Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #182093 > unrolled thread

Peculiar problem with root login

Back to article view | Back to linux.debian.user

Contents

  Peculiar problem with root login Harry Putnam <reader@newsguy.com> - 2017-06-12 15:50 +0200
    Re: Peculiar problem with root login Jan-Peter Rühmann <jan-peter@ruehmann.name> - 2017-06-12 17:40 +0200
      Re: Peculiar problem with root login Felix Miata <mrmazda@earthlink.net> - 2017-06-12 20:00 +0200
        Re: Peculiar problem with root login Dejan Jocic <jodejka@gmail.com> - 2017-06-12 20:10 +0200
          Re: Peculiar problem with root login Erik Karlin <e_karlin@yahoo.com> - 2017-06-12 20:40 +0200
            Re: Peculiar problem with root login Dejan Jocic <jodejka@gmail.com> - 2017-06-12 21:10 +0200
    Re: Peculiar problem with root login David Christensen <dpchrist@holgerdanske.com> - 2017-06-12 20:50 +0200
      Re: Peculiar problem with root login Harry Putnam <reader@newsguy.com> - 2017-06-18 18:00 +0200
        Re: Peculiar problem with root login Harry Putnam <reader@newsguy.com> - 2017-06-18 23:00 +0200
        Re: Peculiar problem with root login Harry Putnam <reader@newsguy.com> - 2017-06-18 23:00 +0200
        Re: Re: Peculiar problem with root login Tom Dial <tddial@comcast.net> - 2017-06-18 23:10 +0200
          Re: Peculiar problem with root login Harry Putnam <reader@newsguy.com> - 2017-06-19 15:00 +0200
        Re: Peculiar problem with root login David Christensen <dpchrist@holgerdanske.com> - 2017-06-19 08:10 +0200
          Re: Peculiar problem with root login David Christensen <dpchrist@holgerdanske.com> - 2017-06-19 08:20 +0200

#182093 — Peculiar problem with root login

Running debian jesse in a vbox vm on a Solaris host

I have what seems like an unusual problem with root login on this
host.

I've done the normal things one does to allow root login; that is, add

   PermitRootLogin yes

to /etc/ssh/sshd_config

Restart ssh, and in fact this host has been rebooted a few times since
adding that Permit line.

I set sudo up to work with no passwd for a certain user long ago and
so I was able to redo root passwd just to make sure there wasn't some
error there.

Still, I cannot login as root user  I don't mean at the main login
screen one gets on bootup, but from an xterm in a running session.

Of course, checked to see if Caps lock was on... 

I've checked output of ssh -vvv root@localhost, and see nothing very
exciting.. just asking for password and rejecting it repeatedly:

debug1: Next authentication method: password
  root@localhost's password: 
  debug2: we sent a password packet, wait for reply
  debug1: Authentications that can continue: publickey,password
  Permission denied, please try again.

This password has been in use for many years on vm hosts behind
firewall etc etc. So, there is literally NO chance I'm just getting it
wrong.  Not to mention as I said above that I redid the passwd in this
most recent attempt to get it working.

I'm fresh out of ideas as to what else to do here.

The auth log shows:

  Jun 11 14:50:55 d2 sshd[2830]: pam_unix(sshd:auth): authentication
  failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=d.local.lan
  user=root

  Jun 11 14:50:57 d2 sshd[2830]: Failed password for root from
  127.0.0.1 port 54522 ssh2

[toc] | [next] | [standalone]

#182096

Normally you can´t login via Root, because there is no entry in the passwd file.
That is because it is no good Idea to work as root.
the best way for SSH is by public key, without the need for Passwords.
There are a lot of Howto´s in the net.
Hope that helps a little.

