[SOLVED] FC9 running on VMWare server 2.0, no SSH

kinetik · 09-21-2009, 05:14 PM

Hi all

Here's the background:

I have an FC9 (Fedora release 9 (Sulphur)) VM running on a Windows Host, let's say it's called VMA.
I made a copy of this VM, lock stock and barrel, to a new VMWare Server Host running on RHEL4.

Everything went just fine, managed to change the IP of the copied VM, changed the hostname (VMB), ethernet devices up and running... BUT I cannot for the life of me SSH to the new copy of the VM.

I can jump onto the VM by means of VMWare console and SSH from there to any other server I know of. I can see connections coming in if I do a tail -f /var/log/secure, but the server just flatly refuses any ssh attempts.

SELinux was running on the server, now disabled. Port 22 comms are permitted.

The weirdest part of all is I can't even SSH to the copied VM (VMB) from the server itself (VMB). So if I do a "ssh user@VMB" on VMB, even that fails. The original VMA though, its SSH works just dandy.

I've tried removing the /etc/ssh/ssh_host_*, restarting SSH and have it regenerate whatever certificates or keys it needs, no luck. Nothing's configured in /etc/hosts.deny or /etc/hosts.allow.
I've even tried removing the openssh-server package on there and reinstalling it. Still. No. Luck.

Please let me know if I should post any config files and/ or logfiles as I'm completely stumped by this so far.

Any help appreciated.

Also, I'm not going to be on here again for about 15 hours or so, but please if you have any advice I'd greatly appreciate it and will get back to you. Really, any advice whatsoever. I'll even try the raindance if you think that'll fix it.

Cheers.

EDIT: I guess it's suffice to say that I couldn't spot anything obvious in the /var/log/messages file either. Then again, I am quite tired at the moment so I might have missed something somewhere.

jschiwal · 09-21-2009, 06:36 PM

Using "ssh -vv" should produce useful debugging information on the client side.
Telnet'ing in on port 22 can diagnose network connectivity problems.
Posting /etc/ssh/sshd_config might provide useful information as well.

kinetik · 09-21-2009, 07:51 PM

Quote:

Originally Posted by jschiwal

Using "ssh -vv" should produce useful debugging information on the client side.
Telnet'ing in on port 22 can diagnose network connectivity problems.
Posting /etc/ssh/sshd_config might provide useful information as well.

Ah yes, jschiwal, I've lost count of how many times you've helped me out on this forum.

If you can manage to help me out again this time, I'd seriously have to make a plan to courier you a sixpack of Windhoek Lager.

I'm not close to the server in question at the moment, but I'll post the contents of the sshd_config file as soon as I'm back at the office.

In the meantime though, I can confirm that I'm able to telnet to the VMB server over port 22 and can even see the connection hit when I run a netstat -aln on server VMB.

I've tried the ssh -vv on the server itself as well when I tested ssh-ing from server VMB to VMB, it said something like next allowed connections being GHIS (or something like that), key, password. Shortly after entering the password though, it just gave a permission denied.

Let me get that sshd_config file posted on here though, that should hopefully shed some light.

Cheers

kinetik · 09-22-2009, 08:09 AM

OK, this is getting weirder by the second...

Turns out some of my colleagues can login just fine, using the same version of PuTTy that I am. My OS account in particular though still can't, and neither can root (even though the root account is explicitly set to be able to login).

I'm trying to get that sshd_config file quick, will post it in a sec.

kinetik · 09-22-2009, 10:05 AM

Here's the current config of the SSH Daemon on the server not playing ball:

Quote:

# $OpenBSD: sshd_config,v 1.77 2008/02/08 23:24:07 djm Exp $

# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

# Disable legacy (protocol version 1) support in the server for new
# installations. In future the default will change to require explicit
# activation of protocol 1
Protocol 2

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 768

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no
PasswordAuthentication yes

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
GSSAPICleanupCredentials yes

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM no
#UsePAM yes

# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10
#PermitTunnel no
#ChrootDirectory none

# no default banner path
#Banner none

# override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# ForceCommand cvs server

I've tried with UsePAM No and UsePAM Yes, no luck unfortunately.

kinetik · 09-22-2009, 10:47 AM

Unbelievable, all sorted now.

Here's what the problem was:
The VM itself had a keyboard mapping for UK (not the same as my desktop PC's). When I reset both the root password and my own account's password, it was with liberal use of special characters like @, #, $, % etc.
So the passwords I thought I changed it to weren't the passwords at all, but completely different! That also explains why some accounts could login, but I couldn't.

I feel pretty stupid right about now to say the least.

Anyways, thanks for trying to help me jschiwal, as always I appreciate it.