Debian SSH problem after upgrading Sarge to Etch?

-
About 3 hour I've been strugling to figure it out... why my ssh keep closing the connection after I issued the correct password? Actually, I just upgrade the Debian on this TS-7260 board from the default Sarge to Etch.

I search all the settings in /etc/ssh/sshd_config, nothing much different... i tried to check wether it is hosts.allow or hosts.deny problem but it wasn't...

I keep on trying many times... thank god i can still access the board using serial console. I tried to restart the server but still, I can't get in. I've tried to ssh with -vv and this is what I got...
apogee@apogee-persiasys:~$ ssh -vv raingauge@10.1.1.92
OpenSSH_4.6p1 Debian-5ubuntu0.1, OpenSSL 0.9.8e 23 Feb 2007
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 10.1.1.92 [10.1.1.92] port 22.
debug1: Connection established.
debug1: identity file /home/apogee/.ssh/identity type -1
debug1: identity file /home/apogee/.ssh/id_rsa type -1
debug1: identity file /home/apogee/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_4.3p2 Debian-9
debug1: match: OpenSSH_4.3p2 Debian-9 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_4.6p1 Debian-5ubuntu0.1
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_init: found hmac-md5
debug1: kex: server->client aes128-cbc hmac-md5 none
debug2: mac_init: found hmac-md5
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 121/256
debug2: bits set: 515/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '10.1.1.92' is known and matches the RSA host key.
debug1: Found key in /home/apogee/.ssh/known_hosts:7
debug2: bits set: 537/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/apogee/.ssh/identity ((nil))
debug2: key: /home/apogee/.ssh/id_rsa ((nil))
debug2: key: /home/apogee/.ssh/id_dsa ((nil))
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /home/apogee/.ssh/identity
debug1: Trying private key: /home/apogee/.ssh/id_rsa
debug1: Trying private key: /home/apogee/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug2: we sent a keyboard-interactive packet, wait for reply
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
Password: 
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 0
debug1: Authentication succeeded (keyboard-interactive).
debug1: channel 0: new [client-session]
debug2: channel 0: send open
debug1: Entering interactive session.
debug2: callback start
debug2: client_session2_setup: id 0
debug2: channel 0: request pty-req confirm 0
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
debug2: channel 0: request env confirm 0
debug2: channel 0: request shell confirm 0
debug2: fd 3 setting TCP_NODELAY
debug2: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug1: channel 0: free: client-session, nchannels 1
Connection to 10.1.1.92 closed by remote host.
Connection to 10.1.1.92 closed.
debug1: Transferred: stdin 0, stdout 0, stderr 81 bytes in 0.1 seconds
debug1: Bytes per second: stdin 0.0, stdout 0.0, stderr 831.4
debug1: Exit status -1
apogee@apogee-persiasys:~$

After checking all the settings again, I found one tiny little thing that I have to change to make it work...

Simply change the line with:

PasswordAuthentication yes

to

PasswordAuthentication no

in /etc/ssh/sshd_config solve the problem... that's all...

Maybe because I'm trying to match the old Debian Sarge sshd_config, and I couldn't find it...

So, here is my new /etc/ssh/sshd_config file contents:
# Package generated configuration file
# See the sshd(8) manpage for defails

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation no

# ...but breaks Pam auth via kbdint, so we have to turn it off
# Use PAM authentication via keyboard-interactive so PAM modules can
# properly interface with the user (off due to PrivSep)
#PAMAuthenticationViaKbdInt no
# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 600
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile     %h/.ssh/authorized_keys

# rhosts authentication should not be used
#RhostsAuthentication no
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords yes

# Uncomment to disable s/key passwords 
#ChallengeResponseAuthentication no

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no

# To change Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#AFSTokenPassing no
#KerberosTicketCleanup no

# Kerberos TGT Passing does only work with the AFS kaserver
#KerberosTgtPassing yes

X11Forwarding no
X11DisplayOffset 10
PrintMotd no
#PrintLastLog no
KeepAlive yes
UseLogin yes

#MaxStartups 10:30:60
#Banner /etc/issue.net
#ReverseMappingCheck yes

Subsystem sftp /usr/lib/openssh/sftp-server


UsePAM yes

So, lesson learned... your SSH setting from previous version may not match, have the same meaning or function the same way it used to work. Hack it around and you'll find the fix... Keep google handy! Hope it helps others who gonna deal with this TS-ARM board like me... with Debian Arm...

Comments

Post a Comment

Popular posts from this blog

How to Create Hyperlink on Blogger Post

-
Image
Well, this time I make a basic simple tutorial. For all advanced geek who read this blog, please ignore this post... I just wanna help myself not to teach the same basic thing on every newbies friends that really need help. OK guys, back to the howto... There are two ways to create a hyperlink on your blog post. One is the simple GUI way and the other is coders way. I prefer the coder way as I can have more control on it. I like to teach by example. So, let say you wanna create a hyperlink on this line of words... You can go here to see my art blog where you wanna link the word "here" to the other page on your blog or on the internet. In this example, I wanna link it to my Art Of Apogee Blog post with the address: http://artofapogee.blogspot.com/2008/03/gimp-best-free-photoshop.html And here is how to do it using both ways... The simple GUI way If you rollover every button on your Compose toolbar, you can see one button called "Link" where the word Link will pop u
Read more

How to Add a Sudo User on AlmaLinux 9.2 (Turquoise Kodkod): A Step-by-Step Guide

-
Image
As a system administrator, one of the essential tasks in managing a Linux server is granting users administrative privileges through the "sudo" command. AlmaLinux, a robust and secure Linux distribution, follows the same principles as other CentOS/RHEL-based systems for managing users and permissions. In this tutorial, we'll walk you through the process of adding a sudo user on AlmaLinux 9.2.
Read more

How to Show and Hide Text in Blog Post

-
Image
I would like to share on how to make a Show/Hide text in your blog post. I'm sorry if I didn't explain detail enough because I want to keep my post short as I'm in a hurry. However, you can read the detail explanation on Blogger Help . In this example, I assume you have sub topics that you want to make it hidden until reader clicks on the headline. Without the show/hide trick, it would look like this... Title One This is the example text for title one. Title Two This is the example text for title two. Title Three This is the example text for title three. Here's my step to do this... Firstly, edit your template and add the following code in the CSS area. .posthidden {display:none} .postshown {display:inline} Then add the following javascript code on your blog template between the <head></head> tag. <script type="text/Javascript"> function expandcollapse (postid) { whichpost = document.getElementById(postid); if (w
Read more