Am 12.06.2017 um 15:50 schrieb Harry Putnam:
> Running debian jesse in a vbox vm on a Solaris host
>
> I have what seems like an unusual problem with root login on this
> host.
>
> I've done the normal things one does to allow root login; that is, add
>
>    PermitRootLogin yes
>
> to /etc/ssh/sshd_config
>
> Restart ssh, and in fact this host has been rebooted a few times since
> adding that Permit line.
>
> I set sudo up to work with no passwd for a certain user long ago and
> so I was able to redo root passwd just to make sure there wasn't some
> error there.
>
> Still, I cannot login as root user  I don't mean at the main login
> screen one gets on bootup, but from an xterm in a running session.
>
> Of course, checked to see if Caps lock was on... 
>
> I've checked output of ssh -vvv root@localhost, and see nothing very
> exciting.. just asking for password and rejecting it repeatedly:
>
> debug1: Next authentication method: password
>   root@localhost's password: 
>   debug2: we sent a password packet, wait for reply
>   debug1: Authentications that can continue: publickey,password
>   Permission denied, please try again.
>
> This password has been in use for many years on vm hosts behind
> firewall etc etc. So, there is literally NO chance I'm just getting it
> wrong.  Not to mention as I said above that I redid the passwd in this
> most recent attempt to get it working.
>
> I'm fresh out of ideas as to what else to do here.
>
> The auth log shows:
>
>   Jun 11 14:50:55 d2 sshd[2830]: pam_unix(sshd:auth): authentication
>   failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=d.local.lan
>   user=root
>
>   Jun 11 14:50:57 d2 sshd[2830]: Failed password for root from
>   127.0.0.1 port 54522 ssh2
Good luck,
-- 
Signatur
------------------------------------------------------------------------------------------
FOTO <http://www.ruehmann.name> 	
Jan-Peter Rühmann & Kuma
	
QR-Code (ME-Card) <http://www.ruehmann.name>
Gubkower Str. 7 	
TELEFON:   +49 (38205) 65484
18195 Prangendorf 	
FAX:   +49 (38205) 65212
Deutschland / MVP   	
MOBILE:   +49 (162) 1316054
PIRATENPARTEI <http://piratenpartei-mv.de/> VER.DI <http://rostock.verdi.de/> EUROPA
DEUTSCHLAND MECKLENBURG-VORPOMMERN ROSTOCK
EMAIL:   Jan-Peter@Ruehmann.name <mailto:Jan-Peter@Ruehmann.name>
  ICQ:   <http://www.icq.com> 288192920
<http://www.icq.com/people/about_me.php?uin=288192920>   Sprechen
<http://www.icq.com/people/cmd.php?uin=288192920&action=message>   Hinzuf�gen
<http://www.icq.com/people/cmd.php?uin=288192920&action=add>
  Twitter Profil @JPRuehmann   <http://twitter.com/?q=JPRuehmann#>
  WhatsApp 491621316054   <https://www.whatsapp.com>
WEB:   http://www.ruehmann.name <http://www.ruehmann.name>

------------------------------------------------------------------------------------------
Die Verwendung der Daten zu Werbezwecken ist verboten.

[toc] | [prev] | [next] | [standalone]

#182098

Jan-Peter Rühmann composed on 2017-06-12 17:15 (UTC+0200):
.
> Normally you can´t login via Root, because there is no entry in the passwd file.
.
That is false for every Debian installation (Squeeze, Wheezy, Jessie, Stretch at
least) I have ever done (unless maybe I'm misremembering all the way back to Etch).
-- 
"The wise are known for their understanding, and pleasant
words are persuasive." Proverbs 16:21 (New Living Translation)

 Team OS/2 ** Reg. Linux User #211409 ** a11y rocks!

Felix Miata  ***  http://fm.no-ip.com/

[toc] | [prev] | [next] | [standalone]

#182099

On 12-06-17, Felix Miata wrote:
> Jan-Peter Rühmann composed on 2017-06-12 17:15 (UTC+0200):
> .
> > Normally you can´t login via Root, because there is no entry in the passwd file.
> .
> That is false for every Debian installation (Squeeze, Wheezy, Jessie, Stretch at
> least) I have ever done (unless maybe I'm misremembering all the way back to Etch).
> -- 
> "The wise are known for their understanding, and pleasant
> words are persuasive." Proverbs 16:21 (New Living Translation)
> 
>  Team OS/2 ** Reg. Linux User #211409 ** a11y rocks!
> 
> Felix Miata  ***  http://fm.no-ip.com/
> 

dejan@ddeb:~$ cat /etc/passwd | grep root
root:x:0:0:root:/root:/bin/bash

Perhaps it is true if you choose not to create root account during
installation process.

