Ssh & Cl

[1lexis]

Bonjour,

J'essaye d'activer le service ssh sur mon D214 pour pouvoir m'identifier avec une clé privée. Et j'ai beaucoup de mal. J'ai fini par récupérer le fichier de config sshd_config ainsi que la clé d'un autre Synlogy sur lequel je me connecte (avec la clé en question). Mais rien n'y fait, cela ne fonctionne pas. Je dois toujours taper le mot de passe de l'utilisaute (sachant quà terme je voudrais désactiver l'authentification par mot de passe).

Voici les log :

OpenSSH_5.8p1-hpn13v11, OpenSSL 1.0.1h-fips 5 Jun 2014
debug1: Reading configuration data /var/services/homes/alexis/.ssh/config
debug1: Applying options for alexis
debug2: ssh_connect: needpriv 0
debug1: Connecting to 88.182.235.161 [88.182.235.161] port 4869.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load "/var/services/homes/alexis/.ssh/key_spiff" as a RSA1 public key
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /var/services/homes/alexis/.ssh/key_spiff type -1
debug1: identity file /var/services/homes/alexis/.ssh/key_spiff-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.8p1-hpn13v11
debug1: match: OpenSSH_5.8p1-hpn13v11 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.8p1-hpn13v11
debug2: fd 3 setting O_NONBLOCK
debug3: put_host_port: [88.182.235.161]:4869
debug3: load_hostkeys: loading entries for host "[88.182.235.161]:4869" from file "/var/services/homes/alexis/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /var/services/homes/alexis/.ssh/known_hosts:2
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: AUTH STATE IS 0
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-md5
debug1: REQUESTED ENC.NAME is 'aes128-ctr'
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: REQUESTED ENC.NAME is 'aes128-ctr'
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA c9:e9:d5:9b:c9:61:59:c3:6b:c5:0a:19:81:83:a5:4c
debug3: put_host_port: [88.182.235.161]:4869
debug3: put_host_port: [88.182.235.161]:4869
debug3: load_hostkeys: loading entries for host "[88.182.235.161]:4869" from file "/var/services/homes/alexis/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /var/services/homes/alexis/.ssh/known_hosts:2
debug3: load_hostkeys: loaded 1 keys
debug3: load_hostkeys: loading entries for host "[88.182.235.161]:4869" from file "/var/services/homes/alexis/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /var/services/homes/alexis/.ssh/known_hosts:2
debug3: load_hostkeys: loaded 1 keys
debug1: Host '[88.182.235.161]:4869' is known and matches the ECDSA host key.
debug1: Found key in /var/services/homes/alexis/.ssh/known_hosts:2
debug1: ssh_ecdsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /var/services/homes/alexis/.ssh/key_spiff ((nil))
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug3: start over, passed a different list publickey,password,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /var/services/homes/alexis/.ssh/key_spiff
debug1: read PEM private key done: type RSA
debug3: sign_and_send_pubkey: RSA ed:ff:a1:2e:6b:68:f8:60:4f:26:90:51:c7:0d:64:c1
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug2: we sent a keyboard-interactive packet, wait for reply
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
Password:

Et le fichier de conf :

# $OpenBSD: sshd_config,v 1.82 2010/09/06 17:10:19 naddy Exp $


# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.


# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin


# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options change a
# default value.


#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::


# The default requires explicit activation of protocol 1
#Protocol 2


# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key


# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 1024


# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#LogLevel INFO


# Authentication:


#LoginGraceTime 2m
#PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10


RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys


# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes


# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no


# Change to no to disable s/key passwords
ChallengeResponseAuthentication yes
#ChallengeResponseAuthentication no


# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no


# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes


# Set this to 'yes' to enable PAM authentication, account processing, 
# and session processing. If this is enabled, PAM authentication will 
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
#UsePAM no


#AllowAgentForwarding yes
AllowTcpForwarding no
#GatewayPorts no
#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10
#PermitTunnel no
ChrootDirectory none
#ChrootDirectory /var/services/homes/%u
#DenyUsers admin


# no default banner path
#Banner none


# override default of no subsystems
#Subsystem sftp /usr/libexec/sftp-server
#Subsystem       sftp    internal-sftp -f DAEMON -l VERBOSE -u 000
Subsystem       sftp    internal-sftp -f DAEMON -u 000
#Subsystem       sftp    /usr/syno/sbin/sftp-server -l DEBUG3


# the following are HPN related configuration options
# tcp receive buffer polling. disable in non autotuning kernels
#TcpRcvBufPoll yes


# allow the use of the none cipher
#NoneEnabled no


# disable hpn performance boosts. 
#HPNDisabled no


# buffer size for hpn to non-hpn connections
#HPNBufferSize 2048




# Example of overriding settings on a per-user basis
Match User root
# X11Forwarding no
AllowTcpForwarding yes
# ForceCommand cvs server

Merci d'avance pour votre aide...

[CoolRaoul]

Il n'y a pas besoin de modifier le fichier de config (et ce n'était pas necessaire d'en joindre une copie: on a tous le même)

Par contre un utilisateur "lambda" n'est pas autorisé a se connecter à moins de modifier son shell dans /etc/passwd.

Modifié le 2 septembre 2014 par CoolRaoul

[1lexis]

Bonjour,

J'avais bien modifié le shell. D'ailleur je me connecte en ssh, mais avec le mot de passe, pas ma clé privée...

[CoolRaoul]

J'avais bien modifié le shell. D'ailleur je me connecte en ssh, mais avec le mot de passe, pas ma clé privée...

Ah oui en effet, alors faut activer les log (voir comment faire ) et aller y voir ("dans /var/log/messages") ce qui se passe.

Je parie un probleme de droits sur authorized_keys ou un des dossier englobants.

[1lexis]

Ah oui en effet, alors faut activer les log (voir comment faire ) et aller y voir ("dans /var/log/messages") ce qui se passe.

Je parie un probleme de droits sur authorized_keys ou un des dossier englobants.

Merci beaucoup.

J'ai activé les logs et vu :

Authentication refused: bad ownership or modes for directory

Alors, par contre, il y a quelque chose que je ne m'explique pas. Les droits sur mon répertoire home étaient "drwx--x--x". J'ai passé la commande "chmod g-w mon_homme" et là cela fonctionne. Je peux me connecter en ssh avec ma clé.

Sauf que, après avoir passé la commande chmod, les droits sur mon répertoire home sont "drwx--x--x". Les mêmes qu'avant non ?

Comprend pas...

[CoolRaoul]

Alors, par contre, il y a quelque chose que je ne m'explique pas. Les droits sur mon répertoire home étaient "drwx--x--x". J'ai passé la commande "chmod g-w mon_homme" et là cela fonctionne. Je peux me connecter en ssh avec ma clé.

Sauf que, après avoir passé la commande chmod, les droits sur mon répertoire home sont "drwx--x--x". Les mêmes qu'avant non ?

Comprend pas...

Les ACLs doivent certainement être activés sur le partage homes.

La commande "ls -l" ne les visualise pas mais par contre le "chmod" a bien réinitialisé les droits effectifs au minimum ce qui a produit l'effet constaté.

Modifié le 2 septembre 2014 par CoolRaoul