Hi guys,

I'm stuck on this. I can ssh my target prod server (call it server A), and from there ssh into my repo server (say server B) fine. When I run some scripts that are accessing server B from server A via ssh however they get a a "failed password". Any ideas? What is the difference from server B's perspective how the ssh connection is being established? Here's a tail of the secure.log from Server B for both cases.

---------- server B log when "manually ssh'ing in " -------------------
Feb 6 15:23:18 Macintosh-2 com.apple.SecurityServer[21]: checkpw() succeeded, creating credential for user greg
Feb 6 15:23:18 Macintosh-2 com.apple.SecurityServer[21]: checkpw() succeeded, creating shared credential for user greg
Feb 6 15:23:18 Macintosh-2 com.apple.SecurityServer[21]: Succeeded authorizing right system.login.tty by client /usr/sbin/sshd for authorization created by /usr/sbin/sshd.
Feb 6 15:23:18 Macintosh-2 sshd[2372]: Accepted keyboard-interactive/pam for greg from 10.1.1.1 port 49636 ssh2

--------- server B log when scripts are trying to access ------------
Feb 6 15:23:53 Macintosh-2 sshd[2414]: error: PAM: Authentication failure for greg from home.gregsdomainname.org
Feb 6 15:23:53: --- last message repeated 2 times ---
Feb 6 15:23:53 Macintosh-2 sshd[2414]: Failed password for greg from 10.1.1.1 port 50366 ssh2

Not sure if it's significant, however I acutally trigger the scripts running on Server A from Server B itself. Hence end-to-end it is:

Server A (run capistrano init) ==ssh==> Sever B (run scripts) ====ssh===>Server A

Server B ssh config (/etc/ssh_config)
=========================
Macintosh-2:etc greg$ cat /etc/ssh_config
# Host *
# ForwardAgent no
# ForwardX11 no
# RhostsRSAAuthentication no
# RSAAuthentication yes
PasswordAuthentication yes
# HostbasedAuthentication no
# GSSAPIAuthentication yes
# GSSAPIDelegateCredentials no
# GSSAPIKeyExchange yes
# GSSAPITrustDNS no
# BatchMode no
# CheckHostIP yes
# AddressFamily any
# ConnectTimeout 0
# StrictHostKeyChecking ask
# IdentityFile ~/.ssh/identity
# IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa
# Port 22
# Protocol 2,1
# Cipher 3des
# Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
# EscapeChar ~
# Tunnel no
# TunnelDevice any:any
# PermitLocalCommand no




Thanks

How are you authenticating to server B from within the script? Normally you'd use Pubkey Authentication (with no passphrase) for this purpose.

good question - as I'm using capistrano (www.capify.org) I'm not sure exactly. When I manually ssh across it's just a basic username/password (no keys).

What seems to be happening is (I think), capistrano aids in deploying your application, and effectively you kick it off on your DEV box (call it server DEV). It then uses it own approach to ssh into your PROD server (server A) and run the scripts. In this case it should be running a script on server A that then uses git (git-scm.com) [which itself uses ssh], to ssh to server B (which has the repository) to grab the latest copy of the code.

To complicate things a little:
* My dev box (server DEV) is actually the same box as server B (with repository). Not sure if this is significant.
* I do run two (2) ssh daemons ("sshd" and "sshd_local"). I use "sshd" for external access on a different port and requiring keys, where as "sshd_local" runs on the normal port with basic username/password. I'm not specifying the port for the external "sshd" server so this shouldn't be an issue (I hope).

I don't know what your third-party app is doing, but if it gives you the latitude to configure user authentication, you're going to want to switch to pubkeys. Failing that, double-check the user name and password it's using.

If that's still no good, I would contact the vendors and ask what their app is doing.

yeah - I think I'll focus on getting feedback from the capistrano user group - it's a bit hard to isolate this to being a generic ssh issue at the moment given the variables