[toc] | [prev] | [next] | [standalone]

#182101

On Mon, Jun 12, 2017 at 08:06:21PM +0200, Dejan Jocic wrote:
> On 12-06-17, Felix Miata wrote:
> > Jan-Peter Rühmann composed on 2017-06-12 17:15 (UTC+0200):
> > .
> > > Normally you can´t login via Root, because there is no entry in the passwd file.
> > .
> > That is false for every Debian installation (Squeeze, Wheezy, Jessie, Stretch at
> > least) I have ever done (unless maybe I'm misremembering all the way back to Etch).
> > -- 
> > "The wise are known for their understanding, and pleasant
> > words are persuasive." Proverbs 16:21 (New Living Translation)
> > 
> >  Team OS/2 ** Reg. Linux User #211409 ** a11y rocks!
> > 
> > Felix Miata  ***  http://fm.no-ip.com/
> > 
> 
> dejan@ddeb:~$ cat /etc/passwd | grep root
> root:x:0:0:root:/root:/bin/bash
> 
> Perhaps it is true if you choose not to create root account during
> installation process.
> 
> 
man 5 shadow

[toc] | [prev] | [next] | [standalone]

#182103

On 12-06-17, Erik Karlin wrote:
> On Mon, Jun 12, 2017 at 08:06:21PM +0200, Dejan Jocic wrote:
> > On 12-06-17, Felix Miata wrote:
> > > Jan-Peter Rühmann composed on 2017-06-12 17:15 (UTC+0200):
> > > .
> > > > Normally you can´t login via Root, because there is no entry in the passwd file.
> > > .
> > > That is false for every Debian installation (Squeeze, Wheezy, Jessie, Stretch at
> > > least) I have ever done (unless maybe I'm misremembering all the way back to Etch).
> > > -- 
> > > "The wise are known for their understanding, and pleasant
> > > words are persuasive." Proverbs 16:21 (New Living Translation)
> > > 
> > >  Team OS/2 ** Reg. Linux User #211409 ** a11y rocks!
> > > 
> > > Felix Miata  ***  http://fm.no-ip.com/
> > > 
> > 
> > dejan@ddeb:~$ cat /etc/passwd | grep root
> > root:x:0:0:root:/root:/bin/bash
> > 
> > Perhaps it is true if you choose not to create root account during
> > installation process.
> > 
> > 
> man 5 shadow

And? 

p.s. Please, reply to the list, not to me. There is no need to reply to
me, I'm subscribed. Thank you :)

[toc] | [prev] | [next] | [standalone]

#182102

On 06/12/2017 06:39 AM, Harry Putnam wrote:
> Running debian jesse in a vbox vm on a Solaris host
>
> I have what seems like an unusual problem with root login on this
> host.
>
> I've done the normal things one does to allow root login; that is, add
>
>    PermitRootLogin yes
>
> to /etc/ssh/sshd_config
>
> Restart ssh, and in fact this host has been rebooted a few times since
> adding that Permit line.
>
> I set sudo up to work with no passwd for a certain user long ago and
> so I was able to redo root passwd just to make sure there wasn't some
> error there.
>
> Still, I cannot login as root user  I don't mean at the main login
> screen one gets on bootup, but from an xterm in a running session.
>
> Of course, checked to see if Caps lock was on...
>
> I've checked output of ssh -vvv root@localhost, and see nothing very
> exciting.. just asking for password and rejecting it repeatedly:
>
> debug1: Next authentication method: password
>   root@localhost's password:
>   debug2: we sent a password packet, wait for reply
>   debug1: Authentications that can continue: publickey,password
>   Permission denied, please try again.
>
> This password has been in use for many years on vm hosts behind
> firewall etc etc. So, there is literally NO chance I'm just getting it
> wrong.  Not to mention as I said above that I redid the passwd in this
> most recent attempt to get it working.
>
> I'm fresh out of ideas as to what else to do here.
>
> The auth log shows:
>
>   Jun 11 14:50:55 d2 sshd[2830]: pam_unix(sshd:auth): authentication
>   failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=d.local.lan
>   user=root
>
>   Jun 11 14:50:57 d2 sshd[2830]: Failed password for root from
>   127.0.0.1 port 54522 ssh2

Please run the following commands from the console of the jesse vm as 
root and paste your console session (prompts, commands entered, output 
obtained).  If you redact anything, substitute the phrase '<redacted>':

