Hi there i can't connect to ssh of the fc6 precreated VE this is an example... [root@calvin ~]# ssh root@calvin-fc6 root@calvin-fc6's password: Last login: Tue May 22 11:54:31 2007 from 172.21.17.10 Connection to calvin-fc6 closed. [root@calvin ~]# the connection closes after submitting a password.. is it a PAM problem ? thanks Gianni
can you vzctl enter the VE? If so, what does the ve syslog say?
sure ... this is /var/log/secure May 22 14:42:29 calvin-fc6 sshd[3355]: Accepted password for root from 172.21.17.10 port 33667 ssh2 May 22 14:42:29 calvin-fc6 sshd[3355]: pam_unix(sshd:session): session opened for user root by (uid=0) May 22 14:42:29 calvin-fc6 sshd[3355]: pam_unix(sshd:session): session closed for user root messages says nothing... thanks Gianni
strace -ff `pidof sshd` duplicate problem paste strace output here.
i think there's a different syntax [root@calvin-fc6 log]# pidof sshd 2444 [root@calvin-fc6 log]# /usr/bin/strace -ff `pidof sshd` /usr/bin/strace: 2444: command not found can you help me Thanks Gianni
strace is not installed. to install: yum -y install strace
i don't think so... [root@calvin ~]# vzctl enter 101 entered into VE 101 [root@calvin-fc6 /]# strace usage: strace [-dffhiqrtttTvVxx] [-a column] [-e expr] ... [-o file] [-p pid] ... [-s strsize] [-u username] [-E var=val] ... [command [arg ...]] or: strace -c [-e expr] ... [-O overhead] [-S sortby] [-E var=val] ... [command [arg ...]] -c -- count time, calls, and errors for each syscall and report summary -f -- follow forks, -ff -- with output into separate files -F -- attempt to follow vforks, -h -- print help message -i -- print instruction pointer at time of syscall -q -- suppress messages about attaching, detaching, etc. -r -- print relative timestamp, -t -- absolute timestamp, -tt -- with usecs -T -- print time spent in each syscall, -V -- print version -v -- verbose mode: print unabbreviated argv, stat, termio[s], etc. args -x -- print non-ascii strings in hex, -xx -- print all strings in hex -a column -- alignment COLUMN for printing syscall results (default 40) -e expr -- a qualifying expression: option=[!]all or option=[!]val1[,val2]... options: trace, abbrev, verbose, raw, signal, read, or write -o file -- send trace output to FILE instead of stderr -O overhead -- set overhead for tracing syscalls to OVERHEAD usecs -p pid -- trace process with process id PID, may be repeated -s strsize -- limit length of print strings to STRSIZE chars (default 32) -S sortby -- sort syscall counts by: time, calls, name, nothing (default time) -u username -- run command as username handling setuid and/or setgid -E var=val -- put var=val in the environment for command -E var -- remove var from the environment for command [root@calvin-fc6 /]# strace -ff `pidof sshd` strace: 2444: command not found i tried this... [root@calvin-fc6 /]# strace -ff sshd execve("/usr/sbin/sshd", ["sshd"], [/* 17 vars */]) = 0 brk(0) = 0x80062000 uname({sys="Linux", node="calvin-fc6", ...}) = 0 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=18836, ...}) = 0 mmap2(NULL, 18836, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7eed000 close(3) = 0 open("/usr/lib/libwrap.so.0", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\360\34"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=31376, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7eec000 mmap2(NULL, 32092, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7ee4000 mmap2(0xb7eeb000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7) = 0xb7eeb000 close(3) = 0 open("/lib/libpam.so.0", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\340\31"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=42044, ...}) = 0 mmap2(NULL, 44924, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7ed9000 mmap2(0xb7ee3000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x9) = 0xb7ee3000 close(3) = 0 open("/lib/libdl.so.2", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0000\v\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=14704, ...}) = 0 mmap2(NULL, 12408, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7ed5000 mmap2(0xb7ed7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1) = 0xb7ed7000 close(3) = 0 open("/lib/libselinux.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\0205\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=91896, ...}) = 0 mmap2(NULL, 93016, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7ebe000 mmap2(0xb7ed3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x15) = 0xb7ed3000 close(3) = 0 open("/lib/libaudit.so.0", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0p\32\0\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=75292, ...}) = 0 mmap2(NULL, 78132, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7eaa000 mmap2(0xb7ebc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x11) = 0xb7ebc000 close(3) = 0 open("/lib/libresolv.so.2", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\240!\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=74608, ...}) = 0 mmap2(NULL, 75976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7e97000 mmap2(0xb7ea6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xe) = 0xb7ea6000 mmap2(0xb7ea8000, 6344, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7ea8000 close(3) = 0 open("/lib/libcrypto.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\200\21"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1237420, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7e96000 mmap2(NULL, 1250008, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7d64000 mmap2(0xb7e80000, 73728, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x11c) = 0xb7e80000 mmap2(0xb7e92000, 13016, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7e92000 close(3) = 0 open("/lib/libutil.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\0\v\0\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=13480, ...}) = 0 mmap2(NULL, 12428, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7d60000 mmap2(0xb7d62000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1) = 0xb7d62000 close(3) = 0 open("/usr/lib/libz.