Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #182332

Re: Peculiar problem with root login

From David Christensen <dpchrist@holgerdanske.com>
Newsgroups linux.debian.user
Subject Re: Peculiar problem with root login
Date 2017-06-19 08:10 +0200
Message-ID <tTY2S-7lb-9@gated-at.bofh.it> (permalink)
References <tRxTb-2Ka-1@gated-at.bofh.it> <tRCzw-5S5-9@gated-at.bofh.it> <tTKMh-71w-9@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On 06/18/17 08:57, Harry Putnam wrote:
...
> root # cat /etc/debian_version
> 8.8
>
> root # uname -a
> Linux d2 3.16.0-4-amd64 #1 SMP Debian 3.16.43-2 (2017-04-30) x86_64 GNU/Linux
>
> root # dpkg-query --show openssh-server
> openssh-server  1:6.7p1-5+deb8u3
>
> root # dpkg-query --show openssh-client
> openssh-client  1:6.7p1-5+deb8u3
>
> root # ls -1 /etc/ssh/*ssh*
> /etc/ssh/ssh_config
> /etc/ssh/sshd_config
> /etc/ssh/sshd_config~
> /etc/ssh/ssh_host_dsa_key
> /etc/ssh/ssh_host_dsa_key.pub
> /etc/ssh/ssh_host_ecdsa_key
> /etc/ssh/ssh_host_ecdsa_key.pub
> /etc/ssh/ssh_host_ed25519_key
> /etc/ssh/ssh_host_ed25519_key.pub
> /etc/ssh/ssh_host_rsa_key
> /etc/ssh/ssh_host_rsa_key.pub
>
> root # egrep -v '^.*#' /etc/ssh/sshd_config | grep .
> Port 22
> Protocol 2
> HostKey /etc/ssh/ssh_host_rsa_key
> HostKey /etc/ssh/ssh_host_dsa_key
> HostKey /etc/ssh/ssh_host_ecdsa_key
> HostKey /etc/ssh/ssh_host_ed25519_key
> UsePrivilegeSeparation yes
> KeyRegenerationInterval 3600
> ServerKeyBits 1024
> SyslogFacility AUTH
> LogLevel INFO
> LoginGraceTime 120
> PermitRootLogin without-password
> StrictModes yes
> RSAAuthentication yes
> PubkeyAuthentication yes
> IgnoreRhosts yes
> RhostsRSAAuthentication no
> HostbasedAuthentication no
> PermitEmptyPasswords no
> ChallengeResponseAuthentication no
> PasswordAuthentication yes

I use:

PasswordAuthentication no


This requires all users to have their remote user public keys entered 
into their authorized_keys files to log in from those remote hosts.


> X11Forwarding yes
> X11DisplayOffset 10
> PrintMotd no
> PrintLastLog yes
> TCPKeepAlive yes
> AcceptEnv LANG LC_*
> Subsystem sftp /usr/lib/openssh/sftp-server
> UsePAM yes
> PermitRootLogin yes

This conflicts with the above setting (which is what I use):

PermitRootLogin without-password


Delete "PermitRootLogin yes".


> root # ssh localhost
> root@localhost's password:
> Permission denied, please try again.
> root@localhost's password:
>
>  **** Could not login **** -ed Harry
>
> root # tail /var/log/auth.log
> Jun 18 11:43:17 d2 sshd[1894]: Accepted password for reader from 192.168.1.42 port 40945 ssh2
> Jun 18 11:43:17 d2 sshd[1894]: pam_unix(sshd:session): session opened for user reader by (uid=0)
> Jun 18 11:43:17 d2 systemd-logind[477]: New session 185 of user reader.
> Jun 18 11:43:17 d2 sshd[1897]: Setting tty modes failed: Invalid argument
> Jun 18 11:43:59 d2 su[1917]: Successful su for root by reader
> Jun 18 11:43:59 d2 su[1917]: + /dev/pts/4 reader:root
> Jun 18 11:43:59 d2 su[1917]: pam_unix(su:session): session opened for user root by reader(uid=1000)
> Jun 18 11:45:56 d2 sshd[1963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=d.local.lan  user=root
> Jun 18 11:45:58 d2 sshd[1963]: Failed password for root from 127.0.0.1 port 54526 ssh2
> Jun 18 11:46:03 d2 sshd[1963]: Connection closed by 127.0.0.1 [preauth]
>
>


On 06/18/17 13:48, Harry Putnam wrote:
...
 > root # ls -la .ssh
 > total 12
 > drwx------ 2 root root 4096 May 30 21:44 .
 > drwx------ 6 root root 4096 Jun 18 11:35 ..
 > -rw-r--r-- 1 root root  666 May 30 22:17 known_hosts


I'd delete known_hosts, to be safe.


I have AT&T U-verse residential DSL service, which implements DNS hijacking:

https://en.wikipedia.org/wiki/DNS_hijacking


Beware of using SSH directly:

$ ssh remotehost


If remotehost doesn't resolve, instead of a "host not found" error 
message, AT&T directs SSH to a hijacker host; so I can enter my 
passphrase (like a sucker).