# cat /etc/debian_version

# uname -a

# dpkg-query --show openssh-server

# dpkg-query --show openssh-client

# ls -1 /etc/ssh/*ssh*

# ls -1 /root/.ssh

# egrep -v '^.*#' /etc/ssh/sshd_config | grep .

# ssh localhost

# tail /var/log/auth.log


David

[toc] | [prev] | [next] | [standalone]

#182285

David Christensen <dpchrist@holgerdanske.com> writes:

> On 06/12/2017 06:39 AM, Harry Putnam wrote:
>> Running debian jesse in a vbox vm on a Solaris host
>>
>> I have what seems like an unusual problem with root login on this
>> host.

[...]

>> I'm fresh out of ideas as to what else to do here.
>>
>> The auth log shows:
>>
>>   Jun 11 14:50:55 d2 sshd[2830]: pam_unix(sshd:auth): authentication
>>   failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=d.local.lan
>>   user=root
>>
>>   Jun 11 14:50:57 d2 sshd[2830]: Failed password for root from
>>   127.0.0.1 port 54522 ssh2
>
> Please run the following commands from the console of the jesse vm as
> root and paste your console session (prompts, commands entered, output
> obtained).  If you redact anything, substitute the phrase
> '<redacted>':
>
> # cat /etc/debian_version
>
> # uname -a
>
> # dpkg-query --show openssh-server
>
> # dpkg-query --show openssh-client
>
> # ls -1 /etc/ssh/*ssh*
>
> # ls -1 /root/.ssh
>
> # egrep -v '^.*#' /etc/ssh/sshd_config | grep .
>
> # ssh localhost
>
> # tail /var/log/auth.log

Thanks for the prod... I should have included at least some of that.

-------       -------       ---=---       -------       -------

diagnostic_data:

root # cat /etc/debian_version
8.8

root # uname -a
Linux d2 3.16.0-4-amd64 #1 SMP Debian 3.16.43-2 (2017-04-30) x86_64 GNU/Linux

root # dpkg-query --show openssh-server
openssh-server  1:6.7p1-5+deb8u3

root # dpkg-query --show openssh-client
openssh-client  1:6.7p1-5+deb8u3

root # ls -1 /etc/ssh/*ssh*
/etc/ssh/ssh_config
/etc/ssh/sshd_config
/etc/ssh/sshd_config~
/etc/ssh/ssh_host_dsa_key
/etc/ssh/ssh_host_dsa_key.pub
/etc/ssh/ssh_host_ecdsa_key
/etc/ssh/ssh_host_ecdsa_key.pub
/etc/ssh/ssh_host_ed25519_key
/etc/ssh/ssh_host_ed25519_key.pub
/etc/ssh/ssh_host_rsa_key
/etc/ssh/ssh_host_rsa_key.pub

root # egrep -v '^.*#' /etc/ssh/sshd_config | grep .
Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
UsePrivilegeSeparation yes
KeyRegenerationInterval 3600
ServerKeyBits 1024
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 120
PermitRootLogin without-password
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
PasswordAuthentication yes
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
UsePAM yes
PermitRootLogin yes

root # ssh localhost
root@localhost's password:
Permission denied, please try again.
root@localhost's password:

 **** Could not login **** -ed Harry

root # tail /var/log/auth.log
Jun 18 11:43:17 d2 sshd[1894]: Accepted password for reader from 192.168.1.42 port 40945 ssh2
Jun 18 11:43:17 d2 sshd[1894]: pam_unix(sshd:session): session opened for user reader by (uid=0)
Jun 18 11:43:17 d2 systemd-logind[477]: New session 185 of user reader.
Jun 18 11:43:17 d2 sshd[1897]: Setting tty modes failed: Invalid argument
Jun 18 11:43:59 d2 su[1917]: Successful su for root by reader
Jun 18 11:43:59 d2 su[1917]: + /dev/pts/4 reader:root
Jun 18 11:43:59 d2 su[1917]: pam_unix(su:session): session opened for user root by reader(uid=1000)
Jun 18 11:45:56 d2 sshd[1963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=d.local.lan  user=root
Jun 18 11:45:58 d2 sshd[1963]: Failed password for root from 127.0.0.1 port 54526 ssh2
Jun 18 11:46:03 d2 sshd[1963]: Connection closed by 127.0.0.1 [preauth]