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\240\26"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=73836, ...}) = 0 mmap2(NULL, 76656, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7d4d000 mmap2(0xb7d5f000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x11) = 0xb7d5f000 close(3) = 0 open("/lib/libnsl.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\00001\0\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=99252, ...}) = 0 mmap2(NULL, 91944, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7d36000 mmap2(0xb7d49000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x12) = 0xb7d49000 mmap2(0xb7d4b000, 5928, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7d4b000 close(3) = 0 open("/lib/libcrypt.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0P\7\0\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=26052, ...}) = 0 mmap2(NULL, 184636, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7d08000 mmap2(0xb7d0d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4) = 0xb7d0d000 mmap2(0xb7d0f000, 155964, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7d0f000 close(3) = 0 open("/usr/lib/libgssapi_krb5.so.2", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\360<\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=172844, ...}) = 0 mmap2(NULL, 175804, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7cdd000 mmap2(0xb7d07000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x29) = 0xb7d07000 close(3) = 0 open("/usr/lib/libkrb5.so.3", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0000\372"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=557868, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7cdc000 mmap2(NULL, 556612, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7c54000 mmap2(0xb7cda000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x86) = 0xb7cda000 close(3) = 0 open("/usr/lib/libk5crypto.so.3", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\2205\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=155608, ...}) = 0 mmap2(NULL, 155040, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7c2e000 mmap2(0xb7c53000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x25) = 0xb7c53000 close(3) = 0 open("/lib/libcom_err.so.2", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300\10"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=6496, ...}) = 0 mmap2(NULL, 9356, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7c2b000 mmap2(0xb7c2d000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1) = 0xb7c2d000 close(3) = 0 open("/lib/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0p`\1\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1573504, ...}) = 0 mmap2(NULL, 1295780, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7aee000 mmap2(0xb7c25000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x137) = 0xb7c25000 mmap2(0xb7c28000, 9636, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7c28000 close(3) = 0 open("/lib/libsepol.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300/\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=243928, ...}) = 0 mmap2(NULL, 285024, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7aa8000 mmap2(0xb7ae3000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3b) = 0xb7ae3000 mmap2(0xb7ae4000, 39264, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7ae4000 close(3) = 0 open("/usr/lib/libkrb5support.so.0", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0000\24\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=29048, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7aa7000 mmap2(NULL, 31848, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7a9f000 mmap2(0xb7aa6000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6) = 0xb7aa6000 close(3) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7a9e000 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7a9d000 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7a9d6d0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 mprotect(0xb7c25000, 8192, PROT_READ) = 0 mprotect(0xb7d0d000, 4096, PROT_READ) = 0 mprotect(0xb7d49000, 4096, PROT_READ) = 0 mprotect(0xb7d62000, 4096, PROT_READ) = 0 mprotect(0xb7ea6000, 4096, PROT_READ) = 0 mprotect(0xb7ed7000, 4096, PROT_READ) = 0 mprotect(0xb7f0c000, 4096, PROT_READ) = 0 munmap(0xb7eed000, 18836) = 0 access("/etc/selinux/", F_OK) = 0 brk(0) = 0x80062000 brk(0x80083000) = 0x80083000 open("/etc/selinux/config", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) open("/proc/mounts", O_RDONLY|O_LARGEFILE) = 3 fstat64(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ef1000 read(3, "simfs / simfs rw 0 0\nproc /proc "..., 1024) = 122 read(3, "", 1024) = 0 close(3) = 0 munmap(0xb7ef1000, 4096) = 0 geteuid32() = 0 setgroups32(0, []) = 0 open("/dev/null", O_RDWR|O_LARGEFILE) = 3 close(3) = 0 write(2, "sshd re-exec requires execution "..., 55sshd re-exec requires execution with an absolute path ) = 55 exit_group(255) = ? Process 3461 detached [root@calvin-fc6 /]#
strace -ff -p `pidof sshd` final answer
are you sure ? [root@calvin ~]# service vz status OpenVZ is running... [root@calvin ~]# vzlist VE not found [root@calvin ~]# vzlist 101 VEID NPROC STATUS IP_ADDR HOSTNAME 101 - stopped 172.21.17.31 calvin-fc6 [root@calvin ~]# vzstart 101 -bash: vzstart: command not found [root@calvin ~]# vzctl start 101 Starting VE ... VE is mounted Adding IP address(es): 172.21.17.31 Setting CPU units: 1000 Set hostname: calvin-fc6 VE start in progress... [root@calvin ~]# vzlist 101 VEID NPROC STATUS IP_ADDR HOSTNAME 101 11 running 172.21.17.31 calvin-fc6 [root@calvin ~]# vzctl enter 101 entered into VE 101 [root@calvin-fc6 /]# strace -ff -p `pidof sshd` attach: ptrace(PTRACE_ATTACH, ...): No such process [root@calvin-fc6 /]# service sshd status sshd (pid 351) is running... [root@calvin-fc6 /]# pidof sshd 351 [root@calvin-fc6 /]# strace -ff -p 351 attach: ptrace(PTRACE_ATTACH, ...): No such process [root@calvin-fc6 /]# thanks Gianni
the strace syntax is correct, i suspect "pidof" is not. "ps ax | grep sshd", does it show 351 or the same pid that pidof does?
