ssh pam and tcp_wrappers

[Aaron Sheard]

I have successfully upgraded to ssh3.4, and have changed the startup to use inetd.conf with tcp_wrappers.

My problem now is, I can ssh to the host with the root account, but any other user accounts fail, and the message in syslog is:

fatal: PAM session setup failed[33]: General Commercial Security error

what i can't understand is it works for root but no one else.. has anyone had this problem? I am running 11i "trusted system"

[Thomas D. Harrison]

This isn't the exact answer but it might help. It regards a similar problem with ftp.

http://support1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000034057880

[Thomas D. Harrison]

I believe this has something to do with the /etc/rc.config.d/comsec configuration file.
( it starts the ttsyncd daemon ). I know it's not much of a solution but it might give you some key words to search on.

Good Luck!

Thom :^)

[Aaron Sheard]

thanks..I'll check it out. It's odd that root works fine though, just not regular users.

[Aaron Sheard]

Ok, re: the first link the line referenced in the file inside /tcb has the right entry.

the other one, comsec, is for NIS+ servers - i don't use NIS at all so that one is not applicable..

It seems to have something to do with PAM but i am confused because root login works, not others. But i dont see how it could be a permissions problem.

[doug hosking]

The error code isn't very helpful in this case. :-(
How long ago did you convert to a trusted system?
One of the side effects of doing that is that
passwords are immediately expired. There was a bug
in PAM where the wrong error code was being passed
back in the case of expired passwords. I'm not sure
how that would show up in the case of ssh.
If you haven't yet reset the password for the non-root user in
question, you might be tripping over that PAM bug.

I would suggest you try:
1) explicitly resetting the password of the user (with passwd)
and see if that changes the behavior
2) installing patch PHCO_24839 (11.11 PAM patch)

You are already looking at /var/adm/syslog/syslog.log, which
often has more helpful hints about what's going wrong in such
cases.

[Aaron Sheard]

I ended up installing the pre-compiled version made available by HP - it isn't the latest, but it works..

[Richard Ross]

Aaron,

What piece did you reinstall? I having the same problem. Can ssh into root, but receive the 'PAM session setup failed' on any other user.

I just upgraded to:
openssh to 3.4p1
tcpwrappers 7.5
zlib 1.1.4

This is on an hpux 11.0 Trusted system.

[Aaron Sheard]

I never did get it to compile. I ended up installing this one.

https://payment.ecommerce.hp.com/cgi-bin/swdepot_parser.cgi/cgi/try.pl?productNumber=T1471AA&date=

[Richard Ross]

Aaron,

Found the problem.

openssh 3.4p1 defaults to turning sshd privsep ON. This is not supported on an HP Trusted system. You will need to vi sshd_config and turn off UsePrivilegeSeparation.

Recycle sshd and all works fine.

Unfortunatly, this is only documented if you downlod the openssh source.