Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #182315

Re: Re: Peculiar problem with root login

Show all headers | View raw

On 06/18/2017 09:57 AM, Harry Putnam wrote:
> David Christensen <dpchrist@holgerdanske.com> writes:
> 
>> On 06/12/2017 06:39 AM, Harry Putnam wrote:
>>> Running debian jesse in a vbox vm on a Solaris host
>>>
>>> I have what seems like an unusual problem with root login on this
>>> host.
> 
> [...]
> 
>>> I'm fresh out of ideas as to what else to do here.
>>>
>>> The auth log shows:
>>>
>>>   Jun 11 14:50:55 d2 sshd[2830]: pam_unix(sshd:auth): authentication
>>>   failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=d.local.lan
>>>   user=root
>>>
>>>   Jun 11 14:50:57 d2 sshd[2830]: Failed password for root from
>>>   127.0.0.1 port 54522 ssh2
>>
>> Please run the following commands from the console of the jesse vm as
>> root and paste your console session (prompts, commands entered, output
>> obtained).  If you redact anything, substitute the phrase
>> '<redacted>':
>>
>> # cat /etc/debian_version
>>
>> # uname -a
>>
>> # dpkg-query --show openssh-server
>>
>> # dpkg-query --show openssh-client
>>
>> # ls -1 /etc/ssh/*ssh*
>>
>> # ls -1 /root/.ssh
>>
>> # egrep -v '^.*#' /etc/ssh/sshd_config | grep .
>>
>> # ssh localhost
>>
>> # tail /var/log/auth.log
> 
> Thanks for the prod... I should have included at least some of that.
> 
> -------       -------       ---=---       -------       -------
> 
> diagnostic_data:
> 
> root # cat /etc/debian_version
> 8.8
> 
> root # uname -a
> Linux d2 3.16.0-4-amd64 #1 SMP Debian 3.16.43-2 (2017-04-30) x86_64 GNU/Linux
> 
> root # dpkg-query --show openssh-server
> openssh-server  1:6.7p1-5+deb8u3
> 
> root # dpkg-query --show openssh-client
> openssh-client  1:6.7p1-5+deb8u3
> 
> root # ls -1 /etc/ssh/*ssh*
> /etc/ssh/ssh_config
> /etc/ssh/sshd_config
> /etc/ssh/sshd_config~
> /etc/ssh/ssh_host_dsa_key
> /etc/ssh/ssh_host_dsa_key.pub
> /etc/ssh/ssh_host_ecdsa_key
> /etc/ssh/ssh_host_ecdsa_key.pub
> /etc/ssh/ssh_host_ed25519_key
> /etc/ssh/ssh_host_ed25519_key.pub
> /etc/ssh/ssh_host_rsa_key
> /etc/ssh/ssh_host_rsa_key.pub
> 
> root # egrep -v '^.*#' /etc/ssh/sshd_config | grep .
> Port 22
> Protocol 2
> HostKey /etc/ssh/ssh_host_rsa_key
> HostKey /etc/ssh/ssh_host_dsa_key
> HostKey /etc/ssh/ssh_host_ecdsa_key
> HostKey /etc/ssh/ssh_host_ed25519_key
> UsePrivilegeSeparation yes
> KeyRegenerationInterval 3600
> ServerKeyBits 1024
> SyslogFacility AUTH
> LogLevel INFO
> LoginGraceTime 120
> PermitRootLogin without-password

This will prevent root login using a password. Only other methods, such
as RSA authentication are to be permitted.

> StrictModes yes
> RSAAuthentication yes
> PubkeyAuthentication yes
> IgnoreRhosts yes
> RhostsRSAAuthentication no
> HostbasedAuthentication no
> PermitEmptyPasswords no
> ChallengeResponseAuthentication no
> PasswordAuthentication yes
> X11Forwarding yes
> X11DisplayOffset 10
> PrintMotd no
> PrintLastLog yes
> TCPKeepAlive yes
> AcceptEnv LANG LC_*
> Subsystem sftp /usr/lib/openssh/sftp-server
> UsePAM yes
> PermitRootLogin yes

This may or may not be effective owing the the above setting of
"PermitRootLogin without-password" depending on how sshd treats
duplicate setting. My (jessie) man page does not say whether the first
or last setting will be effective.

