check both boxes the same and yes - there was a root password. So, copied the existing crpyted passwd out of the way and set a new password - suddenly I was asked for the password... So, just for a laugh, I copy/pasted the offending string into the roots password field on another box and bingo same problem!!! That is bizarre - might have to give it a brute force (if we can't find what its supposed to be) just to see what it was!

Thanks for your help.

[Denver Osborn]

strange...

is it a trusted system?

Does pwck (authck -p or pwck -s if trusted) find any errors?

-denver

[Tony Walker_2]

Turns out someone had managed to set the root password blank! I tested this with a crypt("",y5) to verify....

Thanks again!