ssh help please

[Guest salan]

Hi I am having problems with ssh on an ubuntu server (latest release setup as a webserver).

It was working, but some how I have managed to mess it up.

The server is working and I can use webmin etc.

But when I go to ssh in (using say putty) It asks for a user and pass then shuts the session down.

Here is a debug log of what happens:

Dec 8 08:33:48 webserver sshd[2597]: debug1: Forked child 2817.

Dec 8 08:33:48 webserver sshd[2817]: Set /proc/self/oom_score_adj to -1000

Dec 8 08:33:48 webserver sshd[2817]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8

Dec 8 08:33:48 webserver sshd[2817]: debug1: inetd sockets after dupping: 3, 3

Dec 8 08:33:48 webserver sshd[2817]: Connection from 192.168.1.5 port 54808

Dec 8 08:33:49 webserver sshd[2817]: debug1: Client protocol version 2.0; client software version PuTTY_Release_0.60

Dec 8 08:33:49 webserver sshd[2817]: debug1: no match: PuTTY_Release_0.60

Dec 8 08:33:49 webserver sshd[2817]: debug1: Enabling compatibility mode for protocol 2.0

Dec 8 08:33:49 webserver sshd[2817]: debug1: Local version string SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1

Dec 8 08:33:51 webserver sshd[2817]: debug1: PAM: initializing for "alan"

Dec 8 08:33:51 webserver sshd[2817]: debug1: PAM: setting PAM_RHOST to "unknown-00-0c-29-3b-f0-6d.home"

Dec 8 08:33:51 webserver sshd[2817]: debug1: PAM: setting PAM_TTY to "ssh"

Dec 8 08:33:55 webserver sshd[2817]: debug1: PAM: password authentication accepted for alan

Dec 8 08:33:55 webserver sshd[2817]: debug1: do_pam_account: called

Dec 8 08:33:55 webserver sshd[2817]: Accepted password for alan from 192.168.1.5 port 54808 ssh2

Dec 8 08:33:55 webserver sshd[2817]: debug1: monitor_child_preauth: alan has been authenticated by privileged process

Dec 8 08:33:55 webserver sshd[2817]: debug1: PAM: establishing credentials

Dec 8 08:33:55 webserver sshd[2817]: pam_unix(sshd:session): session opened for user alan by (uid=0)

Dec 8 08:33:55 webserver sshd[2817]: User child is on pid 2844

Dec 8 08:33:55 webserver sshd[2844]: debug1: SELinux support disabled

Dec 8 08:33:55 webserver sshd[2844]: debug1: PAM: establishing credentials

Dec 8 08:33:55 webserver sshd[2844]: debug1: permanently_set_uid: 1000/1000

Dec 8 08:33:55 webserver sshd[2844]: debug1: Entering interactive session for SSH2.

Dec 8 08:33:55 webserver sshd[2844]: debug1: server_init_dispatch_20

Dec 8 08:33:55 webserver sshd[2844]: debug1: server_input_channel_open: ctype session rchan 256 win 16384 max 16384

Dec 8 08:33:55 webserver sshd[2844]: debug1: input_session_request

Dec 8 08:33:55 webserver sshd[2844]: debug1: channel 0: new [server-session]

Dec 8 08:33:55 webserver sshd[2844]: debug1: session_new: session 0

Dec 8 08:33:55 webserver sshd[2844]: debug1: session_open: channel 0

Dec 8 08:33:55 webserver sshd[2844]: debug1: session_open: session 0: link with channel 0

Dec 8 08:33:55 webserver sshd[2844]: debug1: server_input_channel_open: confirm session

Dec 8 08:33:55 webserver sshd[2844]: debug1: server_input_channel_req: channel 0 request pty-req reply 1

Dec 8 08:33:55 webserver sshd[2844]: debug1: session_by_channel: session 0 channel 0

Dec 8 08:33:55 webserver sshd[2844]: debug1: session_input_channel_req: session 0 req pty-req

Dec 8 08:33:55 webserver sshd[2844]: debug1: Allocating pty.

Dec 8 08:33:55 webserver sshd[2817]: debug1: session_new: session 0

Dec 8 08:33:55 webserver sshd[2817]: debug1: SELinux support disabled

Dec 8 08:33:55 webserver sshd[2844]: debug1: session_pty_req: session 0 alloc /dev/pts/0

Dec 8 08:33:55 webserver sshd[2844]: debug1: server_input_channel_req: channel 0 request shell reply 1

Dec 8 08:33:55 webserver sshd[2844]: debug1: session_by_channel: session 0 channel 0

Dec 8 08:33:55 webserver sshd[2844]: debug1: session_input_channel_req: session 0 req shell

Dec 8 08:33:55 webserver sshd[2844]: debug1: Forced command (config) 'internal-sftp'

Dec 8 08:33:55 webserver sshd[2845]: debug1: Setting controlling tty using TIOCSCTTY.

