Newsgroup: it.comp.os.linux.sys
Titolo: Accesso SSH direttamente da root

Sto aggiornando l'SSH di un server red hat remoto; nel passaggio dalla
3.7.qualcosa alla 3.8, hanno deciso che non e' piu' possibile loggarsi
direttamente come root.
Per varie ragioni, ho bisogno di accedere alle macchine in questione
direttamente come root (gli ip origine sono comunque limitati a reti
trusted): qualche idea? sshd_config e' gia' a posto.
TIA,
*

 trusted): qualche idea? sshd_config e' gia' a posto.
Nel senso che hai PermitRootLogin yes ? E allora quale e' il
problema? Che errore ti da?
Davide
-- 
| A musician of more ambition than talent composed an elegy at the death
| of composer Edward MacDowell.  She played the elegy for the pianist
| Josef Hoffman, then asked his opinion.  "Well, it's quite nice," he
| replied, but don't you think it would be better if ..."  "If what?" 

 problema? Che errore ti da?
Mi dice che la password e' sbagliata. Ora, dato che mi sto loggando da
localhost e ho appena inserito la stessa password per loggarmi alla console,
mi viene difficile pensare che possa *davvero* essere sbagliata (una volta
si, due anche, sei volte non credo).
Ciaotutti,
*

 typed:
Uhm... Non lascia loggare NESSUNO! Ho provato con un altro account e anche
quello mi dice password errata.
Ciaotutti,
*

 quello mi dice password errata.
Mi viene il dubbio che SSHD stia usando un metodo di autenticazione
diverso da quello normale (aka: (non) usa md5/shadow). Verifica un po'.
Davide
-- 
| When I heated my home with oil, I used an average of 800 gallons a
| year.  I have found that I can keep comfortably warm for an entire
| winter with slightly over half that quantity of beer.   -- Dave Barry,
| "Postpetroleum Guzzler" 

 quello mi dice password errata.
Sicuro di averlo compilato con pam?
-- 
wash the blood from your hands
bury your secrets in the sand
and forget