[root@calvin-fc6 /]# pidof sshd 351 [root@calvin-fc6 /]# ps aux | grep sshd root 351 0.0 0.0 5184 928 ? Ss 08:36 0:00 /usr/sbin/sshd root 556 0.0 0.0 1800 496 pts/0 R+ 10:27 0:00 grep sshd [root@calvin-fc6 /]# Thanks Gianni
Could you please show all output of: echo; \ echo "----------------------------------------"; \ echo "------ id ------"; \ id; \ echo "------ /proc/user_beancounters ------"; \ echo "---cut here--- {"; \ cat /proc/user_beancounters; \ echo "---cut here--- }"; \ echo "------ ll ~/.ssh/ ------"; \ ll ~/.ssh/; \ echo "------ cat /etc/ssh/sshd_config ------"; \ echo "---cut here--- {"; \ cat /etc/ssh/sshd_config; \ echo "---cut here--- }"; \ echo "------ cat /etc/hosts.allow ------"; \ echo "---cut here--- {"; \ cat /etc/hosts.allow; \ echo "---cut here--- }"; \ echo "----------------------------------------"; \ echo
---------------------------------------- ------ id ------ uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(whe el) ------ /proc/user_beancounters ------ ---cut here--- { Version: 2.5 uid resource held maxheld barrier limit failcnt 101: kmemsize 912166 1053618 2752512 2936012 0 lockedpages 0 0 32 32 0 privvmpages 3665 9818 49152 53575 0 shmpages 31 31 8192 8192 0 dummy 0 0 0 0 0 numproc 16 19 65 65 0 physpages 2252 2767 0 2147483647 0 vmguarpages 0 0 6144 2147483647 0 oomguarpages 2252 2767 6144 2147483647 0 numtcpsock 4 4 80 80 0 numflock 5 6 100 110 0 numpty 1 1 16 16 0 numsiginfo 0 3 256 256 0 tcpsndbuf 0 0 319488 524288 0 tcprcvbuf 0 0 319488 524288 0 othersockbuf 8944 22360 132096 336896 0 dgramrcvbuf 0 8380 132096 132096 0 numothersock 9 16 80 80 0 dcachesize 0 0 1048576 1097728 0 numfile 439 503 2048 2048 0 dummy 0 0 0 0 0 dummy 0 0 0 0 0 dummy 0 0 0 0 0 numiptent 0 0 128 128 0 ---cut here--- } ------ ll ~/.ssh/ ------ pippo.sh: line 10: ll: command not found ------ cat /etc/ssh/sshd_config ------ ---cut here--- { # $OpenBSD: sshd_config,v 1.73 2005/12/06 22:38:28 reyk Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options change a # default value. #Port 22 #Protocol 2,1 Protocol 2 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress :: # HostKey for protocol version 1 #HostKey /etc/ssh/ssh_host_key # HostKeys for protocol version 2 #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_dsa_key # Lifetime and size of ephemeral version 1 server key #KeyRegenerationInterval 1h #ServerKeyBits 768 # Logging # obsoletes QuietMode and FascistLogging #SyslogFacility AUTH SyslogFacility AUTHPRIV #LogLevel INFO # Authentication: #LoginGraceTime 2m #PermitRootLogin yes #StrictModes yes #MaxAuthTries 6 #RSAAuthentication yes #PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #RhostsRSAAuthentication no # similar for protocol version 2 #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # RhostsRSAAuthentication and HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes # To disable tunneled clear text passwords, change to no here! #PasswordAuthentication yes #PermitEmptyPasswords no PasswordAuthentication yes # Change to no to disable s/key passwords #ChallengeResponseAuthentication yes ChallengeResponseAuthentication no # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no # GSSAPI options #GSSAPIAuthentication no GSSAPIAuthentication yes #GSSAPICleanupCredentials yes GSSAPICleanupCredentials yes # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication mechanism. # Depending on your PAM configuration, this may bypass the setting of # PasswordAuthentication, PermitEmptyPasswords, and # "PermitRootLogin without-password". If you just want the PAM account and # session checks to run without PAM authentication, then enable this but set # ChallengeResponseAuthentication=no #UsePAM no UsePAM yes # Accept locale-related environment variables AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL #AllowTcpForwarding yes #GatewayPorts no #X11Forwarding no X11Forwarding yes #X11DisplayOffset 10 #X11UseLocalhost yes #PrintMotd yes #PrintLastLog yes #TCPKeepAlive yes #UseLogin no #UsePrivilegeSeparation yes #PermitUserEnvironment no #Compression delayed #ClientAliveInterval 0 #ClientAliveCountMax 3 #ShowPatchLevel no #UseDNS yes #PidFile /var/run/sshd.pid #MaxStartups 10 #PermitTunnel no # no default banner path #Banner /some/path # override default of no subsystems Subsystem sftp /usr/libexec/openssh/sftp-server ---cut here--- } ------ cat /etc/hosts.allow ------ ---cut here--- { # # hosts.allow This file describes the names of the hosts which are # allowed to use the local INET services, as decided # by the '/usr/sbin/tcpd' server. # ---cut here--- } ---------------------------------------- [root@calvin-fc6 /]#
------------------------------------------------ ------------ id ------------ uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(whe el) ------------ cat /etc/pam.d/sshd ------------ #%PAM-1.0 auth include system-auth account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so ------------ ls -l ~/.ssh/ ------------ total 4 -rw-r--r-- 1 root root 398 May 21 17:11 known_hosts ------------ cat ~/.bashrc ------------ # .bashrc # User specific aliases and functions alias rm='rm -i' alias cp='cp -i' alias mv='mv -i' # Source global definitions if [ -f /etc/bashrc ]; then . /etc/bashrc fi ------------ cat ~/.bash_profile ------------ # .bash_profile # Get the aliases and functions if [ -f ~/.bashrc ]; then . ~/.bashrc fi # User specific environment and startup programs PATH=$PATH:$HOME/bin export PATH unset USERNAME ------------ cat /etc/securetty ------------ console vc/1 vc/2 vc/3 vc/4 vc/5 vc/6 vc/7 vc/8 vc/9 vc/10 vc/11 tty1 tty2 tty3 tty4 tty5 tty6 tty7 tty8 tty9 tty10 tty11 ------------------------------------------------ [root@calvin-fc6 /]#
thanks, Is your sshd from rpm or it was built custom? also, you should uncomment next line: "PermitRootLogin yes" in your /etc/ssh/sshd_config file and restart sshd server (# service sshd restart) Regards, Roman.