You need to create SSH keys for root on this machine:

         2017-06-01 20:44:39 root@jesse ~
         # ssh-keygen
         Generating public/private rsa key pair.
         Enter file in which to save the key (/root/.ssh/id_rsa):
         Enter passphrase (empty for no passphrase): <redacted>
         Enter same passphrase again: <redacted>
         Your identification has been saved in /root/.ssh/id_rsa.
         Your public key has been saved in /root/.ssh/id_rsa.pub.
         The key fingerprint is:
	<remainder redacted>


Be sure to enter a strong passphrase.


Then copy your public key to the authorized_keys file:

         2017-06-01 20:46:17 root@jesse ~
         # cp .ssh/id_rsa.pub .ssh/authorized_keys


You don't want to type your passphrases into remote hosts, especially if 
you have to do it over and over (I use CVS over SSH, so this gets 
tedious very quickly.)  You want to use ssh-agent(1) and ssh-add(1), so 
you can type your passphrase(s) once per key per terminal session into 
your local machine and ssh-agent will manage your decrypted private 
key(s) whenever you log in to remote hosts:

         2017-06-01 20:46:37 root@jesse ~
         # ssh-agent bash -l

         2017-06-01 20:46:54 root@jesse ~
         # ssh-add
         Enter passphrase for /root/.ssh/id_rsa: <redacted>
         Identity added: /root/.ssh/id_rsa (/root/.ssh/id_rsa)


Now you should be able to login from root to root@localhost:

         2017-06-01 20:47:05 root@jesse ~
         # ssh localhost
         The authenticity of host 'localhost (::1)' can't be established.
         ECDSA key fingerprint is <redacted>
         Are you sure you want to continue connecting (yes/no)? yes
         Warning: Permanently added 'localhost' (ECDSA) to the list of 
known hosts.
         ...


Write down the host ECDSA key fingerprint on a note card and keep it. 
You will verify this fingerprint when you log into this machine from 
remote hosts.


Copy and paste all of the above into a log file.


Plug in a USB flash drive and mount it (double-click on the icon on the 
desktop).  Create a directory structure on a USB flash drive:

     root@host1 ~ # mkdir -p /media/user/usblabel/domainname/host1/root/.ssh


Copy root's public key to the flash drive:

     root@host1 ~ # cp /root/.ssh/id_rsa.pub 
/media/user/usblabel/domainname/host1/root/.ssh/.


Go through the above procedure on your other accounts and machines.


Unmount the USB flash drive before yanking it out (right click on 
desktop icon and choose "unmount").


Before you can log in to root@host1 from root@host2, you first need to 
append root@host2' public key (id_rsa.pub) to root@host1's 
authorized_keys file:

     root@host1 ~ # cat 
/media/user/usblabel/domainname/host2/root/.ssh/id_rsa.pub >> 
/root/.ssh/authorized_keys


Then from host2:

     root@host2 ~ # ssh-agent bash -l

     root@host2 ~ # ssh-add

     root@host2 ~ # ssh host1


You should see host2's ECDSA key fingerprint the first time you log in. 
Verify it against the note card.


"SSH Mastery" by Michael W Lucas was worth every penny:

     https://www.michaelwlucas.com/tools/ssh


David

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Peculiar problem with root login Harry Putnam <reader@newsguy.com> - 2017-06-12 15:50 +0200
  Re: Peculiar problem with root login Jan-Peter Rühmann <jan-peter@ruehmann.name> - 2017-06-12 17:40 +0200
    Re: Peculiar problem with root login Felix Miata <mrmazda@earthlink.net> - 2017-06-12 20:00 +0200
      Re: Peculiar problem with root login Dejan Jocic <jodejka@gmail.com> - 2017-06-12 20:10 +0200
        Re: Peculiar problem with root login Erik Karlin <e_karlin@yahoo.com> - 2017-06-12 20:40 +0200
          Re: Peculiar problem with root login Dejan Jocic <jodejka@gmail.com> - 2017-06-12 21:10 +0200
  Re: Peculiar problem with root login David Christensen <dpchrist@holgerdanske.com> - 2017-06-12 20:50 +0200
    Re: Peculiar problem with root login Harry Putnam <reader@newsguy.com> - 2017-06-18 18:00 +0200
      Re: Peculiar problem with root login Harry Putnam <reader@newsguy.com> - 2017-06-18 23:00 +0200
      Re: Peculiar problem with root login Harry Putnam <reader@newsguy.com> - 2017-06-18 23:00 +0200
      Re: Re: Peculiar problem with root login Tom Dial <tddial@comcast.net> - 2017-06-18 23:10 +0200
        Re: Peculiar problem with root login Harry Putnam <reader@newsguy.com> - 2017-06-19 15:00 +0200
      Re: Peculiar problem with root login David Christensen <dpchrist@holgerdanske.com> - 2017-06-19 08:10 +0200
        Re: Peculiar problem with root login David Christensen <dpchrist@holgerdanske.com> - 2017-06-19 08:20 +0200

csiph-web