In coda metto l'output del demone in debug. Non vorrei che fosse il pam a
fare vaccate, pero'... A occhio mi sembra giusto, pero' non ne sono
sicurissimo.
Dato che ho utilizzato i file di configurazione dell'installazione
precedente, a meno che non sia cambiato qualcosa dovrebbe andare tutto.
Versione snippata:
Failed none for root from 127.0.0.1 port 32868 ssh2
debug3: mm_request_receive entering
debug3: mm_auth_password: user not authenticated
Failed none for root from 127.0.0.1 port 32868 ssh2
debug1: userauth-request for user root service ssh-connection method
keyboard-interactive
debug1: attempt 1 failures 1
debug2: input_userauth_request: try method keyboard-interactive
debug1: keyboard-interactive devs
debug1: auth2_challenge: user=root devs=
debug1: kbdint_alloc: devices ''
debug2: auth2_challenge_start: devices
Failed keyboard-interactive for root from 127.0.0.1 port 32868 ssh2
debug1: userauth-request for user root service ssh-connection method
password
debug1: attempt 2 failures 2
debug2: input_userauth_request: try method password
debug3: mm_auth_password entering
debug3: mm_request_send entering: type 10
debug3: mm_auth_password: waiting for MONITOR_ANS_AUTHPASSWORD
debug3: mm_request_receive_expect entering: type 11
debug3: mm_request_receive entering
debug3: monitor_read: checking request 10
debug3: auth_shadow_pwexpired: today 12485 sp_lstchg 12137 sp_max 99999
debug3: mm_answer_authpassword: sending result 0
debug3: mm_request_send entering: type 11
Failed password for root from 127.0.0.1 port 32868 ssh2
Versione completa:
debug2: read_server_config: filename /etc/sshd_config
debug1: sshd version OpenSSH_3.8p1
debug1: private host key: #0 type 0 RSA1
debug3: Not a RSA1 key file /etc/ssh_host_rsa_key.
debug1: read PEM private key done: type RSA
debug1: private host key: #1 type 1 RSA
debug3: Not a RSA1 key file /etc/ssh_host_dsa_key.
debug1: read PEM private key done: type DSA
debug1: private host key: #2 type 2 DSA
socket: Address family not supported by protocol
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
Generating 768 bit RSA key.
RSA key generation complete.
debug1: Server will not fork when running in debugging mode.
Connection from 127.0.0.1 port 32868
debug1: Client protocol version 2.0; client software version OpenSSH_3.8p1
debug1: match: OpenSSH_3.8p1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-1.99-OpenSSH_3.8p1
debug2: Network child is on pid 29243
debug3: preauth child monitor started
debug3: mm_request_receive entering
debug3: privsep user:group 74:74
debug1: permanently_set_uid: 74/74
debug1: list_hostkey_types: ssh-rsa,ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit:
diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit:
aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,r
ijnda...@lysator.liu.se
,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit:
aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,r
ijnda...@lysator.liu.se
,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit:
hmac-md5,hmac-sha1,hmac-ripemd160,
hmac-ri...@openssh.com
,hmac-sha1-96,hm
ac-md5-96
debug2: kex_parse_kexinit:
hmac-md5,hmac-sha1,hmac-ripemd160,
hmac-ri...@openssh.com
,hmac-sha1-96,hm
ac-md5-96
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit:
diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit:
aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,r
ijnda...@lysator.liu.se
,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit:
aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,r
ijnda...@lysator.liu.se
,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit:
hmac-md5,hmac-sha1,hmac-ripemd160,
hmac-ri...@openssh.com
,hmac-sha1-96,hm
ac-md5-96
debug2: kex_parse_kexinit:
hmac-md5,hmac-sha1,hmac-ripemd160,
hmac-ri...@openssh.com
,hmac-sha1-96,hm
ac-md5-96
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_init: found hmac-md5
debug1: kex: client->server aes128-cbc hmac-md5 none
debug2: mac_init: found hmac-md5
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received
debug3: mm_request_send entering: type 0
debug3: monitor_read: checking request 0
debug3: mm_answer_moduli: got parameters: 1024 1024 8192
debug3: mm_request_send entering: type 1
debug2: monitor_read: 0 used once, disabling now
debug3: mm_request_receive entering
debug3: mm_choose_dh: waiting for MONITOR_ANS_MODULI
debug3: mm_request_receive_expect entering: type 1
debug3: mm_request_receive entering
debug3: mm_choose_dh: remaining 0
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug2: dh_gen_key: priv key bits set: 128/256
debug2: bits set: 536/1024
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
debug2: bits set: 515/1024
debug3: mm_key_sign entering
debug3: mm_request_send entering: type 4
