SSH users
Well it's almost new year and guess who has to re-install his SuSE server because of some security issues. :rolleyes:
Although the good side is that I'm going from SuSE 8.1 to SuSE 10.0. :) Anyway, I'm having a problem with my SSH. It is running and I can connect to it. But when I try to login using a username that exists on the SuSE machine it gives an 'access denied'. How can I give that user the rights to login to SSH? (Makes the configuration of the thing a whole lot easier because the chair @ the desktop computer is much more comforting :cool:) |
Can you post the output of the following please (hostname is the ssh server you are connecting to)?
Code:
ssh -v hostname |
Hmmm, how can I do that from Putty?
(please note: the computer I'm using to connect to the SuSE server is Win XP) But I tried it also @ SuSE and when I tried to SSH to localhost it all went a-ok. So apparently it just won't accept SSH logins from the outside. |
Sorry, I did mean to run the `ssh -v` from your Linux box. From putty, you can turn on logging from Session / Logging / Log SSH packet data.
Have you tried to telnet to the SSH port on the Linux box from the Windows box? If the Suse box were at 192.168.1.5: telnet 192.168.1.5 22 should display the SSH banner on the Linux box - I get `SSH-2.0-OpenSSH_4.2`. If you can't connect then it may be the Windows firewall, the Suse firewall, or the Suse SSH configuration. If it's firewall (packet) related... If you have ethereal running on both boxes, you can check whether the SSH traffic leaving the Windows box arrives at the Suse box, or whether the return traffic leaving the Suse box is getting back to the Windows box. Just restrict ethereal with a `port 22` filter to cut down the data it collects. If it's config related... Are you running your SSH daemon standalone or out of inetd? You can check for ssh in /etc/inetd.conf. If so, look for entries in /etc/hosts.allow or /etc/hosts.deny that restrict remote access to ssh or ALL. Do you have any settings in /etc/ssh_config that aren't global (look for a line beginning with `host`)? Do you have any settings in /etc/sshd_config that limit where the daemon will accept connections (look for lines beginning with ListenAddress)? Sorry it's not more specific help :( |
Quote:
Quote:
(SuSE 10.0 doesn't use inetd.conf, it uses xinetd.conf) Quote:
hosts.deny says: http-rman: ALL EXCEPT LOCAL Quote:
Quote:
listenaddress 0.0.0.0 listenaddress :: But these are also commented out. Keep in mind that I can connect to the server using Putty. But if I insert my login name and the correct password it just gives an access denied. |
jeucken:
It's not a firewall, because you can see the ssh banner when you telnet. I don't think it's /etc/hosts.allow or hosts.deny, because you get a login prompt. It's a simple case of your ssh server not allowing the username you're using to connect to it. Make sure the following is in your /etc/sshd_config file: Code:
AllowUsers user1 user2 user3 Also make sure you DO NOT have the following line in your sshd_config file: Code:
DenyUsers * If you have a "DenyUsers" entry, delete it or adjust it accordingly. Let us know the results. |
Quote:
Quote:
My sshd_config: Code:
# $OpenBSD: sshd_config,v 1.70 2004/12/23 23:11:00 djm Exp $ |
Can I suggest that you change the following lines?
From: Code:
#Protocol 2,1 Code:
Protocol 2 Code:
PasswordAuthentication no Code:
PasswordAuthentication yes Code:
UsePAM yes Code:
UsePAM no |
Quote:
Thanks :) Up to the next problem :) |
Glad to hear it :)
|
I ran into this as well doing a scratch install of SUSE 10. The above solution worked perfectly!
|
All times are GMT -5. The time now is 02:49 PM. |