[toc] | [prev] | [next] | [standalone]

#182312

Harry Putnam <reader@newsguy.com> writes:

>>
>> # ls -1 /root/.ssh
>>

Sorry ... I managed to overlook this one:

root # ls -la .ssh
total 12
drwx------ 2 root root 4096 May 30 21:44 .
drwx------ 6 root root 4096 Jun 18 11:35 ..
-rw-r--r-- 1 root root  666 May 30 22:17 known_hosts

[toc] | [prev] | [next] | [standalone]

#182314

Harry Putnam <reader@newsguy.com> writes:

>>
>> # ls -1 /root/.ssh
>>

Sorry ... I managed to overlook this one:

root # ls -la .ssh
total 12
drwx------ 2 root root 4096 May 30 21:44 .
drwx------ 6 root root 4096 Jun 18 11:35 ..
-rw-r--r-- 1 root root  666 May 30 22:17 known_hosts

[toc] | [prev] | [next] | [standalone]

#182315

On 06/18/2017 09:57 AM, Harry Putnam wrote:
> David Christensen <dpchrist@holgerdanske.com> writes:
> 
>> On 06/12/2017 06:39 AM, Harry Putnam wrote:
>>> Running debian jesse in a vbox vm on a Solaris host
>>>
>>> I have what seems like an unusual problem with root login on this
>>> host.
> 
> [...]
> 
>>> I'm fresh out of ideas as to what else to do here.
>>>
>>> The auth log shows:
>>>
>>>   Jun 11 14:50:55 d2 sshd[2830]: pam_unix(sshd:auth): authentication
>>>   failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=d.local.lan
>>>   user=root
>>>
>>>   Jun 11 14:50:57 d2 sshd[2830]: Failed password for root from
>>>   127.0.0.1 port 54522 ssh2
>>
>> Please run the following commands from the console of the jesse vm as
>> root and paste your console session (prompts, commands entered, output
>> obtained).  If you redact anything, substitute the phrase
>> '<redacted>':
>>
>> # cat /etc/debian_version
>>
>> # uname -a
>>
>> # dpkg-query --show openssh-server
>>
>> # dpkg-query --show openssh-client
>>
>> # ls -1 /etc/ssh/*ssh*
>>
>> # ls -1 /root/.ssh
>>
>> # egrep -v '^.*#' /etc/ssh/sshd_config | grep .
>>
>> # ssh localhost
>>
>> # tail /var/log/auth.log
> 
> Thanks for the prod... I should have included at least some of that.
> 
> -------       -------       ---=---       -------       -------
> 
> diagnostic_data:
> 
> root # cat /etc/debian_version
> 8.8
> 
> root # uname -a
> Linux d2 3.16.0-4-amd64 #1 SMP Debian 3.16.43-2 (2017-04-30) x86_64 GNU/Linux
> 
> root # dpkg-query --show openssh-server
> openssh-server  1:6.7p1-5+deb8u3
> 
> root # dpkg-query --show openssh-client
> openssh-client  1:6.7p1-5+deb8u3
> 
> root # ls -1 /etc/ssh/*ssh*
> /etc/ssh/ssh_config
> /etc/ssh/sshd_config
> /etc/ssh/sshd_config~
> /etc/ssh/ssh_host_dsa_key
> /etc/ssh/ssh_host_dsa_key.pub
> /etc/ssh/ssh_host_ecdsa_key
> /etc/ssh/ssh_host_ecdsa_key.pub
> /etc/ssh/ssh_host_ed25519_key
> /etc/ssh/ssh_host_ed25519_key.pub
> /etc/ssh/ssh_host_rsa_key
> /etc/ssh/ssh_host_rsa_key.pub
> 
> root # egrep -v '^.*#' /etc/ssh/sshd_config | grep .
> Port 22
> Protocol 2
> HostKey /etc/ssh/ssh_host_rsa_key
> HostKey /etc/ssh/ssh_host_dsa_key
> HostKey /etc/ssh/ssh_host_ecdsa_key
> HostKey /etc/ssh/ssh_host_ed25519_key
> UsePrivilegeSeparation yes
> KeyRegenerationInterval 3600
> ServerKeyBits 1024
> SyslogFacility AUTH
> LogLevel INFO
> LoginGraceTime 120
> PermitRootLogin without-password

This will prevent root login using a password. Only other methods, such
as RSA authentication are to be permitted.