debug3: mm_key_sign: waiting for MONITOR_ANS_SIGN
debug3: mm_request_receive_expect entering: type 5
debug3: mm_request_receive entering
debug3: monitor_read: checking request 4
debug3: mm_answer_sign
debug3: mm_answer_sign: signature 0x8117da8(143)
debug3: mm_request_send entering: type 5
debug2: monitor_read: 4 used once, disabling now
debug3: mm_request_receive entering
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
debug1: userauth-request for user root service ssh-connection method none
debug1: attempt 0 failures 0
debug3: mm_getpwnamallow entering
debug3: mm_request_send entering: type 6
debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM
debug3: mm_request_receive_expect entering: type 7
debug3: mm_request_receive entering
debug3: monitor_read: checking request 6
debug3: mm_answer_pwnamallow
debug3: auth_shadow_acctexpired: today 12485 sp_expire -1 days left -12486
debug3: account expiration disabled
debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
debug3: mm_request_send entering: type 7
debug2: monitor_read: 6 used once, disabling now
debug3: mm_request_receive entering
debug2: input_userauth_request: setting up authctxt for root
debug3: mm_inform_authserv entering
debug3: mm_request_send entering: type 3
debug2: input_userauth_request: try method none
debug3: mm_auth_password entering
debug3: mm_request_send entering: type 10
debug3: mm_auth_password: waiting for MONITOR_ANS_AUTHPASSWORD
debug3: mm_request_receive_expect entering: type 11
debug3: mm_request_receive entering
debug3: monitor_read: checking request 3
debug3: mm_answer_authserv: service=ssh-connection, style=
debug2: monitor_read: 3 used once, disabling now
debug3: mm_request_receive entering
debug3: monitor_read: checking request 10
debug3: mm_answer_authpassword: sending result 0
debug3: mm_request_send entering: type 11
Failed none for root from 127.0.0.1 port 32868 ssh2
debug3: mm_request_receive entering
debug3: mm_auth_password: user not authenticated
Failed none for root from 127.0.0.1 port 32868 ssh2
debug1: userauth-request for user root service ssh-connection method
keyboard-interactive
debug1: attempt 1 failures 1
debug2: input_userauth_request: try method keyboard-interactive
debug1: keyboard-interactive devs
debug1: auth2_challenge: user=root devs=
debug1: kbdint_alloc: devices ''
debug2: auth2_challenge_start: devices
Failed keyboard-interactive for root from 127.0.0.1 port 32868 ssh2
debug1: userauth-request for user root service ssh-connection method
password
debug1: attempt 2 failures 2
debug2: input_userauth_request: try method password
debug3: mm_auth_password entering
debug3: mm_request_send entering: type 10
debug3: mm_auth_password: waiting for MONITOR_ANS_AUTHPASSWORD
debug3: mm_request_receive_expect entering: type 11
debug3: mm_request_receive entering
debug3: monitor_read: checking request 10
debug3: auth_shadow_pwexpired: today 12485 sp_lstchg 12137 sp_max 99999
debug3: mm_answer_authpassword: sending result 0
debug3: mm_request_send entering: type 11
Failed password for root from 127.0.0.1 port 32868 ssh2
debug3: mm_request_receive entering
debug3: mm_auth_password: user not authenticated
Failed password for root from 127.0.0.1 port 32868 ssh2
debug1: userauth-request for user root service ssh-connection method
password
debug1: attempt 3 failures 3
debug2: input_userauth_request: try method password
debug3: mm_auth_password entering
debug3: mm_request_send entering: type 10
debug3: mm_auth_password: waiting for MONITOR_ANS_AUTHPASSWORD
debug3: mm_request_receive_expect entering: type 11
debug3: mm_request_receive entering
debug3: monitor_read: checking request 10
debug3: mm_answer_authpassword: sending result 0
debug3: mm_request_send entering: type 11
Failed password for root from 127.0.0.1 port 32868 ssh2
debug3: mm_request_receive entering
debug3: mm_auth_password: user not authenticated
Failed password for root from 127.0.0.1 port 32868 ssh2
debug1: userauth-request for user root service ssh-connection method
password
debug1: attempt 4 failures 4
debug2: input_userauth_request: try method password
debug3: mm_auth_password entering
debug3: mm_request_send entering: type 10
debug3: mm_auth_password: waiting for MONITOR_ANS_AUTHPASSWORD
debug3: mm_request_receive_expect entering: type 11
debug3: mm_request_receive entering
debug3: monitor_read: checking request 10
debug3: mm_answer_authpassword: sending result 0
debug3: mm_request_send entering: type 11
Failed password for root from 127.0.0.1 port 32868 ssh2
debug3: mm_request_receive entering
debug3: mm_auth_password: user not authenticated
Failed password for root from 127.0.0.1 port 32868 ssh2
Connection closed by 127.0.0.1
debug1: do_cleanup
debug1: do_cleanup
Ciaotutti,
*

