Re: ssh password problem

Todd Zullinger wrote:
Frode Petersen wrote:
I had ssh set up and working. Then I got passwordless ssh working
using rsa public keys.

Now, some days later, I can't get ssh to authenticate either way and
in either direction. (Same user on both machines.)

I'm asked for the password (3 times in sequence), but it is rejected
every time. I do enter the password correctly. I log in locally
using the same passwords without a problem.

Since the password request appears, I'd think that the connection
can be established, and that the problem lies within the domain of
authentication, but am a bit perplexed as to how to proceed. How can
I figure out what the problem is?

Run ssh on the client with -v (add more -v's as needed). That is
often quite helpful. Also, take a look at /var/log/secure on the
server side.

Are you using ssh-agent? Is your key added to the agent still?
(ssh-add -l will list the keys ssh-agent is holding for you)



Thank you! A 'tail -f /var/log/secure' showed the reason.
User <user> from <host> not allowed because listed in DenyUsers

In /etc/ssh/sshd.config I have these two lines:
DenyUsers *
AllowGroups <groupname>

(<user> <host> and <groupname> are not used; real names are)

From the openssh manual: <quote>
DenyUsers
This keyword can be followed by a list of user name patterns,
separated by spaces. Login is disallowed for user names that
match one of the patterns. Only user names are valid; a numeri-
cal user ID is not recognized. By default, login is allowed for
all users. If the pattern takes the form USER@HOST then USER and
HOST are separately checked, restricting logins to particular
users from particular hosts. The allow/deny directives are pro-
cessed in the following order: DenyUsers, AllowUsers, DenyGroups,
and finally AllowGroups.

AllowGroups
This keyword can be followed by a list of group name patterns,
separated by spaces. If specified, login is allowed only for
users whose primary group or supplementary group list matches one
of the patterns. Only group names are valid; a numerical group
ID is not recognized. By default, login is allowed for all
groups. The allow/deny directives are processed in the following
order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.

<end quote>

I understood the above text, specifically about the order, to mean that if I added the two lines in the config file, I would
1. Close for all connection from users.
2. Reopen for connections from users in that group.

Obviously, I was mistaken about the logic here.

As to why it worked the first time? Maybe I forgot to restart sshd, I don't know.

If I try to achieve what I intended, how should I use the Deny* and Allow* entries in sshd.config? Would using only the AllowGroups line automatically disable connections from users not belonging to that group?

Again, thanks!

Frode

--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

Relevant Pages

  • Re: sshd attacks
    ... starts trying a user dictionary attack on sshd? ... ssh allows you to specify which users may login and you may further restrict it to a particular user from a particular host. ... This keyword can be followed by a list of user name patterns, ...
    (comp.unix.bsd.freebsd.misc)
  • RE: Single Sign On - Transfer of credential between webapps....
    ... You'll want to provide your own values forthe keys. ... > Change the loginUrl to be that of your login page. ... > Now, in your other applications (Webapp2 for example), you can get at the ... >> One of my website is used to login user: ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: apache+ssl
    ... How do you get SSL to work? ... I created the keys as mentioned above. ... Also tried moving all the SSL directives into the Directive ... Anyone have a HOWTO that actually works? ...
    (Debian-User)
  • Re: So where did RASFF go?
    ... the bit pattern of the desired ASCII character? ... Such keyboards might as well use a layout that there's ... What use is it to know what bit patterns in one code mean? ... than 7 keys. ...
    (rec.arts.sf.fandom)
  • Re: looking for a solution
    ... "Karolski" wrote in message ... > This is my first post here, so please, be patient. ... > (giving their password and login). ... As far as security keys and web development go, I have a table of logins ...
    (comp.lang.java.programmer)