Re: Problem connecting to SSH, OpenVMS7.3-2, HP TCP/IP v5.4 patched



From: "Milton" <milton.baar@xxxxxxxxx>

$ ssh -v beta
debug: Ssh2/SSH2.C:1847: CRTL version (SYS$SHARE:DECC$SHR.EXE ident) is V7.3-2-0
0
debug: SshAppCommon/SSHAPPCOMMON.C:307: Allocating global SshRegex context.
debug: SshConfig/SSHCONFIG.C:3285: Metaconfig parsing stopped at line 3.
debug: SshConfig/SSHCONFIG.C:842: Setting variable 'VerboseMode' to 'FALSE'.
debug: SshConfig/SSHCONFIG.C:3193: Unable to open ssh2/ssh2_config
debug: Connecting to beta, port 22... (SOCKS not used)
debug: Ssh2/SSH2.C:2813: Entering event loop.
debug: Ssh2Client/SSHCLIENT.C:1607: Creating transport protocol.
debug: SshAuthMethodClient/SSHAUTHMETHODC.C:99: Added "publickey" to usable meth
ods.
debug: SshAuthMethodClient/SSHAUTHMETHODC.C:99: Added "keyboard-interactive" to
usable methods.
debug: SshAuthMethodClient/SSHAUTHMETHODC.C:99: Added "password" to usable metho
ds.
debug: Ssh2Client/SSHCLIENT.C:1648: Creating userauth protocol.
debug: client supports 3 auth methods:
'publickey,keyboard-interactive,password'
debug: SshUnixTcp/SSHUNIXTCP.C:1356: using local hostname beta.xxx.com
debug: Ssh2Common/SSHCOMMON.C:545: local ip = 192.168.100.201, local port = 4915
2
debug: Ssh2Common/SSHCOMMON.C:547: remote ip = 192.168.100.201, remote port = 22
debug: SshConnection/SSHCONN.C:2277: Wrapping...
debug: SshReadLine/SSHREADLINE.C:3651: Initializing ReadLine...
debug: Ssh2Common/SSHCOMMON.C:184: DISCONNECT received: Connection closed by rem
ote host.
debug: SshReadLine/SSHREADLINE.C:3717: Uninitializing ReadLine...
warning: Authentication failed.
debug: Ssh2/SSH2.C:316: locally_generated = TRUE
Disconnected; connection lost (Connection closed by remote host.).
debug: Ssh2Client/SSHCLIENT.C:1683: Destroying client.
debug: SshConfig/SSHCONFIG.C:2745: Freeing pki. (host_pki != NULL, user_pki = NU
LL)
debug: SshConnection/SSHCONN.C:2329: Destroying SshConn object.
debug: Ssh2Client/SSHCLIENT.C:1751: Destroying client completed.
debug: SshAuthMethodClient/SSHAUTHMETHODC.C:104: Destroying authentication metho
d array.
debug: SshAppCommon/SSHAPPCOMMON.C:320: Freeing global SshRegex context.
debug: SshConfig/SSHCONFIG.C:2745: Freeing pki. (host_pki = NULL, user_pki = NUL
L)

So, as you can see, I am trying to make an ssh connection with the
client on the same node as the server.

So it appears.

I have also tried using various
windows-based ssh clients and get the same result. I thought that if
it can't work locally, its not going to work remotely either!

Sounds reasonable to me.