> StrictModes yes
> RSAAuthentication yes
> PubkeyAuthentication yes
> IgnoreRhosts yes
> RhostsRSAAuthentication no
> HostbasedAuthentication no
> PermitEmptyPasswords no
> ChallengeResponseAuthentication no
> PasswordAuthentication yes
> X11Forwarding yes
> X11DisplayOffset 10
> PrintMotd no
> PrintLastLog yes
> TCPKeepAlive yes
> AcceptEnv LANG LC_*
> Subsystem sftp /usr/lib/openssh/sftp-server
> UsePAM yes
> PermitRootLogin yes

This may or may not be effective owing the the above setting of
"PermitRootLogin without-password" depending on how sshd treats
duplicate setting. My (jessie) man page does not say whether the first
or last setting will be effective.

> 
> root # ssh localhost
> root@localhost's password:
> Permission denied, please try again.
> root@localhost's password:
> 
>  **** Could not login **** -ed Harry
> 
> root # tail /var/log/auth.log
> Jun 18 11:43:17 d2 sshd[1894]: Accepted password for reader from 192.168.1.42 port 40945 ssh2
> Jun 18 11:43:17 d2 sshd[1894]: pam_unix(sshd:session): session opened for user reader by (uid=0)
> Jun 18 11:43:17 d2 systemd-logind[477]: New session 185 of user reader.
> Jun 18 11:43:17 d2 sshd[1897]: Setting tty modes failed: Invalid argument
> Jun 18 11:43:59 d2 su[1917]: Successful su for root by reader
> Jun 18 11:43:59 d2 su[1917]: + /dev/pts/4 reader:root
> Jun 18 11:43:59 d2 su[1917]: pam_unix(su:session): session opened for user root by reader(uid=1000)
> Jun 18 11:45:56 d2 sshd[1963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=d.local.lan  user=root
> Jun 18 11:45:58 d2 sshd[1963]: Failed password for root from 127.0.0.1 port 54526 ssh2
> Jun 18 11:46:03 d2 sshd[1963]: Connection closed by 127.0.0.1 [preauth]
> 

My preferences, for what it is worth, are

PermitRootLogin without-password
ChallengeResponseAuthentication no
PasswordAuthentication no
AllowUsers netuser1 \
 netuser2 \
 ... \
 root@localhost \
 root@backuphost

On some systems, "localhost" doesn't work;
 root@::1 root@127.0.0.1
is a workaround. I have not got around to figuring out the differences,
and as the circumvention is trivial it is not a high priority.

This requires arranging to install each user's public key in his or her
.ssh/authorized_keys file, which can be a pain on a large or active
network, but not that much of a problem with up to a few dozen users and
systems.

Regards,
Tom Dial

[toc] | [prev] | [next] | [standalone]

#182352

Tom Dial <tddial@comcast.net> writes:

[...]

>From Harry's settings:


>> LoginGraceTime 120
>> PermitRootLogin without-password

Tom D wrote:

> This will prevent root login using a password. Only other methods, such
> as RSA authentication are to be permitted.

That turned out to be exactly the problem.

Somewhere amongst my fiddling, weeks ago now. I must have uncommented
that or something like.

[...]

>From Harry's settings:

>> PermitRootLogin yes

> This may or may not be effective owing the the above setting of
> "PermitRootLogin without-password" depending on how sshd treats
> duplicate setting. My (jessie) man page does not say whether the first
> or last setting will be effective.

I guess we may assume it goes by the first since

'PermitRootLogin yes'

was the very last line of my config.

[...]

David Christensen <dpchrist@holgerdanske.com> writes:

[...]

>> ChallengeResponseAuthentication no
>> PasswordAuthentication yes
>
> I use:
>
> PasswordAuthentication no
>
>
> This requires all users to have their remote user public keys entered
> into their authorized_keys files to log in from those remote hosts.
>
>
>> X11Forwarding yes
>> X11DisplayOffset 10
>> PrintMotd no
>> PrintLastLog yes
>> TCPKeepAlive yes
>> AcceptEnv LANG LC_*
>> Subsystem sftp /usr/lib/openssh/sftp-server
>> UsePAM yes
>> PermitRootLogin yes
>
> This conflicts with the above setting (which is what I use):
>
> PermitRootLogin without-password

Yup, that was the problem

Thank you both for the excellent input.. (snipped in this response but
kept on hand for future reference..)