Dec 8 08:33:55 webserver sshd[2844]: debug1: Received SIGCHLD.

Dec 8 08:33:55 webserver sshd[2844]: debug1: session_by_pid: pid 2845

Dec 8 08:33:55 webserver sshd[2844]: debug1: session_exit_message: session 0 channel 0 pid 2845

Dec 8 08:33:55 webserver sshd[2844]: debug1: session_exit_message: release channel 0

Dec 8 08:33:55 webserver sshd[2817]: debug1: session_by_tty: session 0 tty /dev/pts/0

Dec 8 08:33:55 webserver sshd[2817]: debug1: session_pty_cleanup: session 0 release /dev/pts/0

Dec 8 08:33:55 webserver sshd[2844]: debug1: session_by_channel: session 0 channel 0

Dec 8 08:33:55 webserver sshd[2844]: debug1: session_close_by_channel: channel 0 child 0

Dec 8 08:33:55 webserver sshd[2844]: debug1: session_close: session 0 pid 0

Dec 8 08:33:55 webserver sshd[2844]: debug1: channel 0: free: server-session, nchannels 1

Dec 8 08:33:55 webserver sshd[2844]: Connection closed by 192.168.1.5

Dec 8 08:33:55 webserver sshd[2844]: debug1: do_cleanup

Dec 8 08:33:55 webserver sshd[2844]: Transferred: sent 2832, received 1688 bytes

Dec 8 08:33:55 webserver sshd[2844]: Closing connection to 192.168.1.5 port 54808

Dec 8 08:33:55 webserver sshd[2817]: debug1: PAM: cleanup

Dec 8 08:33:55 webserver sshd[2817]: debug1: PAM: closing session

Dec 8 08:33:55 webserver sshd[2817]: pam_unix(sshd:session): session closed for user alan

Dec 8 08:33:55 webserver sshd[2817]: debug1: PAM: deleting credentials

 

Any one any ideas?

Alan

Edited December 8, 2011 by salan

[lownoize]

Has the user a valid shell? Is the shell listed in /etc/shells?

Could you run ssh -vvv username@host from another linux system to your webserver and attach the log,

because your debug log from sshd shows only the closing of the connection

[Guest salan]

Dec 8 09:17:01 webserver CRON[3145]: pam_unix(cron:session): session opened for user root by (uid=0)

Dec 8 09:17:01 webserver CRON[3145]: pam_unix(cron:session): session closed for user root

Dec 8 09:17:27 webserver sshd[2597]: debug1: Forked child 3148.

Dec 8 09:17:27 webserver sshd[3148]: Set /proc/self/oom_score_adj to -1000

Dec 8 09:17:27 webserver sshd[3148]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8

Dec 8 09:17:27 webserver sshd[3148]: debug1: inetd sockets after dupping: 3, 3

Dec 8 09:17:27 webserver sshd[3148]: Connection from 192.168.1.5 port 54922

Dec 8 09:17:27 webserver sshd[3148]: debug1: Client protocol version 2.0; client software version PuTTY_Release_0.61

Dec 8 09:17:27 webserver sshd[3148]: debug1: no match: PuTTY_Release_0.61

Dec 8 09:17:27 webserver sshd[3148]: debug1: Enabling compatibility mode for protocol 2.0

Dec 8 09:17:27 webserver sshd[3148]: debug1: Local version string SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1

Dec 8 09:17:30 webserver sshd[3148]: debug1: PAM: initializing for "alan"

Dec 8 09:17:30 webserver sshd[3148]: debug1: PAM: setting PAM_RHOST to "unknown-00-0c-29-3b-f0-6d.home"

Dec 8 09:17:30 webserver sshd[3148]: debug1: PAM: setting PAM_TTY to "ssh"

Dec 8 09:17:34 webserver sshd[3148]: debug1: PAM: password authentication accepted for alan

Dec 8 09:17:34 webserver sshd[3148]: debug1: do_pam_account: called

Dec 8 09:17:34 webserver sshd[3148]: Accepted password for alan from 192.168.1.5 port 54922 ssh2

Dec 8 09:17:34 webserver sshd[3148]: debug1: monitor_child_preauth: alan has been authenticated by privileged process

Dec 8 09:17:34 webserver sshd[3148]: debug1: PAM: establishing credentials

Dec 8 09:17:34 webserver sshd[3148]: pam_unix(sshd:session): session opened for user alan by (uid=0)

Dec 8 09:17:35 webserver sshd[3148]: User child is on pid 3174

Dec 8 09:17:35 webserver sshd[3174]: debug1: SELinux support disabled

Dec 8 09:17:35 webserver sshd[3174]: debug1: PAM: establishing credentials

Dec 8 09:17:35 webserver sshd[3174]: debug1: permanently_set_uid: 1000/1000

Dec 8 09:17:35 webserver sshd[3174]: debug1: Entering interactive session for SSH2.

