LinuxQuestions.org - SSHD broken

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - SSHD broken (https://www.linuxquestions.org/questions/linux-newbie-8/sshd-broken-149971/)

I have my server running for one month and suddenly i cant connect to my sshd server anymore.

When i try to connect with putty, it asks me for my password. If i give the good password, the window disapear and the connection is closed.

When i try to connect with WINSCP on port 22
i get this window:

http://punker.brutalfield.com/uploads/screen1.bmp

I will post what i get when i execute "sshd punker@localhost:22" from the shell when i get home

Thanks a lot for replying
I really need to make it work again

If you can get to a real terminal, try 'ssh -v ...', as that will tell you most of what is going on with the authentication.

Quote:

Originally posted by colnago
If you can get to a real terminal, try 'ssh -v ...', as that will tell you most of what is going on with the authentication.

this is what i get when i run the command from the local shell

Code:

[root@justdome root]# ssh -v punker@localhost



OpenSSH_3.4p1, SSH protocols 1.5/2.0, OpenSSL 0x0090607f

debug1: Reading configuration data /etc/ssh/ssh_config

debug1: Applying options for *

debug1: Rhosts Authentication disabled, originating port will not be trusted.

debug1: ssh_connect: needpriv 0

debug1: Connecting to localhost [127.0.0.1] port 22.

debug1: Connection established.

debug1: identity file /root/.ssh/identity type -1

debug1: identity file /root/.ssh/id_rsa type -1

debug1: identity file /root/.ssh/id_dsa type -1

debug1: Remote protocol version 1.99, remote software version OpenSSH_3.4p1

debug1: match: OpenSSH_3.4p1 pat OpenSSH*

Enabling compatibility mode for protocol 2.0

debug1: Local version string SSH-2.0-OpenSSH_3.4p1

debug1: SSH2_MSG_KEXINIT sent

debug1: SSH2_MSG_KEXINIT received

debug1: kex: server->client aes128-cbc hmac-md5 none

debug1: kex: client->server aes128-cbc hmac-md5 none

debug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent

debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP

debug1: dh_gen_key: priv key bits set: 131/256

debug1: bits set: 1549/3191

debug1: SSH2_MSG_KEX_DH_GEX_INIT sent

debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY

debug1: Host 'localhost' is known and matches the RSA host key.

debug1: Found key in /root/.ssh/known_hosts:2

debug1: bits set: 1589/3191

debug1: ssh_rsa_verify: signature correct

debug1: kex_derive_keys

debug1: newkeys: mode 1

debug1: SSH2_MSG_NEWKEYS sent

debug1: waiting for SSH2_MSG_NEWKEYS

debug1: newkeys: mode 0

debug1: SSH2_MSG_NEWKEYS received

debug1: done: ssh_kex2.

debug1: send SSH2_MSG_SERVICE_REQUEST

debug1: service_accept: ssh-userauth

debug1: got SSH2_MSG_SERVICE_ACCEPT

debug1: authentications that can continue: publickey,password,keyboard-interactive

debug1: next auth method to try is publickey

debug1: try privkey: /root/.ssh/identity

debug1: try privkey: /root/.ssh/id_rsa

debug1: try privkey: /root/.ssh/id_dsa

debug1: next auth method to try is keyboard-interactive

debug1: authentications that can continue: publickey,password,keyboard-interactive

debug1: next auth method to try is password

punker@localhost's password:

debug1: ssh-userauth2 successful: method password

debug1: channel 0: new [client-session]

debug1: send channel open 0

debug1: Entering interactive session.

debug1: channel_free: channel 0: client-session, nchannels 1

Connection to localhost closed by remote host.

Connection to localhost closed.

debug1: Transferred: stdin 0, stdout 0, stderr 81 bytes in 0.0 seconds

debug1: Bytes per second: stdin 0.0, stdout 0.0, stderr 45151.9

debug1: Exit status -1

and here is my sshd_config file

Code:



#        $OpenBSD: sshd_config,v 1.56 2002/06/20 23:37:12 markus Exp $



# This is the sshd server system-wide configuration file.  See

# sshd_config(5) for more information.



# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin



# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented.  Uncommented options change a

# default value.



#Port 22

Protocol 2,1

#ListenAddress 0.0.0.0

#ListenAddress ::



# HostKey for protocol version 1

HostKey /etc/ssh/ssh_host_key

# HostKeys for protocol version 2

HostKey /etc/ssh/ssh_host_rsa_key

HostKey /etc/ssh/ssh_host_dsa_key



# Lifetime and size of ephemeral version 1 server key

#KeyRegenerationInterval 3600

#ServerKeyBits 768



# Logging

#obsoletes QuietMode and FascistLogging

#SyslogFacility AUTH

#LogLevel INFO



# Authentication:



#LoginGraceTime 600

#PermitRootLogin yes

#StrictModes yes



#RSAAuthentication yes

#PubkeyAuthentication yes

#AuthorizedKeysFile        .ssh/authorized_keys



# rhosts authentication should not be used

#RhostsAuthentication no

# Don't read the user's ~/.rhosts and ~/.shosts files

#IgnoreRhosts yes

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts

#RhostsRSAAuthentication no

# similar for protocol version 2

#HostbasedAuthentication no

# Change to yes if you don't trust ~/.ssh/known_hosts for

# RhostsRSAAuthentication and HostbasedAuthentication

#IgnoreUserKnownHosts no



# To disable tunneled clear text passwords, change to no here!

PasswordAuthentication yes

#PermitEmptyPasswords no



# Change to no to disable s/key passwords

#ChallengeResponseAuthentication yes



# Kerberos options

#KerberosAuthentication no

#KerberosOrLocalPasswd yes

#KerberosTicketCleanup yes



#AFSTokenPassing no



# Kerberos TGT Passing only works with the AFS kaserver

#KerberosTgtPassing no



# Set this to 'yes' to enable PAM keyboard-interactive authentication 

# Warning: enabling this may bypass the setting of 'PasswordAuthentication'

#PAMAuthenticationViaKbdInt yes



X11Forwarding yes

#X11DisplayOffset 10

#X11UseLocalhost yes

#PrintMotd yes

#PrintLastLog yes

#KeepAlive yes

#UseLogin no

UsePrivilegeSeparation yes

#Compression yes



#MaxStartups 10

# no default banner path

#Banner /some/path

#VerifyReverseMapping no



# override default of no subsystems

Subsystem        sftp        /usr/lib/ssh/sftp-server

AllowUsers punker

PermitRootLogin no

for those that interests (if any)
i found the solution (with help from ppl on #linux on undernet)

all the passwords were still functioning but they were outdated
so i just changed my passwords and its working again

..in addition to that please:
1. DO NOT use protocol v1: it's not as secure as v2.
2. DO NOT log in as the root account user: use an unprivileged account, then use sudo/su to perform tasks that need root privileges.