[toc] | [prev] | [next] | [standalone]

#182332

On 06/18/17 08:57, Harry Putnam wrote:
...
> root # cat /etc/debian_version
> 8.8
>
> root # uname -a
> Linux d2 3.16.0-4-amd64 #1 SMP Debian 3.16.43-2 (2017-04-30) x86_64 GNU/Linux
>
> root # dpkg-query --show openssh-server
> openssh-server  1:6.7p1-5+deb8u3
>
> root # dpkg-query --show openssh-client
> openssh-client  1:6.7p1-5+deb8u3
>
> root # ls -1 /etc/ssh/*ssh*
> /etc/ssh/ssh_config
> /etc/ssh/sshd_config
> /etc/ssh/sshd_config~
> /etc/ssh/ssh_host_dsa_key
> /etc/ssh/ssh_host_dsa_key.pub
> /etc/ssh/ssh_host_ecdsa_key
> /etc/ssh/ssh_host_ecdsa_key.pub
> /etc/ssh/ssh_host_ed25519_key
> /etc/ssh/ssh_host_ed25519_key.pub
> /etc/ssh/ssh_host_rsa_key
> /etc/ssh/ssh_host_rsa_key.pub
>
> root # egrep -v '^.*#' /etc/ssh/sshd_config | grep .
> Port 22
> Protocol 2
> HostKey /etc/ssh/ssh_host_rsa_key
> HostKey /etc/ssh/ssh_host_dsa_key
> HostKey /etc/ssh/ssh_host_ecdsa_key
> HostKey /etc/ssh/ssh_host_ed25519_key
> UsePrivilegeSeparation yes
> KeyRegenerationInterval 3600
> ServerKeyBits 1024
> SyslogFacility AUTH
> LogLevel INFO
> LoginGraceTime 120
> PermitRootLogin without-password
> StrictModes yes
> RSAAuthentication yes
> PubkeyAuthentication yes
> IgnoreRhosts yes
> RhostsRSAAuthentication no
> HostbasedAuthentication no
> PermitEmptyPasswords no
> ChallengeResponseAuthentication no
> PasswordAuthentication yes

I use:

PasswordAuthentication no


This requires all users to have their remote user public keys entered 
into their authorized_keys files to log in from those remote hosts.


> X11Forwarding yes
> X11DisplayOffset 10
> PrintMotd no
> PrintLastLog yes
> TCPKeepAlive yes
> AcceptEnv LANG LC_*
> Subsystem sftp /usr/lib/openssh/sftp-server
> UsePAM yes
> PermitRootLogin yes

This conflicts with the above setting (which is what I use):

PermitRootLogin without-password


Delete "PermitRootLogin yes".


> root # ssh localhost
> root@localhost's password:
> Permission denied, please try again.
> root@localhost's password:
>
>  **** Could not login **** -ed Harry
>
> root # tail /var/log/auth.log
> Jun 18 11:43:17 d2 sshd[1894]: Accepted password for reader from 192.168.1.42 port 40945 ssh2
> Jun 18 11:43:17 d2 sshd[1894]: pam_unix(sshd:session): session opened for user reader by (uid=0)
> Jun 18 11:43:17 d2 systemd-logind[477]: New session 185 of user reader.
> Jun 18 11:43:17 d2 sshd[1897]: Setting tty modes failed: Invalid argument
> Jun 18 11:43:59 d2 su[1917]: Successful su for root by reader
> Jun 18 11:43:59 d2 su[1917]: + /dev/pts/4 reader:root
> Jun 18 11:43:59 d2 su[1917]: pam_unix(su:session): session opened for user root by reader(uid=1000)
> Jun 18 11:45:56 d2 sshd[1963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=d.local.lan  user=root
> Jun 18 11:45:58 d2 sshd[1963]: Failed password for root from 127.0.0.1 port 54526 ssh2
> Jun 18 11:46:03 d2 sshd[1963]: Connection closed by 127.0.0.1 [preauth]
>
>


On 06/18/17 13:48, Harry Putnam wrote:
...
 > root # ls -la .ssh
 > total 12
 > drwx------ 2 root root 4096 May 30 21:44 .
 > drwx------ 6 root root 4096 Jun 18 11:35 ..
 > -rw-r--r-- 1 root root  666 May 30 22:17 known_hosts


I'd delete known_hosts, to be safe.