When I do the same thing, we look similar for a while, and then
diverge:

alp $ tcpip show version

HP TCP/IP Services for OpenVMS Alpha Version V5.4 - ECO 6
on a COMPAQ Professional Workstation XP1000 running OpenVMS V7.3-2

alp $ ssh "-V"
alp$dka0:[sys0.syscommon.][sysexe]tcpip$ssh_ssh2.exe: SSH Secure Shell OpenVMS (
V5.5) 3.2.0 on COMPAQ Professional Workstation - VMS V7.3-2

alp $ ssh -v alp
debug: Ssh2/SSH2.C:1906: CRTL version (SYS$SHARE:DECC$SHR.EXE ident) is V7.3-2-0
3
debug: SshAppCommon/SSHAPPCOMMON.C:322: Allocating global SshRegex context.
debug: SshConfig/SSHCONFIG.C:3332: Metaconfig parsing stopped at line 4.
debug: SshConfig/SSHCONFIG.C:861: Setting variable 'VerboseMode' to 'FALSE'.
debug: SshConfig/SSHCONFIG.C:3240: Unable to open ssh2/ssh2_config
debug: Connecting to alp, port 22... (SOCKS not used)
debug: Ssh2/SSH2.C:2872: Entering event loop.
debug: Ssh2Client/SSHCLIENT.C:1608: Creating transport protocol.
[Here things start to differ, but not in obviously fatal ways.]
debug: SshAuthMethodClient/SSHAUTHMETHODC.C:101: Added "hostbased" to usable met
hods.
debug: SshAuthMethodClient/SSHAUTHMETHODC.C:101: Added "publickey" to usable met
hods.
debug: SshAuthMethodClient/SSHAUTHMETHODC.C:101: Added "password" to usable meth
ods.
debug: Ssh2Client/SSHCLIENT.C:1649: Creating userauth protocol.
debug: client supports 3 auth methods: 'hostbased,publickey,password'
debug: SshUnixTcp/SSHUNIXTCP.C:1378: using local hostname alp.antinode.org
debug: Ssh2Common/SSHCOMMON.C:546: local ip = 10.0.0.9, local port = 58480
debug: Ssh2Common/SSHCOMMON.C:548: remote ip = 10.0.0.9, remote port = 22
debug: SshConnection/SSHCONN.C:2290: Wrapping...
debug: SshReadLine/SSHREADLINE.C:3670: Initializing ReadLine...
[Here, I continue happily, where you enter the fatal vortex.]
debug: Remote version: SSH-2.0-3.2.0 SSH Secure Shell OpenVMS V5.5 VMS_sftp_vers
ion 2
debug: Major: 3 Minor: 2 Revision: 0
debug: Ssh2Transport/TRCOMMON.C:2268: lang s to c: `', lang c to s: `'
debug: Ssh2Transport/TRCOMMON.C:2333: c_to_s: cipher aes128-cbc, mac hmac-sha1,
compression none
debug: Ssh2Transport/TRCOMMON.C:2336: s_to_c: cipher aes128-cbc, mac hmac-sha1,
compression none
debug: Remote host key found from database.
[... more successful stuff ...]

Knowing little, I'd guess that the server dies in some way to cause
that "DISCONNECT received: Connection closed by remote host." message.

You might look for interesting stuff in the log file(s):
SYS$SYSDEVICE:[TCPIP$SSH]TCPIP$SSH_RUN.LOG
One of my successful run log files looks like this:

$ Set NoOn
$ VERIFY = F$VERIFY(F$TRNLNM("SYLOGIN_VERIFY"))
Mon 20 17:24:23 WARNING: Starting image in auxiliary server mode.
Mon 20 17:24:23 INFORMATIONAL: OpenVMS$gl_sockfd = 0
Mon 20 17:24:23 INFORMATIONAL: connection from "10.0.0.9"
Mon 20 17:24:23 WARNING: Error trying to access file /home_sms/sms/ssh2/knownhosts/alp_antinode_org_ssh-dss.pub.
[No surprise, as I allow, but don't use, host-based authentication.]
Mon 20 17:24:24 NOTICE: Public key /home_sms/sms/ssh2/SMS_NPP_ID_DSA_1024_A.PUB used.
Mon 20 17:24:24 NOTICE: Public key authentication for user sms accepted.
Mon 20 17:24:24 NOTICE: User sms, coming from alp.antinode.org, authenticated.
[Normal logout here.]
Mon 20 17:24:30 INFORMATIONAL: Local disconnected: Connection closed.
Mon 20 17:24:30 INFORMATIONAL: connection lost: 'Connection closed.'
TCPIP$SSH job terminated at 20-NOV-2006 17:24:30.94

