OpenSSH fails on Cold Boot

[Joshua Warcop]

OpenSSH does not start properly on a cold boot of the server. Windows 2003. If I restart the server and try and schedule a task, I get the typical cannot contact sshd on the server. If I manually restart the OpenSSH service, I can then run a task. I get no other error events from OpenSSH. Only sshd logs this - "sshd : PID 412 : error: fork: Resource temporarily unavailable."

Once again HP SIM fails miserably. I'm really getting sick of fighting this application, and it really looks bad in front of our customer we are doing this for.

[Scott_278]

Did you change the service to run under a real user account? if so, did you delete the files in %PROGRAM_FILES%\OpenSSH\var\log?

[Joshua Warcop]

Service has been running as a real user account ever since installation. I've deleted the files, restarted the server, same results.

[Ronald Kowalka]

Have you by chance followed all of these steps for 2003?

SSH ISSUE
--------------------------------------------------------------------------------

Problem: Windows 2003 does not allow the Local System account to have the privileges it needs to run the Secure Shell (SSH) service. This workaround involves configuring the service to run as a real administrative user.

Solution:

Stopping the service

1. Go to Start Menu>Control Panel>Administrative Tools>
Services to bring up the services window.
2. Find the service labeled OpenSSH Server and stop it.
Changing the Log On As User

1. In the same window, right-click the OpenSSH Server
service, and select Properties.
2. Select the Log On tab.
3. Click This account, and enter ".\Administrator."
4. Enter the Administrator password, and click OK.

Setting File Permissions:

1. Right-click the Start Menu button and select Explore to open a file explorer window.
2. Navigate to C:\Program Files\OpenSSH\var\log, and delete any files you find in that directory.
3. Navigate to C:\Program Files\OpenSSH\etc and select the files ssh_host_dsa_key, ssh_host_key, and ssh_host_rsa_key by holding down Ctrl and clicking on them.
4. Right-click one of the files, and select Properties>Security.
5. Click Advanced.
6. Select the Owner tab, and click Other Users or Groups to change the owner to Administrators.
7. Click OK.

Setting User Privileges

1. Select Start Menu>Control Panel>Administrative Tools>Local Security Policy to open the security policy window.
2. Find the Policies for Create a token object and Replace a process level token, and add Administrator to this group by double-clicking the appropriate privilege.
3. Click Add User or Group, and enter Administrator in the Enter the object names to select field.
4. Click Check Names to verify the entry.
5. Click OK.

Starting the Service

1. At this point, the service Log On As User is set to Administrator, and Administrator has been granted Create a token object and Replace a process-level token privileges.
2. Return to the Services window, and restart the service.

In addition the HP Systems Insight Manager SSH keys might need to be set up.

Reinstalling Systems Insight Manager SSH Keys

To have command line and custom tasks work in HP Systems Insight Manager, re-run mxagentconfig for Administrator if HP Systems Insight Manager was installed by someone other than Administrator. To do this, run

mxagentconfig -a -n -u Administrator -p

Where is the name of your management server and is the password for the administrator account.

Alternately, run mxagentconfig from the command line with no parameters and enter the Central Management Server (CMS) system name and the administrative user details into the graphical user interface (GUI). This sets up the authorized_keys2 file in the administrator/.ssh directory with the CMS key. Note that this only works if the user 'Administrator' is a valid user on the CMS and that user has logged in to Windows, creating the home directory. Further information on SSH is available in the white paper 'SSH in HP Systems Insight Manager' available from the HP website.

(HP SIM v4.1)


Just a note about HP SIM 4.2. When you get a copy of it after December 8th, when it is installed on Windows 2003 all of the steps above are done for you.
rk

[Joshua Warcop]

I appreciate the long post. But like I've mentioned previously, this has been working fine in the past. Just something that seems to have broke. So yes, I have followed all of those steps a while back.