Dec 8 09:17:35 webserver sshd[3174]: debug1: server_init_dispatch_20

Dec 8 09:17:35 webserver sshd[3174]: debug1: server_input_channel_open: ctype session rchan 256 win 16384 max 16384

Dec 8 09:17:35 webserver sshd[3174]: debug1: input_session_request

Dec 8 09:17:35 webserver sshd[3174]: debug1: channel 0: new [server-session]

Dec 8 09:17:35 webserver sshd[3174]: debug1: session_new: session 0

Dec 8 09:17:35 webserver sshd[3174]: debug1: session_open: channel 0

Dec 8 09:17:35 webserver sshd[3174]: debug1: session_open: session 0: link with channel 0

Dec 8 09:17:35 webserver sshd[3174]: debug1: server_input_channel_open: confirm session

Dec 8 09:17:35 webserver sshd[3174]: debug1: server_input_channel_req: channel 0 request pty-req reply 1

Dec 8 09:17:35 webserver sshd[3174]: debug1: session_by_channel: session 0 channel 0

Dec 8 09:17:35 webserver sshd[3174]: debug1: session_input_channel_req: session 0 req pty-req

Dec 8 09:17:35 webserver sshd[3174]: debug1: Allocating pty.

Dec 8 09:17:35 webserver sshd[3148]: debug1: session_new: session 0

Dec 8 09:17:35 webserver sshd[3148]: debug1: SELinux support disabled

Dec 8 09:17:35 webserver sshd[3174]: debug1: session_pty_req: session 0 alloc /dev/pts/0

Dec 8 09:17:35 webserver sshd[3174]: debug1: server_input_channel_req: channel 0 request exec reply 1

Dec 8 09:17:35 webserver sshd[3174]: debug1: session_by_channel: session 0 channel 0

Dec 8 09:17:35 webserver sshd[3174]: debug1: session_input_channel_req: session 0 req exec

Dec 8 09:17:35 webserver sshd[3174]: debug1: Forced command (config) 'internal-sftp'

Dec 8 09:17:35 webserver sshd[3175]: debug1: Setting controlling tty using TIOCSCTTY.

Dec 8 09:17:35 webserver sshd[3174]: debug1: Received SIGCHLD.

Dec 8 09:17:35 webserver sshd[3174]: debug1: session_by_pid: pid 3175

Dec 8 09:17:35 webserver sshd[3174]: debug1: session_exit_message: session 0 channel 0 pid 3175

Dec 8 09:17:35 webserver sshd[3174]: debug1: session_exit_message: release channel 0

Dec 8 09:17:35 webserver sshd[3148]: debug1: session_by_tty: session 0 tty /dev/pts/0

Dec 8 09:17:35 webserver sshd[3148]: debug1: session_pty_cleanup: session 0 release /dev/pts/0

Dec 8 09:17:35 webserver sshd[3174]: debug1: session_by_channel: session 0 channel 0

Dec 8 09:17:35 webserver sshd[3174]: debug1: session_close_by_channel: channel 0 child 0

Dec 8 09:17:35 webserver sshd[3174]: debug1: session_close: session 0 pid 0

Dec 8 09:17:35 webserver sshd[3174]: debug1: channel 0: free: server-session, nchannels 1

Dec 8 09:17:35 webserver sshd[3174]: Connection closed by 192.168.1.5

Dec 8 09:17:35 webserver sshd[3174]: debug1: do_cleanup

Dec 8 09:17:35 webserver sshd[3174]: Transferred: sent 2832, received 1712 bytes

Dec 8 09:17:35 webserver sshd[3174]: Closing connection to 192.168.1.5 port 54922

Dec 8 09:17:35 webserver sshd[3148]: debug1: PAM: cleanup

Dec 8 09:17:35 webserver sshd[3148]: debug1: PAM: closing session

Dec 8 09:17:35 webserver sshd[3148]: pam_unix(sshd:session): session closed for user alan

Dec 8 09:17:35 webserver sshd[3148]: debug1: PAM: deleting credentials

[lownoize]

does it work for other users? Does sftp work?

Looks like there is a forced command configured for the user/group, and that is 'internal-sftp., so only sftp should and no interactive login.

Could you please check /etc/ssh/sshd_config forced commands? Just grep ForceCommand /etc/ssh/sshd_config

[Guest salan]

does it work for other users? Does sftp work?

Looks like there is a forced command configured for the user/group, and that is 'internal-sftp., so only sftp should and no interactive login.

Could you please check /etc/ssh/sshd_config forced commands? Just grep ForceCommand /etc/ssh/sshd_config

 

give that man a cigar!

Yep that was it. A while ago I set it up to forces sftp only.

I have so little problems with my linux boxes that i forgot!! (*hangs head in shame*)

Many thanks All fixed now.

Alan