--- Em seg, 8/4/13, Bruce Dubbs escreveu: > De: Bruce Dubbs > Assunto: Re: [blfs-support] openssh-6.2p1 messages > Para: "BLFS Support List" > Data: Segunda-feira, 8 de Abril de 2013, 15:10 > Fernando de Oliveira wrote: > > > This was written a bit each day. Hope I did not forget > anything. > > Sorry, it was difficult to follow. Let me say a few > things that may be > repetitive.
LOL. I am not surprised, I wrote and found it difficult to follow, too :-) Thanks for the reply. This time, I will try to be clearer and treat one point at a time, so, will not trim, below, for treating later. > When invoking ssh, there are several different things that > may ask for a > password: ssh-agent on the client, sshd on the > server, pam on the > server, ssh on the client if the key is password protected. Ok, will try to better understand later, but I have gotten some clarification, already, from your reply and the debug process. > To see what is happening, run on the server as root: > > /usr/sbin/sshd -p29 -D -d -d Done. > Use port 29, do not detach from the server, and debug level > 2. Right. > > On the client: > > ssh -v -v -p29 server I did some work during some time in the machines, no disconnection. Left them alone, came back, client disconnected. Attached logs (obtained with command 2>&1 | tee -a ...). Client lost connection with message: $ Write failed: Broken pipe Server stopped manually, after that. Perhaps client is not replying to debug1: server_input_channel_req: channel 0 request pty-req reply 1 ... debug1: server_input_channel_req: channel 0 request shell reply 1 ... debug1: server_input_global_request: rtype [email protected] want_reply 1 This message is repeated many times in the log. > You will get a fair amount of output. If the server > disconects, it will > say why and the client will also give some messages. Server did not disconnect. > ---- > > I do not recommend using iptables unless you really need to > because you > are exposed directly to the internet. If you do need > it, add temporarily: > > iptables -I1 INPUT -p tcp --dport 29 -j ACCEPT > iptables -I1 OUTPUT -p tcp --sport 29 -j ACCEPT Reply to this, postponed. > ---- > > ping generally uses ICMP, not tcp or udp. It can be > changed though. > The rules for iptables to block ICMP generally have to be > specified > unless passing or blocking everything. See > the notes on the firewall > section of BLFS. I knew it could be done, was perhaps going to do it, but I want to ping, as it is the way I "see" the other machines without going there, or just to test they are running, etc. How bad is to leave ping accepted? []s, Fernando
debug2: load_server_config: filename /etc/ssh/sshd_config debug2: load_server_config: done config len = 194 debug2: parse_server_config: config /etc/ssh/sshd_config len 194 debug1: sshd version OpenSSH_6.0p1 debug1: read PEM private key done: type RSA debug1: private host key: #0 type 1 RSA debug1: read PEM private key done: type DSA debug1: private host key: #1 type 2 DSA debug1: read PEM private key done: type ECDSA debug1: private host key: #2 type 3 ECDSA debug1: rexec_argv[0]='/usr/sbin/sshd' debug1: rexec_argv[1]='-p29' debug1: rexec_argv[2]='-D' debug1: rexec_argv[3]='-d' debug1: rexec_argv[4]='-d' Set /proc/self/oom_score_adj from 0 to -1000 debug2: fd 3 setting O_NONBLOCK debug1: Bind to port 29 on 0.0.0.0. Server listening on 0.0.0.0 port 29. debug2: fd 4 setting O_NONBLOCK debug1: Bind to port 29 on ::. Server listening on :: port 29. debug1: Server will not fork when running in debugging mode. debug1: rexec start in 5 out 5 newsock 5 pipe -1 sock 8 debug1: inetd sockets after dupping: 3, 3 Connection from 192.168.0.162 port 33023 debug1: Client protocol version 2.0; client software version OpenSSH_6.0 debug1: match: OpenSSH_6.0 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.0 debug2: fd 3 setting O_NONBLOCK debug2: Network child is on pid 1885 debug1: permanently_set_uid: 50/50 [preauth] debug1: list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256 [preauth] debug1: SSH2_MSG_KEXINIT sent [preauth] debug1: SSH2_MSG_KEXINIT received [preauth] debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 [preauth] debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256 [preauth] debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] [preauth] debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] [preauth] debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 [preauth] debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 [preauth] debug2: kex_parse_kexinit: none,[email protected] [preauth] debug2: kex_parse_kexinit: none,[email protected] [preauth] debug2: kex_parse_kexinit: [preauth] debug2: kex_parse_kexinit: [preauth] debug2: kex_parse_kexinit: first_kex_follows 0 [preauth] debug2: kex_parse_kexinit: reserved 0 [preauth] debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 [preauth] debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss [preauth] debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] [preauth] debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] [preauth] debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 [preauth] debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 [preauth] debug2: kex_parse_kexinit: none,[email protected],zlib [preauth] debug2: kex_parse_kexinit: none,[email protected],zlib [preauth] debug2: kex_parse_kexinit: [preauth] debug2: kex_parse_kexinit: [preauth] debug2: kex_parse_kexinit: first_kex_follows 0 [preauth] debug2: kex_parse_kexinit: reserved 0 [preauth] debug2: mac_setup: found hmac-md5 [preauth] debug1: kex: client->server aes128-ctr hmac-md5 none [preauth] debug2: mac_setup: found hmac-md5 [preauth] debug1: kex: server->client aes128-ctr hmac-md5 none [preauth] debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth] debug2: monitor_read: 4 used once, disabling now debug2: kex_derive_keys [preauth] debug2: set_newkeys: mode 1 [preauth] debug1: SSH2_MSG_NEWKEYS sent [preauth] debug1: expecting SSH2_MSG_NEWKEYS [preauth] debug2: set_newkeys: mode 0 [preauth] debug1: SSH2_MSG_NEWKEYS received [preauth] debug1: KEX done [preauth] debug1: userauth-request for user fernando service ssh-connection method none [preauth] debug1: attempt 0 failures 0 [preauth] debug2: parse_server_config: config reprocess config len 194 debug2: monitor_read: 6 used once, disabling now debug2: input_userauth_request: setting up authctxt for fernando [preauth] debug2: input_userauth_request: try method none [preauth] debug2: monitor_read: 3 used once, disabling now debug1: userauth-request for user fernando service ssh-connection method keyboard-interactive [preauth] debug1: attempt 1 failures 0 [preauth] debug2: input_userauth_request: try method keyboard-interactive [preauth] debug1: keyboard-interactive devs [preauth] debug1: auth2_challenge: user=fernando devs= [preauth] debug1: kbdint_alloc: devices '' [preauth] debug2: auth2_challenge_start: devices [preauth] debug1: userauth-request for user fernando service ssh-connection method password [preauth] debug1: attempt 2 failures 1 [preauth] debug2: input_userauth_request: try method password [preauth] Accepted password for fernando from 192.168.0.162 port 33023 ssh2 debug1: monitor_read_log: child log fd closed debug1: monitor_child_preauth: fernando has been authenticated by privileged process debug2: mac_setup: found hmac-md5 debug2: mac_setup: found hmac-md5 User child is on pid 1886 debug1: permanently_set_uid: 1000/1000 debug2: set_newkeys: mode 0 debug2: set_newkeys: mode 1 debug1: Entering interactive session for SSH2. debug2: fd 5 setting O_NONBLOCK debug2: fd 6 setting O_NONBLOCK debug1: server_init_dispatch_20 debug1: server_input_channel_open: ctype session rchan 0 win 1048576 max 16384 debug1: input_session_request debug1: channel 0: new [server-session] debug2: session_new: allocate (allocated 0 max 10) debug1: session_new: session 0 debug1: session_open: channel 0 debug1: session_open: session 0: link with channel 0 debug1: server_input_channel_open: confirm session debug1: server_input_global_request: rtype [email protected] want_reply 0 debug1: server_input_channel_req: channel 0 request pty-req reply 1 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req pty-req debug1: Allocating pty. debug2: session_new: allocate (allocated 0 max 10) debug1: session_new: session 0 debug1: session_pty_req: session 0 alloc /dev/pts/0 debug1: server_input_channel_req: channel 0 request shell reply 1 debug1: session_by_channel: session 0 channel 0 debug1: session_input_channel_req: session 0 req shell debug2: fd 3 setting TCP_NODELAY debug2: channel 0: rfd 9 isatty debug2: fd 9 setting O_NONBLOCK debug1: Setting controlling tty using TIOCSCTTY. debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1 debug1: server_input_global_request: rtype [email protected] want_reply 1