I have AT&T U-verse residential DSL service, which implements DNS hijacking:

https://en.wikipedia.org/wiki/DNS_hijacking


Beware of using SSH directly:

$ ssh remotehost


If remotehost doesn't resolve, instead of a "host not found" error 
message, AT&T directs SSH to a hijacker host; so I can enter my 
passphrase (like a sucker).


You need to create SSH keys for root on this machine:

         2017-06-01 20:44:39 root@jesse ~
         # ssh-keygen
         Generating public/private rsa key pair.
         Enter file in which to save the key (/root/.ssh/id_rsa):
         Enter passphrase (empty for no passphrase): <redacted>
         Enter same passphrase again: <redacted>
         Your identification has been saved in /root/.ssh/id_rsa.
         Your public key has been saved in /root/.ssh/id_rsa.pub.
         The key fingerprint is:
	<remainder redacted>


Be sure to enter a strong passphrase.


Then copy your public key to the authorized_keys file:

         2017-06-01 20:46:17 root@jesse ~
         # cp .ssh/id_rsa.pub .ssh/authorized_keys


You don't want to type your passphrases into remote hosts, especially if 
you have to do it over and over (I use CVS over SSH, so this gets 
tedious very quickly.)  You want to use ssh-agent(1) and ssh-add(1), so 
you can type your passphrase(s) once per key per terminal session into 
your local machine and ssh-agent will manage your decrypted private 
key(s) whenever you log in to remote hosts:

         2017-06-01 20:46:37 root@jesse ~
         # ssh-agent bash -l

         2017-06-01 20:46:54 root@jesse ~
         # ssh-add
         Enter passphrase for /root/.ssh/id_rsa: <redacted>
         Identity added: /root/.ssh/id_rsa (/root/.ssh/id_rsa)


Now you should be able to login from root to root@localhost:

         2017-06-01 20:47:05 root@jesse ~
         # ssh localhost
         The authenticity of host 'localhost (::1)' can't be established.
         ECDSA key fingerprint is <redacted>
         Are you sure you want to continue connecting (yes/no)? yes
         Warning: Permanently added 'localhost' (ECDSA) to the list of 
known hosts.
         ...


Write down the host ECDSA key fingerprint on a note card and keep it. 
You will verify this fingerprint when you log into this machine from 
remote hosts.


Copy and paste all of the above into a log file.


Plug in a USB flash drive and mount it (double-click on the icon on the 
desktop).  Create a directory structure on a USB flash drive:

     root@host1 ~ # mkdir -p /media/user/usblabel/domainname/host1/root/.ssh


Copy root's public key to the flash drive:

     root@host1 ~ # cp /root/.ssh/id_rsa.pub 
/media/user/usblabel/domainname/host1/root/.ssh/.


Go through the above procedure on your other accounts and machines.


Unmount the USB flash drive before yanking it out (right click on 
desktop icon and choose "unmount").


Before you can log in to root@host1 from root@host2, you first need to 
append root@host2' public key (id_rsa.pub) to root@host1's 
authorized_keys file:

     root@host1 ~ # cat 
/media/user/usblabel/domainname/host2/root/.ssh/id_rsa.pub >> 
/root/.ssh/authorized_keys


Then from host2:

     root@host2 ~ # ssh-agent bash -l

     root@host2 ~ # ssh-add

     root@host2 ~ # ssh host1


You should see host2's ECDSA key fingerprint the first time you log in. 
Verify it against the note card.


"SSH Mastery" by Michael W Lucas was worth every penny:

     https://www.michaelwlucas.com/tools/ssh


David

[toc] | [prev] | [next] | [standalone]

#182333

On 06/18/17 23:08, David Christensen wrote:
...
> You should see host2's ECDSA key fingerprint the first time you log in.
> Verify it against the note card.

Correction:  You should see host1's ECDSA key fingerprint ...


David

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web