[root@calvin-fc6 /]# ne /etc/ssh/sshd_config [root@calvin-fc6 /]# service sshd restart Stopping sshd: [ OK ] Starting sshd: [ OK ] [root@calvin-fc6 /]# exit logout exited from VE 101 [root@calvin ~]# ssh root@172.21.17.31 root@172.21.17.31's password: Permission denied, please try again. root@172.21.17.31's password: Last login: Tue May 22 14:42:29 2007 from 172.21.17.10 Connection to 172.21.17.31 closed. ------------------------------------------------------------ ------ i took the image from http://download.openvz.org/template/precreated/fedora-core-6 -i686-default.tar.gz I made a yum to update the packets Thanks Gianni
don't give up, continue investigation echo; \ echo "---------------------------------------"; \ echo "------- cat /etc/nologin ------"; \ [ -r /etc/nologin ] && cat /etc/nologin; \ echo "------- cat /etc/ssh/denyusers ------"; \ [ -r /etc/ssh/denyusers ] && cat /etc/ssh/denyusers; \ echo "------- dmesg | grep -i selinux ------"; \ dmesg | grep -i selinux; \ echo "---------------------------------------"; \ echo
[root@calvin ~]# ssh root@calvin-fc6 "pwd;ps -Af;ls -l;"
[root@calvin ~]# ssh root@calvin-fc6 "pwd;ps -Af;ls -l;" root@calvin-fc6's password: [root@calvin ~]# ssh root@calvin-fc6 "pwd;ps -Af;ls -l;" root@calvin-fc6's password: [root@calvin ~]# ssh root@calvin-fc6 root@calvin-fc6's password: Last login: Wed May 23 13:58:09 2007 from 172.21.17.10 Connection to calvin-fc6 closed. [root@calvin ~]#
*ON VE* echo; \ grep "^root" /etc/passwd; \ ls -l /bin/bash; \ ls -l /bin/sh; \ echo;
root:x:0:0:root:/root:/bin/bash -rwxr-xr-x 1 root root 716972 Jul 12 2006 /bin/bash lrwxrwxrwx 1 root root 4 May 21 16:24 /bin/sh -> bash
rpm -qV openssh-server bash util-linux
[root@calvin-fc6 /]# rpm -qV openssh-server bash util-linux S.5....T c /etc/ssh/sshd_config !!!! is there no Bash installed ???
-------------- >!!!! >is there no Bash installed ??? all ok, bash installed "rpm -qV" show modified files for package. (it look at checksum) >root:x:0:0:root:/root:/bin/bash >-rwxr-xr-x 1 root root 716972 Jul 12 2006 /bin/bash >lrwxrwxrwx 1 root root 4 May 21 16:24 /bin/sh -> bash >[root@calvin-fc6 /]# rpm -qV openssh-server bash util-linux >S.5....T c /etc/ssh/sshd_config -------------- ls -l /dev/pty* | head -n 5
[root@calvin-fc6 /]# ls -l /dev/pty* | head -n 5 crw-rw-rw- 1 root tty 2, 176 Apr 13 2006 /dev/ptya0 crw-rw-rw- 1 root tty 2, 177 Apr 13 2006 /dev/ptya1 crw-rw-rw- 1 root tty 2, 178 Apr 13 2006 /dev/ptya2 crw-rw-rw- 1 root tty 2, 179 Apr 13 2006 /dev/ptya3 crw-rw-rw- 1 root tty 2, 180 Apr 13 2006 /dev/ptya4 [root@calvin-fc6 /]#
*ON HW NODE* echo; \ echo "------ lsmod | grep slm ------"; \ lsmod | grep slm; \ echo "------ dmesg ------"; \ dmesg; \ echo;
[root@calvin ~]# ------ lsmod | grep slm ------ ------ dmesg ------ Linux version 2.6.20-ovz005.1 (root@centos-32-build) (gcc version 3.4.4 20050721 (Red Hat 3.4.4-2)) #1 SMP Thu Apr 19 15:14:08 MSD 2007 BIOS-provided physical RAM map: sanitize start sanitize end copy_e820_map() start: 0000000000000000 size: 000000000009fc00 end: 000000000009fc00 type: 1 copy_e820_map() type is E820_RAM copy_e820_map() start: 000000000009fc00 size: 0000000000000400 end: 00000000000a0000 type: 2 copy_e820_map() start: 00000000000f0000 size: 0000000000010000 end: 0000000000100000 type: 2 copy_e820_map() start: 0000000000100000 size: 000000003fef0000 end: 000000003fff0000 type: 1 copy_e820_map() type is E820_RAM copy_e820_map() start: 000000003fff0000 size: 0000000000003000 end: 000000003fff3000 type: 4 copy_e820_map() start: 000000003fff3000 size: 000000000000d000 end: 0000000040000000 type: 3 copy_e820_map() start: 00000000ffb00000 size: 0000000000500000 end: 0000000100000000 type: 2 BIOS-e820: 0000000000000000 - 000000000009fc00 (usable) BIOS-e820: 000000000009fc00 - 00000000000a0000 (reserved) BIOS-e820: 00000000000f0000 - 0000000000100000 (reserved) BIOS-e820: 0000000000100000 - 000000003fff0000 (usable) BIOS-e820: 000000003fff0000 - 000000003fff3000 (ACPI NVS) BIOS-e820: 000000003fff3000 - 0000000040000000 (ACPI data) BIOS-e820: 00000000ffb00000 - 0000000100000000 (reserved) 127MB HIGHMEM available. 896MB LOWMEM available. Entering add_active_range(0, 0, 262128) 0 entries of 256 used Zone PFN ranges: DMA 0 -> 4096 Normal 4096 -> 229376 HighMem 229376 -> 262128 early_node_map[1] active PFN ranges 0: 0 -> 262128 On node 0 totalpages: 262128 DMA zone: 36 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4060 pages, LIFO batch:0 Normal zone: 1980 pages used for memmap Normal zone: 223300 pages, LIFO batch:31 HighMem zone: 287 pages used for memmap HighMem zone: 32465 pages, LIFO batch:7 DMI 2.3 present. Using APIC driver default ACPI: RSDP (v000 IntelR ) @ 0x000f68a0 ACPI: RSDT (v001 IntelR AWRDACPI 0x42302e31 AWRD 0x00000000) @ 0x3fff3000 ACPI: FADT (v001 IntelR AWRDACPI 0x42302e31 AWRD 0x00000000) @ 0x3fff3040 ACPI: DSDT (v001 INTELR AWRDACPI 0x00001000 MSFT 0x0100000c) @ 0x00000000 ACPI: PM-Timer IO Port: 0x408 Allocating PCI resources starting at 50000000 (gap: 40000000:bfb00000) Detected 1799.854 MHz processor. Built 1 zonelists. Total pages: 259825 Kernel command line: ro root=LABEL=/ rhgb quiet Local APIC disabled by BIOS -- you can enable it with "lapic" mapped APIC to ffffd000 (0190c000) Enabling fast