OpenSSH_6.0p1, OpenSSL 1.0.1a 19 Apr 2012 debug1: Reading configuration data /etc/ssh/ssh_config debug2: ssh_connect: needpriv 0 debug1: Connecting to 192.168.0.100 [192.168.0.100] port 29. debug1: Connection established. debug1: identity file /home/fernando/.ssh/id_rsa type -1 debug1: identity file /home/fernando/.ssh/id_rsa-cert type -1 debug1: identity file /home/fernando/.ssh/id_dsa type -1 debug1: identity file /home/fernando/.ssh/id_dsa-cert type -1 debug1: identity file /home/fernando/.ssh/id_ecdsa type -1 debug1: identity file /home/fernando/.ssh/id_ecdsa-cert type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_6.0 debug1: match: OpenSSH_6.0 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.0 debug2: fd 3 setting O_NONBLOCK debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,[email protected],zlib debug2: kex_parse_kexinit: none,[email protected],zlib debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256 debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected] debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,[email protected] debug2: kex_parse_kexinit: none,[email protected] debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: mac_setup: found hmac-md5 debug1: kex: server->client aes128-ctr hmac-md5 none debug2: mac_setup: found hmac-md5 debug1: kex: client->server aes128-ctr hmac-md5 none debug1: sending SSH2_MSG_KEX_ECDH_INIT debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ECDSA 1e:07:16:f5:5a:0e:88:60:f5:7b:12:58:03:9c:0e:7a debug1: checking without port identifier debug1: Host '192.168.0.100' is known and matches the ECDSA host key. debug1: Found key in /home/fernando/.ssh/known_hosts:16 debug1: found matching key w/out port debug1: ssh_ecdsa_verify: signature correct debug2: kex_derive_keys debug2: set_newkeys: mode 1 debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug2: set_newkeys: mode 0 debug1: SSH2_MSG_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST sent debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug2: key: /home/fernando/.ssh/id_rsa ((nil)) debug2: key: /home/fernando/.ssh/id_dsa ((nil)) debug2: key: /home/fernando/.ssh/id_ecdsa ((nil)) debug1: Authentications that can continue: publickey,password,keyboard-interactive debug1: Next authentication method: publickey debug1: Trying private key: /home/fernando/.ssh/id_rsa debug1: Trying private key: /home/fernando/.ssh/id_dsa debug1: Trying private key: /home/fernando/.ssh/id_ecdsa debug2: we did not send a packet, disable method debug1: Next authentication method: keyboard-interactive debug2: userauth_kbdint debug2: we sent a keyboard-interactive packet, wait for reply debug1: Authentications that can continue: publickey,password,keyboard-interactive debug2: we did not send a packet, disable method debug1: Next authentication method: password debug2: we sent a password packet, wait for reply debug1: Authentication succeeded (password). Authenticated to 192.168.0.100 ([192.168.0.100]:29). debug2: fd 5 setting O_NONBLOCK debug1: channel 0: new [client-session] debug2: channel 0: send open debug1: Requesting [email protected] debug1: Entering interactive session. debug2: callback start debug2: client_session2_setup: id 0 debug2: fd 3 setting TCP_NODELAY debug2: channel 0: request pty-req confirm 1 debug2: channel 0: request shell confirm 1 debug2: callback done debug2: channel 0: open confirm rwindow 0 rmax 32768 debug2: channel_input_status_confirm: type 99 id 0 debug2: PTY allocation request accepted on channel 0 debug2: channel 0: rcvd adjust 2097152 debug2: channel_input_status_confirm: type 99 id 0 debug2: shell request accepted on channel 0 Last login: Mon Apr 8 19:43:39 2013 from 192.168.0.162 Environment: USER=fernando LOGNAME=fernando HOME=/home/fernando PATH=/usr/bin:/bin:/usr/sbin:/sbin MAIL=/var/mail/fernando SHELL=/bin/bash SSH_CLIENT=192.168.0.162 33023 29 SSH_CONNECTION=192.168.0.162 33023 192.168.0.100 29 SSH_TTY=/dev/pts/0 TERM=xterm [?1034h[?1034h[?1034h[?1034h[?1034h[?1034h[?1034h[?1034h[?1034hDo you want to start X? (y/n): n ]0;fernando@VMWLFSGamer: ~[1;32mfernando [ [0m~[1;32m ]$ [0m ]0;fernando@VMWLFSGamer: ~[1;32mfernando [ [0m~[1;32m ]$ [0mmail -bash: mail: comando não encontrado ]0;fernando@VMWLFSGamer: ~[1;32mfernando [ [0m~[1;32m ]$ [0mecho $MAIL /var/mail/fernando ]0;fernando@VMWLFSGamer: ~[1;32mfernando [ [0m~[1;32m ]$ [0mecho $SHELL /bin/bash ]0;fernando@VMWLFSGamer: ~[1;32mfernando [ [0m~[1;32m ]$ [0mecho $SSH_CLIENT 192.168.0.162 33023 29 ]0;fernando@VMWLFSGamer: ~[1;32mfernando [ [0m~[1;32m ]$ [0mecho $TERM xterm ]0;fernando@VMWLFSGamer: ~[1;32mfernando [ [0m~[1;32m ]$ [0mWrite failed: Broken pipe
-- http://linuxfromscratch.org/mailman/listinfo/blfs-support FAQ: http://www.linuxfromscratch.org/blfs/faq.html Unsubscribe: See the above information page
