OpenSSH failed non-root login

From: Andy (unclemonty_at_gmail.com)
Date: 10/20/04 

Date: 20 Oct 2004 02:57:24 -0700

sshd version OpenSSH_3.6.1p2
Distro Fedora Core 1
Kernel 2.4.22-1.2199.nptl

Hope someone can help with this, I've come to a full stop. Frequently
sshd is denying any non-root logins. To be precise, it just
disconnects the connecting client after the password is provided.
After restarting sshd it works fine and root login always works,
regardless.

Any help anyone can offer would be much appreciated, I've drawn a
blank on this one so far.

I've been tracing both before and after restarting sshd and the most
notable differences I can see are..

The following two messages apprear often in the output of the trace
and always differ in the ways below:

This when login fails:
setpriority(PRIO_PROCESS, 0, 0) = -1 EACCES (Permission denied)

And this when login succeeds:
setpriority(PRIO_PROCESS, 0, 0) = 0

Then, much later in the run, things change dramatically after being
pretty much identical for the most part..

When login fails:

[pid 6306] read(9, "# /etc/security/console.perms\n#\n"..., 8192) =
2453
[pid 6306] read(9, "", 8192) = 0
[pid 6306] ioctl(9, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfeb2778) = -1
ENOTTY (Inappropriate ioctl for device)
[pid 6306] close(9) = 0
** change happens here **
[pid 6306] lstat64("/dev/pts/1", {st_mode=S_IFCHR|0620,
st_rdev=makedev(136, 1), ...}) = 0
[pid 6306] time([1098264231]) = 1098264231
[pid 6306] getpid() = 6306
[pid 6306] rt_sigaction(SIGPIPE, {0xba5d30, [], SA_RESTORER,
0xaf5a58}, {SIG_IGN}, 8) = 0
[pid 6306] socket(PF_FILE, SOCK_DGRAM, 0) = 9
[pid 6306] fcntl64(9, F_SETFD, FD_CLOEXEC) = 0
[pid 6306] connect(9, {sa_family=AF_FILE, path="/dev/log"}, 16) = 0
[pid 6306] send(9, "<82>Oct 20 10:23:51 sshd[6306]: "..., 85, 0) = 85
[pid 6306] rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0
[pid 6306] close(9)

When login succeeds:

[pid 6390] read(9, "# /etc/security/console.perms\n#\n"..., 8192) =
2453
[pid 6390] read(9, "", 8192) = 0
[pid 6390] ioctl(9, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbffa47a8) = -1
ENOTTY (Inappropriate ioctl for device)
[pid 6390] close(9) = 0
** change happens here **
[pid 6390] lstat64("/dev/pts/1", {st_mode=S_IFCHR|0620,
st_rdev=makedev(136, 1), ...}) = 0
[pid 6390] open("/etc/security/pam_env.conf", O_RDONLY) = 9
[pid 6390] fstat64(9, {st_mode=S_IFREG|0644, st_size=2862, ...}) = 0
[pid 6390] mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xbf5ff000
[pid 6390] read(9, "# $Date: 2000/06/20 22:11:35 $\n#"..., 4096) =
2862
[pid 6390] read(9, "", 4096) = 0
[pid 6390] close(9) = 0
[pid 6390] munmap(0xbf5ff000, 4096) = 0
[pid 6390] open("/etc/environment", O_RDONLY) = -1 ENOENT (No such
file or directory)
[pid 6390] clone(Process 6391 attached
child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD,
child_tidptr=0xbf5d90c8) = 6391
[pid 6390] close(8) = 0

Cheers,
Andy

Relevant Pages

  • Re: sshd attacks
    ... but if you know the usernames you want you could use ... > from your sshd server before anyone can break your encryption. ... > taht finds open sshd services and tests common user names and password. ... You could also do something where you login with PK to an account whose ...
    (comp.unix.bsd.freebsd.misc)
  • Re: strange and serious problem about user login
    ... > any service other than root. ... > and I try to login as normal user except root, ... > and when I start sshd in this pc, I get no errors, but when I check ...
    (Fedora)
  • Signal 1, Name stays on "who" list under Linux
    ... I'm not too sure if this is off topic, it might be a bug in sshd which is ... OpenSSH v3.4p1, SSH protocols 1.5/2.0 ... 1> connect to the linux box via SSH client and login as any user ... To get past step 2 you have to enter root password, ...
    (comp.security.ssh)
  • Re: autoblocking many ssh failed logins from the same IP....
    ... > daemon) to stop accepting login attempts from a given IP if it tries ... > actually just read the man pages and figure out how to get sshd to ... You can have multiple AllowUsers entries if you want more than one user ... To unsubscribe, ...
    (freebsd-questions)
  • Re: Login.Access
    ... I was using the default sshd config which has "UseLogin no". ... >> Login seems to be ignoring my /etc/login.access settings. ... >> Gerhardt Information Technologies ...
    (FreeBSD-Security)