FPU save and restore... done. Enabling unmasked SIMD FPU exception support... done. Initializing CPU#0 CPU 0 irqstacks, hard=c0763000 soft=c0743000 PID hash table entries: 4096 (order: 12, 16384 bytes) Console: colour VGA+ 80x25 Dentry cache hash table entries: 131072 (order: 7, 524288 bytes) Inode-cache hash table entries: 65536 (order: 6, 262144 bytes) Memory: 1031988k/1048512k available (2103k kernel code, 15700k reserved, 937k data, 256k init, 131008k highmem) virtual kernel memory layout: fixmap : 0xffc56000 - 0xfffff000 (3748 kB) pkmap : 0xff800000 - 0xffc00000 (4096 kB) vmalloc : 0xf8800000 - 0xff7fe000 ( 111 MB) lowmem : 0xc0000000 - 0xf8000000 ( 896 MB) .init : 0xc06fe000 - 0xc073e000 ( 256 kB) .data : 0xc060df4f - 0xc06f8594 ( 937 kB) .text : 0xc0400000 - 0xc060df4f (2103 kB) Checking if this processor honours the WP bit even in supervisor mode... Ok. Calibrating delay using timer specific routine.. 3601.84 BogoMIPS (lpj=1800923) Mount-cache hash table entries: 512 CPU: After generic identify, caps: 3febf9ff 00000000 00000000 00000000 00000000 00000000 00000000 CPU: Trace cache: 12K uops, L1 D cache: 8K CPU: L2 cache: 512K CPU: Hyper-Threading is disabled CPU: After all inits, caps: 3febf9ff 00000000 00000000 00003080 00000000 00000000 00000000 Intel machine check architecture supported. Intel machine check reporting enabled on CPU#0. CPU0: Intel P4/Xeon Extended MCE MSRs (12) available CPU0: Thermal monitoring enabled Checking 'hlt' instruction... OK. SMP alternatives: switching to UP code Freeing SMP alternatives: 14k freed ACPI: Core revision 20060707 ACPI: setting ELCR to 0200 (from 0e20) Page beancounter hash is 65536 entries. CPU0: Intel(R) Pentium(R) 4 CPU 1.80GHz stepping 04 SMP motherboard not detected. Local APIC not detected. Using dummy APIC emulation. Brought up 1 CPUs NET: Registered protocol family 16 No dock devices found. ACPI: bus type pci registered PCI: PCI BIOS revision 2.10 entry at 0xfb1a0, last bus=2 PCI: Using configuration type 1 Setting up standard PCI resources ACPI: Interpreter enabled ACPI: Using PIC for interrupt routing ACPI: PCI Root Bridge [PCI0] (0000:00) PCI: Probing PCI hardware (bus 00) PCI quirk: region 0400-047f claimed by ICH4 ACPI/GPIO/TCO PCI quirk: region 0480-04bf claimed by ICH4 GPIO 0000:00:1f.1: cannot adjust BAR0 (not I/O) 0000:00:1f.1: cannot adjust BAR1 (not I/O) 0000:00:1f.1: cannot adjust BAR2 (not I/O) 0000:00:1f.1: cannot adjust BAR3 (not I/O) PCI: Firmware left 0000:02:06.0 e100 interrupts enabled, disabling PCI: Firmware left 0000:02:07.0 e100 interrupts enabled, disabling Boot video device is 0000:02:08.0 PCI: Transparent bridge - 0000:00:1e.0 ACPI: PCI Interrupt Routing Table [\_SB_.PCI0._PRT] ACPI: PCI Interrupt Routing Table [\_SB_.PCI0.HUB0._PRT] ACPI: PCI Interrupt Link [LNKA] (IRQs 3 4 5 6 7 9 10 11 12 14 15) *0, disabled. ACPI: PCI Interrupt Link [LNKB] (IRQs 3 4 *5 6 7 9 10 11 12 14 15) ACPI: PCI Interrupt Link [LNKC] (IRQs 3 4 5 6 7 9 10 11 12 14 15) *0, disabled. ACPI: PCI Interrupt Link [LNKD] (IRQs 3 4 5 6 7 9 10 *11 12 14 15) ACPI: PCI Interrupt Link [LNKE] (IRQs 3 4 5 6 7 9 10 *11 12 14 15) ACPI: PCI Interrupt Link [LNKF] (IRQs 3 4 5 6 7 9 *10 11 12 14 15) ACPI: PCI Interrupt Link [LNK0] (IRQs 3 4 5 6 7 9 10 11 12 14 15) *0, disabled. ACPI: PCI Interrupt Link [LNK1] (IRQs 3 4 5 6 7 *9 10 11 12 14 15) Linux Plug and Play Support v0.97 (c) Adam Belay pnp: PnP ACPI init pnp: PnP ACPI: found 14 devices usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb PCI: Using ACPI for IRQ routing PCI: If a device doesn't work, try "pci=routeirq". If it helps, post a report PCI: Bridge: 0000:00:01.0 IO window: disabled. MEM window: disabled. PREFETCH window: disabled. PCI: Bridge: 0000:00:1e.0 IO window: c000-cfff MEM window: e4000000-e6ffffff PREFETCH window: 50000000-502fffff PCI: Setting latency timer of device 0000:00:1e.0 to 64 NET: Registered protocol family 2 IP route cache hash table entries: 32768 (order: 5, 131072 bytes) TCP established hash table entries: 131072 (order: 8, 1048576 bytes) TCP bind hash table entries: 65536 (order: 7, 524288 bytes) TCP: Hash tables configured (established 131072 bind 65536) TCP reno registered checking if image is initramfs... it is Freeing initrd memory: 1487k freed apm: BIOS version 1.2 Flags 0x07 (Driver version 1.16ac) apm: overridden by ACPI. audit: initializing netlink socket (disabled) audit(1179902163.752:1): initialized highmem bounce pool size: 64 pages Total HugeTLB memory allocated, 0 VFS: Disk quotas dquot_6.5.1 Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) io scheduler noop registered io scheduler anticipatory registered io scheduler deadline registered io scheduler cfq registered (default) pci_hotplug: PCI Hot Plug PCI Core version: 0.5 ACPI: Fan [FAN] (on) ACPI: Processor [CPU0] (supports 2 throttling states) ACPI: Thermal Zone [THRM] (23 C) Real Time Clock Driver v1.12ac Non-volatile memory driver v1.2 Linux agpgart interface v0.101 (c) Dave Jones agpgart: Detected an Intel i845 Chipset. agpgart: AGP aperture is 64M @ 0xe0000000 Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing enabled serial8250: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A serial8250: ttyS1 at I/O 0x2f8 (irq = 3) is a 16550A 