 Sicuro di averlo compilato con pam?
'nchia mo' mi fai venire il dubbio...
In effetti gli ho dato solo il --prefix quando ho fatto il configure, non
vorrei che avesse deciso di are solo l'autenticazione con chiave.
Mo' riprovo a compilare...
Ciaotutti,
*


Dopo avere esplicitamente inserito --with-pam nella configurazione e aver
lanciato un ciclo di (make clean, make -j 10, make install)... Non e'
cambiato assolutamente nulla :-/
Avro' dimenticato qualcosa?
Ciaotutti,
*

 lanciato un ciclo di (make clean, make -j 10, make install)
Make -j 10?? Che macchina hai?
-- 
Roberto Tagliaferri-Linux user #30785 <-> r.tagliaferri@(forse)
tosnet.it
	Due linee rette s'incontrano
	all'infinito, quando ormai non gliene frega più niente

 (make clean, make -j 10, make install)... Non e'
/me muore di invidia
-- 
He who findeth sensuous pleasures in the bodies of lush, hot, pink
damsels is not righteous, but he can have a lot more fun.

 Make -j 10?? Che macchina hai?
In realta' piccola, ma essendo una macchina da soma si comporta meglio
quando le dai carichi pesanti :)
Ciaotutti,
* -- che e' sempre bloccato li'...

Prova qualcosa come -whith-md5-password ( vado a memoria)
Anche  a me faceva un casino simile su una vecchia slackware.
Ciao Luca
-- 
<<>><<>><<>><<>><<>><<>><<<>><<>><<>><<>><<>><<>><<>><<>>
Luca Paredi
Computing technical supporter              
Universita' degli Studi dell'Insubria  
<<>><<>><<>><<>><<>><<>><<<>><<>><<>><<>><<>><<>><<>><<>>


--with-md5-passwords
Provato pure quello ma non funziona :(
Ciaotutti,
*


Sul server che parametro dai a -j??? 1000?


 typed:
...e fu cosi' che, provando e riprovando, mi accorsi che il configure non
trovava gli header PAM.
Ora vedo se li trovo, dopodiche' forse funziona...
Ciaotutti,
*

 Sul server che parametro dai a -j??? 1000?
Sempre 10, cosi' non mi confondo :P
Ciaotutti,
*

*Alessandro* wrote:

Appena mi liberano qualche cpu te la presto per compilarci ssh:
 
 4 Active Jobs      32 of   32 Processors Active (100.00%)
Vampiri...


 Vampiri...
Misericordia :)
Come media di utilizzo CPU come sta messa?
Ciaotutti,
*

 
Ma cosa sono, 386sx???



ssh non si lamenta... In effetti, non si lamenta manco sshd, mi dicono solo
che la password e' sbagliata. Ora, dopo essermi accorto che il --with-pam in
realta' non funziona, un sospetto sul motivo mi e' anche venuto :P
Ciaotutti,
*
--
Per scrivermi in email aggiungete un tag [PRI] al soggetto, altrimenti
il messaggio verra' automaticamente cassato.
To write me in private mail add a [PRI] to the subject, otherwise the
message will be automatically deleted.

Configurazione corretta per una Red hat:
./configure --with-md5-passwords --with-pam --prefix=/usr --sysconfdir=/etc/
ssh
Grazie a tutti per la collaborazione :)
Ciaotutti,
*

Lo correggo che e' andato a capo:
./configure --with-md5-passwords --with-pam --prefix=/usr \
--sysconfdir=/etc/ssh

E ti pare che non dimenticavo un pezzo...
./configure --with-md5-passwords --with-pam --prefix=/usr \
    --sysconfdir=/etc/ssh --mandir=/usr/share/man \
    --with-mantype=man
Stranamente le man pages non sono zippate, quindi andrebbero zippate a mano
nelle directory opportune, inoltre non sostituiscono automaticamente quelle
gia' esistenti.
Ciaotutti,
*