Re: SSH v3.7.1p2 gotcha: illegal user
From: Darren Tucker (dtucker_at_zip.com.au)
Date: 01/27/04
- Previous message: jim.horwath_at_rcn.com: "password file syncing"
- In reply to: schulz_at_videotron.ca: "SSH v3.7.1p2 gotcha: illegal user"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 27 Jan 2004 14:52:27 +1100 To: schulz@videotron.ca
schulz@videotron.ca wrote:
> We use passwordless accounts with public_key authentication,
> mainly for cvs access.
>
> We just upgraded to SSH v3.7.1p2, and the all connections
> were refused, except the few accounts which had been used
> for real. (this on Linux and Solaris)
>
> I sppose it's a feature
It was mentioned in the 3.7 release notes:
* Portable OpenSSH:
[snip]
- Deny access to locked accounts, regardless of authentication
method in use.
> but then it took a few hours to figure out
> as there doesn't seem to be any precedence.
The SSH v1 series checked for locked accounts on some platforms
(including Solaris) going back to approximately 1998. Later patchsets
of PAM on Solaris will do it too (try setting up a cron job as a user
then passwd -l the account). For details see:
http://bugzilla.mindrot.org/show_bug.cgi?id=442
> Simply changing '!!' (disabled) to '*' solved the problem for us.
>
> I didn't track down when the change was made, it could have been
> there waiting to bite us for a long time.
It was first in 3.7p1.
> So here goes (for google to know):
[snip log]
You should have read all of the debugging info, or wherever you send
your sshd logs to via syslog (authlog, maybe?). You would have seen a
line similar to:
User [foo] not allowed because account is locked
> ssh -vvv (this didn't provide a useful clue, though)
[snip]
As a general rule, the client will not be told why an authentication
failed. This is a security Feature.
--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
- Previous message: jim.horwath_at_rcn.com: "password file syncing"
- In reply to: schulz_at_videotron.ca: "SSH v3.7.1p2 gotcha: illegal user"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