00:09: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A 00:0a: ttyS1 at I/O 0x2f8 (irq = 3) is a 16550A RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize Uniform Multi-Platform E-IDE driver Revision: 7.00alpha2 ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx ICH2: IDE controller at PCI slot 0000:00:1f.1 ICH2: chipset revision 18 ICH2: not 100% native mode: will probe irqs later ide0: BM-DMA at 0xf000-0xf007, BIOS settings: hda:DMA, hdb:pio ide1: BM-DMA at 0xf008-0xf00f, BIOS settings: hdc:DMA, hdd:pio Probing IDE interface ide0... hda: Maxtor 6E040L0, ATA DISK drive ide0 at 0x1f0-0x1f7,0x3f6 on irq 14 Probing IDE interface ide1... hdc: MATSHITA CR-177, ATAPI CD/DVD-ROM drive ide1 at 0x170-0x177,0x376 on irq 15 hda: max request size: 128KiB hda: 80293248 sectors (41110 MB) w/2048KiB Cache, CHS=65535/16/63, UDMA(100) hda: cache flushes supported hda: hda1 hda2 ide-floppy driver 0.99.newide usbcore: registered new interface driver hiddev usbcore: registered new interface driver usbhid drivers/usb/input/hid-core.c: v2.6:USB HID core driver PNP: PS/2 Controller [PNP0303:PS2K,PNP0f13:PS2M] at 0x60,0x64 irq 1,12 serio: i8042 KBD port at 0x60,0x64 irq 1 serio: i8042 AUX port at 0x60,0x64 irq 12 mice: PS/2 mouse device common for all mice TCP bic registered Initializing XFRM netlink socket NET: Registered protocol family 1 NET: Registered protocol family 17 Using IPI Shortcut mode Time: tsc clocksource has been installed. Freeing unused kernel memory: 256k freed Write protecting the kernel read-only data: 615k USB Universal Host Controller Interface driver v3.0 ACPI: PCI Interrupt Link [LNKD] enabled at IRQ 11 PCI: setting IRQ 11 as level-triggered ACPI: PCI Interrupt 0000:00:1f.2[D] -> Link [LNKD] -> GSI 11 (level, low) -> IRQ 11 PCI: Setting latency timer of device 0000:00:1f.2 to 64 uhci_hcd 0000:00:1f.2: UHCI Host Controller uhci_hcd 0000:00:1f.2: new USB bus registered, assigned bus number 1 uhci_hcd 0000:00:1f.2: irq 11, io base 0x0000d000 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected ACPI: PCI Interrupt Link [LNK1] enabled at IRQ 9 PCI: setting IRQ 9 as level-triggered ACPI: PCI Interrupt 0000:00:1f.4[C] -> Link [LNK1] -> GSI 9 (level, low) -> IRQ 9 PCI: Setting latency timer of device 0000:00:1f.4 to 64 uhci_hcd 0000:00:1f.4: UHCI Host Controller uhci_hcd 0000:00:1f.4: new USB bus registered, assigned bus number 2 uhci_hcd 0000:00:1f.4: irq 9, io base 0x0000d800 usb usb2: configuration #1 chosen from 1 choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI) SCSI subsystem initialized libata version 2.00 loaded. kjournald starting. Commit interval 5 seconds EXT3-fs: mounted filesystem with ordered data mode. input: ImPS/2 Generic Wheel Mouse as /class/input/input0 input: AT Translated Set 2 keyboard as /class/input/input1 parport: PnPBIOS parport detected. parport0: PC-style at 0x378 (0x778), irq 7 [PCSPP,TRISTATE,EPP] e100: Intel(R) PRO/100 Network Driver, 3.5.17-k2-NAPI e100: Copyright(c) 1999-2006 Intel Corporation ACPI: PCI Interrupt Link [LNKF] enabled at IRQ 10 PCI: setting IRQ 10 as level-triggered ACPI: PCI Interrupt 0000:02:06.0[A] -> Link [LNKF] -> GSI 10 (level, low) -> IRQ 10 e100: eth0: e100_probe: addr 0xe6204000, irq 10, MAC addr 00:30:48:51:01:C7 ACPI: PCI Interrupt Link [LNKE] enabled at IRQ 11 ACPI: PCI Interrupt 0000:02:07.0[A] -> Link [LNKE] -> GSI 11 (level, low) -> IRQ 11 e100: eth1: e100_probe: addr 0xe6205000, irq 11, MAC addr 00:30:48:51:01:C6 intel_rng: FWH not detected input: PC Speaker as /class/input/input2 ACPI: PCI Interrupt Link [LNKB] enabled at IRQ 5 PCI: setting IRQ 5 as level-triggered ACPI: PCI Interrupt 0000:00:1f.3[B] -> Link [LNKB] -> GSI 5 (level, low) -> IRQ 5 hdc: ATAPI 24X CD-ROM drive, 128kB Cache, UDMA(33) Uniform CD-ROM driver Revision: 3.20 ACPI: PCI Interrupt 0000:02:01.0[A] -> Link [LNKB] -> GSI 5 (level, low) -> IRQ 5 skge 1.9 addr 0xe6200000 irq 5 chip Yukon rev 1 skge eth2: addr 00:0a:5e:1a:35:cd Floppy drive(s): fd0 is 1.44M FDC 0 is a post-1991 82077 lp0: using parport0 (interrupt-driven). lp0: console ready sonypi: Sony Programmable I/O Controller Driver v1.26. input: Power Button (FF) as /class/input/input3 ACPI: Power Button (FF) [PWRF] input: Power Button (CM) as /class/input/input4 ACPI: Power Button (CM) [PWRB] ibm_acpi: ec object not found md: Autodetecting RAID arrays. md: autorun ... md: ... autorun DONE. device-mapper: ioctl: 4.11.0-ioctl (2006-10-12) initialised: dm-devel@redhat.com device-mapper: multipath: version 1.0.5 loaded EXT3 FS on hda1, internal journal Adding 2096472k swap on /dev/hda2. Priority:-1 extents:1 across:2096472k NET: Registered protocol family 10 lo: Disabled Privacy Extensions skge eth2: enabling interface ADDRCONF(NETDEV_UP): eth2: link is not ready skge eth2: Link is up at 1000 Mbps, full duplex, flow control both ADDRCONF(NETDEV_CHANGE): eth2: link becomes ready ip_tables: (C) 2000-2006 Netfilter Core Team eth2: no IPv6 routers present VE: 101: started lo: Disabled Privacy Extensions [root@calvin ~]#
* from VE * 1) please create non superuser user on VE and try to use it name for connect. 2) please try to connect to localhost from VE (from VE: ssh root@localhost and non_su_user@localhost) I smoke and thinking come back in 7 min.