> 
> root # ssh localhost
> root@localhost's password:
> Permission denied, please try again.
> root@localhost's password:
> 
>  **** Could not login **** -ed Harry
> 
> root # tail /var/log/auth.log
> Jun 18 11:43:17 d2 sshd[1894]: Accepted password for reader from 192.168.1.42 port 40945 ssh2
> Jun 18 11:43:17 d2 sshd[1894]: pam_unix(sshd:session): session opened for user reader by (uid=0)
> Jun 18 11:43:17 d2 systemd-logind[477]: New session 185 of user reader.
> Jun 18 11:43:17 d2 sshd[1897]: Setting tty modes failed: Invalid argument
> Jun 18 11:43:59 d2 su[1917]: Successful su for root by reader
> Jun 18 11:43:59 d2 su[1917]: + /dev/pts/4 reader:root
> Jun 18 11:43:59 d2 su[1917]: pam_unix(su:session): session opened for user root by reader(uid=1000)
> Jun 18 11:45:56 d2 sshd[1963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=d.local.lan  user=root
> Jun 18 11:45:58 d2 sshd[1963]: Failed password for root from 127.0.0.1 port 54526 ssh2
> Jun 18 11:46:03 d2 sshd[1963]: Connection closed by 127.0.0.1 [preauth]
> 

My preferences, for what it is worth, are

PermitRootLogin without-password
ChallengeResponseAuthentication no
PasswordAuthentication no
AllowUsers netuser1 \
 netuser2 \
 ... \
 root@localhost \
 root@backuphost

On some systems, "localhost" doesn't work;
 root@::1 root@127.0.0.1
is a workaround. I have not got around to figuring out the differences,
and as the circumvention is trivial it is not a high priority.

This requires arranging to install each user's public key in his or her
.ssh/authorized_keys file, which can be a pain on a large or active
network, but not that much of a problem with up to a few dozen users and
systems.

Regards,
Tom Dial

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Peculiar problem with root login Harry Putnam <reader@newsguy.com> - 2017-06-12 15:50 +0200
  Re: Peculiar problem with root login Jan-Peter Rühmann <jan-peter@ruehmann.name> - 2017-06-12 17:40 +0200
    Re: Peculiar problem with root login Felix Miata <mrmazda@earthlink.net> - 2017-06-12 20:00 +0200
      Re: Peculiar problem with root login Dejan Jocic <jodejka@gmail.com> - 2017-06-12 20:10 +0200
        Re: Peculiar problem with root login Erik Karlin <e_karlin@yahoo.com> - 2017-06-12 20:40 +0200
          Re: Peculiar problem with root login Dejan Jocic <jodejka@gmail.com> - 2017-06-12 21:10 +0200
  Re: Peculiar problem with root login David Christensen <dpchrist@holgerdanske.com> - 2017-06-12 20:50 +0200
    Re: Peculiar problem with root login Harry Putnam <reader@newsguy.com> - 2017-06-18 18:00 +0200
      Re: Peculiar problem with root login Harry Putnam <reader@newsguy.com> - 2017-06-18 23:00 +0200
      Re: Peculiar problem with root login Harry Putnam <reader@newsguy.com> - 2017-06-18 23:00 +0200
      Re: Re: Peculiar problem with root login Tom Dial <tddial@comcast.net> - 2017-06-18 23:10 +0200
        Re: Peculiar problem with root login Harry Putnam <reader@newsguy.com> - 2017-06-19 15:00 +0200
      Re: Peculiar problem with root login David Christensen <dpchrist@holgerdanske.com> - 2017-06-19 08:10 +0200
        Re: Peculiar problem with root login David Christensen <dpchrist@holgerdanske.com> - 2017-06-19 08:20 +0200

csiph-web