Accounting information:
Buffered I/O count: 675 Peak working set size: 9280
Direct I/O count: 321 Peak virtual size: 181632
Page faults: 692 Mounted volumes: 0
Charged CPU time: 0 00:00:00.38 Elapsed time: 0 00:00:07.89


I changed my SYS$SYSDEVICE:[TCPIP$SSH.SSH2]SSHD2_CONFIG file so:

ALP $ diff /merg = 0 SYS$SYSDEVICE:[TCPIP$SSH.SSH2]SSHD2_CONFIG.TEMPLATE
..
************
File SYS$SYSDEVICE:[TCPIP$SSH.SSH2]SSHD2_CONFIG.TEMPLATE;1
******
File SYS$SYSDEVICE:[TCPIP$SSH.SSH2]SSHD2_CONFIG.;4
164 AllowedAuthentications hostbased, publickey, password
************
************
File SYS$SYSDEVICE:[TCPIP$SSH.SSH2]SSHD2_CONFIG.TEMPLATE;1
******
File SYS$SYSDEVICE:[TCPIP$SSH.SSH2]SSHD2_CONFIG.;4
222 IgnoreRhosts no
************

Number of difference sections found: 2
Number of difference records found: 2
[...]

The non-default "AllowedAuthentications" accounts for the early
differences between our messages. I made a similar change to the
SSH2_CONFIG file, but I don't know if that one matters:

ALP $ diff /merg = 0 SYS$SYSDEVICE:[TCPIP$SSH.SSH2]SSH2_CONFIG.TEMPLATE
..
************
File SYS$SYSDEVICE:[TCPIP$SSH.SSH2]SSH2_CONFIG.TEMPLATE;1
******
File SYS$SYSDEVICE:[TCPIP$SSH.SSH2]SSH2_CONFIG.;2
131 AllowedAuthentications hostbased, publickey, password
************

Number of difference sections found: 1
Number of difference records found: 1
[...]

------------------------------------------------------------------------

Steven M. Schweda sms@antinode-org
382 South Warwick Street (+1) 651-699-9818
Saint Paul MN 55105-2547
.



Relevant Pages

  • Re: IIS 6.0 and 401.2 and 401.1 Errors
    ... > authentication -- client and server first negotiate authentication that ... > So, if you see repeated 401.2 for the same resource from the same client, ... > authenticated connection and instead RENEGOTIATING a new connection. ... > You can easily verify this by installing "Network Monitor" from Windows ...
    (microsoft.public.inetserver.iis)
  • NTLM authentifizierung und fremde Browser
    ... [DEBUG] ... authentication realm: username:rootadmin password:afis- ... HttpMethodBase - -Adding Host request header ... HttpMethodBase - -Should close connection in ...
    (microsoft.public.de.inetserver.iis)
  • Re: IIS 6.0 and 401.2 and 401.1 Errors
    ... authentication -- client and server first negotiate authentication that ... authenticated connection is considered "authenticated" and directly succeed. ... So, if you see repeated 401.2 for the same resource from the same client, it ... means that the client and server are NOT keeping their previously ...
    (microsoft.public.inetserver.iis)
  • RE: Windows Me/98 Client connecting to SQL W2k3
    ... because to simplify the connection problem it can also be ... On Wednesday I will be at the client site and I will check the MDAC and the ... SQL authentication we do not use. ... Only Windows Authentication. ...
    (microsoft.public.sqlserver.connect)
  • Re: Problem connecting to SSH, OpenVMS7.3-2, HP TCP/IP v5.4 patched
    ... debug: SshAppCommon/SSHAPPCOMMON.C:307: Allocating global SshRegex context. ... connection lost. ... Suggestion 2. ... host-based, or password authentication. ...
    (comp.os.vms)