- non superuser [root@calvin ~]# ssh gia_bass@172.21.17.31 gia_bass@172.21.17.31's password: Last login: Tue May 22 14:25:59 2007 from 172.21.17.10 Connection to 172.21.17.31 closed. [root@calvin ~]# - from localhost (seems ok) [root@calvin-fc6 /]# ssh root@localhost root@localhost's password: Last login: Wed May 23 15:19:15 2007 from calvin-fc6 [root@calvin-fc6 ~]# who root pts/1 May 23 15:19 (calvin-fc6) [root@calvin-fc6 ~]#
good, *FROM HW* ip a l ip r l *FROM VE* ip a l ip r l try to update your /etc/ssh/sshd_config and restart sshd service: ------------------ UsePAM no UsePrivilegeSeparation yes ------------------ >- non superuser > >[root@calvin ~]# ssh gia_bass@172.21.17.31 >gia_bass@172.21.17.31's password: >Last login: Tue May 22 14:25:59 2007 from 172.21.17.10 >Connection to 172.21.17.31 closed. >[root@calvin ~]# > >- from localhost (seems ok) >[root@calvin-fc6 /]# ssh root@localhost >root@localhost's password: >Last login: Wed May 23 15:19:15 2007 from calvin-fc6 >[root@calvin-fc6 ~]# who >root pts/1 May 23 15:19 (calvin-fc6) >[root@calvin-fc6 ~]#
from HW [root@calvin ~]# ip a l 2: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 4: eth0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1000 link/ether 00:30:48:51:01:c7 brd ff:ff:ff:ff:ff:ff 6: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1000 link/ether 00:30:48:51:01:c6 brd ff:ff:ff:ff:ff:ff 8: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000 link/ether 00:0a:5e:1a:35:cd brd ff:ff:ff:ff:ff:ff inet 172.21.17.10/19 brd 172.21.31.255 scope global eth2 inet6 fe80::20a:5eff:fe1a:35cd/64 scope link valid_lft forever preferred_lft forever 1: venet0: <BROADCAST,POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue link/void from VE [root@calvin-fc6 /]# ip a l 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 3: venet0: <BROADCAST,POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue link/void inet 127.0.0.1/32 scope host venet0 inet 172.21.17.31/32 brd 172.21.17.31 scope global venet0:0 in VE I changed /etc/ssh/sshd_config and restarted [root@calvin ~]# ssh root@172.21.17.31 root@172.21.17.31's password: Last login: Wed May 23 15:19:35 2007 from calvin-fc6 Connection to 172.21.17.31 closed. [root@calvin ~]#
* FROM HW* ip r l * FROM VE* ip r l
[root@calvin ~]# ip r l 172.21.17.31 dev venet0 scope link 172.21.0.0/19 dev eth2 proto kernel scope link src 172.21.17.10 169.254.0.0/16 dev eth2 scope link default via 172.21.1.1 dev eth2 [root@calvin ~]# vzctl enter 101 entered into VE 101 [root@calvin-fc6 /]# ip r l 192.0.2.0/24 dev venet0 scope host 169.254.0.0/16 dev venet0 scope link default via 192.0.2.1 dev venet0 [root@calvin-fc6 /]#
*FROM HW* cat /etc/ssh/ssh_config
if it can be useful on the same Hw I have FC5 and centos 5 that are working exited from VE 101 [root@calvin ~]# cat /etc/ssh/ssh_config # $OpenBSD: ssh_config,v 1.21 2005/12/06 22:38:27 reyk Exp $ # This is the ssh client system-wide configuration file. See # ssh_config(5) for more information. This file provides defaults for # users, and the values can be changed in per-user configuration files # or on the command line. # Configuration data is parsed as follows: # 1. command line options # 2. user-specific file # 3. system-wide file # Any configuration value is only changed the first time it is set. # Thus, host-specific definitions should be at the beginning of the # configuration file, and defaults at the end. # Site-wide defaults for some commonly used options. For a comprehensive # list of available options, their meanings and defaults, please see the # ssh_config(5) man page. # Host * # ForwardAgent no # ForwardX11 no # RhostsRSAAuthentication no # RSAAuthentication yes # PasswordAuthentication yes # HostbasedAuthentication no # BatchMode no # CheckHostIP yes # AddressFamily any # ConnectTimeout 0 # StrictHostKeyChecking ask # IdentityFile ~/.ssh/identity # IdentityFile ~/.ssh/id_rsa # IdentityFile ~/.ssh/id_dsa # Port 22 # Protocol 2,1 # Cipher 3des # Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192- cbc,aes256-cbc # EscapeChar ~ # Tunnel no # TunnelDevice any:any # PermitLocalCommand no Host * GSSAPIAuthentication yes # If this option is set to yes then remote X11 clients will have full access # to the original X11 display. As virtually no X11 client supports the untrusted # mode correctly we set this to yes. ForwardX11Trusted yes # Send locale-related environment variables SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT SendEnv LC_IDENTIFICATION LC_ALL [root@calvin ~]#
try connect again from HW -> VE as root, but please add -vvv for ssh *FROM HW* ssh -vvv root@172.21.17.31
[root@calvin ~]# ssh -vvv root@172.21.17.31 OpenSSH_4.3p2, OpenSSL 0.9.8b 04 May 2006 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug2: ssh_connect: needpriv 0 debug1: Connecting to 172.21.17.31 [172.21.17.31] port 22. debug1: Connection established. debug1: permanently_set_uid: 0/0 debug1: identity file /root/.ssh/identity type -1 debug1: identity file /root/.ssh/id_rsa type -1 debug1: identity file /root/.ssh/id_dsa type -1 debug1: Remote protocol version 2.0, remote software version OpenSSH_4.3 debug1: match: OpenSSH_4.3 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_4.3 debug2: fd 3 setting O_NONBLOCK debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sh a1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcf our256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcf our256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sh a1,diffie-hellman-group1-sha1 debug2: kex_parse_kexinit: ssh-rsa,ssh-dss debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcf our256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcf our256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96 debug2: kex_parse_kexinit: none,zlib@openssh.com debug2: kex_parse_kexinit: none,zlib@openssh.com debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: mac_init: found hmac-md5 debug1: kex: server->client aes128-cbc hmac-md5 none debug2: mac_init: found hmac-md5 debug1: kex: client->server aes128-cbc hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug2: dh_gen_key: priv key bits set: 128/256 debug2: bits set: 523/1024 debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug3: check_host_in_hostfile: filename /root/.ssh/known_hosts debug3: check_host_in_hostfile: match line 6 debug1: Host '172.21.17.31' is known and matches the RSA host key. debug1: Found key in /root/.ssh/known_hosts:6 debug2: bits set: 517/1024 debug1: ssh_rsa_verify: signature correct debug2: kex_derive_keys debug2: set_newkeys: mode 1 debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug2: set_newkeys: mode 0 debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug2: key: /root/.ssh/identity ((nil)) debug2: key: /root/.ssh/id_rsa ((nil)) debug2: key: /root/.ssh/id_dsa ((nil)) debug1: Authentications that can continue: publickey,gssapi-with-mic,password debug3: start over, passed a different list publickey,gssapi-with-mic,password debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password debug3: authmethod_lookup gssapi-with-mic debug3: remaining preferred: publickey,keyboard-interactive,password debug3: authmethod_is_enabled gssapi-with-mic debug1: Next authentication method: gssapi-with-mic debug3: Trying to reverse map address 172.21.17.31. debug1: An invalid name was supplied Cannot determine realm for numeric host address debug1: An invalid name was supplied Cannot determine realm for numeric host address debug1: An invalid name was supplied Cannot determine realm for numeric host address debug2: we did not send a packet, disable method debug3: authmethod_lookup publickey debug3: remaining preferred: keyboard-interactive,password debug3: authmethod_is_enabled publickey debug1: Next authentication method: publickey debug1: Trying private key: /root/.ssh/identity debug3: no such identity: /root/.ssh/identity debug1: Trying private key: /root/.ssh/id_rsa debug3: no such identity: /root/.ssh/id_rsa debug1: Trying private key: /root/.ssh/id_dsa debug3: no such identity: /root/.ssh/id_dsa debug2: we did not send a packet, disable method debug3: authmethod_lookup password debug3: remaining preferred: ,password debug3: authmethod_is_enabled password debug1: Next authentication method: password root@172.21.17.31's password: debug1: Next authentication method: password root@172.21.17.31's password: debug3: packet_send2: adding 64 (len 57 padlen 7 extra_pad 64) debug2: we sent a password packet, wait for reply Connection closed by UNKNOWN
hm.. It is very strange, looks like all ok, could you please upgrade openssh-server on your VE, if it is last version, then downgrade it on previous version I will thinking about it problem and keep you updated. Now I go home. Thank you for assistance. Regards, Roman.
I have just a next lines in my sshd_config: -------- start of file -------- SyslogFacility AUTHPRIV PasswordAuthentication yes ChallengeResponseAuthentication no UsePAM yes Subsystem sftp /usr/libexec/openssh/sftp-server -------- end of file -------- and it's works fine. I saw some topics about problems with connects when GSSAPI is enabled but I don't think what it is your case. So, at this moment only one way come to my mind it is reinstall openssh-server on old version. Maybe it is not best way, but it can help to resolve problem.
IT WORKS !!!!!!!!! you're great !!! GREAT Thanks : Gianni
Dear Gianni, if it is works now, could you please mark it as solved, please. Thank you, Roman.
Re: * SOLVED * FC6 Precreated VE and ssh
I had the same problem: ahuxley@pc012939$ ssh root@loofah pwd ahuxley@pc012939$ After the posting of a very cut-down /etc/ssh/sshd_config above, I started stripping stuff out of the full version in order to see what the problem was. And amazingly, it was the 'AcceptEnv' statements! So fix #1 on the ssh client: ahuxley@pc012939$ unset LC_ALL ahuxley@pc012939$ or, alternatively, fix #2 on the ssh server: [root@loofah ssh]# perl -pi -e 's/^(AcceptEnv)/#$1/' /etc/ssh/sshd_config [root@loofah ssh]# /etc/init.d/sshd restart Stopping sshd: [ OK ] Starting sshd: [ OK ] [root@loofah ssh]# I suspect that the "right" fix is to set up the locales correctly on the server. I imagine (but didn't check) that the stripped down FC6 template is missing some of this. Alexis (PS just posting here 'cos I thought this would be useful for all of you. If you want to ask further questions then I'm unlikely to see it if posted here. Mail me at ahuxley at gmx dot net.)