SCP zamrzne před odesláním souboru

[kuja]

Mam nakonfigurovany non-interactive pripojeni mezi AIXem a RHEL. AIX je jako zdroj, RHEL je cil. Oba maji OpenSSH, takze tady by to melo bejt v poradku.

Je udelanej chroot na cili do jednoho adresare pod konkretnim userem. User ma /sbin/nologin jako shell. RSA klice sou v poradku, takze az potud je vsechno v poradku.

Ale jakmile se snazim pripojit pres scp, tak mi to zmrzne na tomhle :


debug1: Authentication succeeded (publickey).
Authenticated to xxxx.
debug2: fd 4 setting O_NONBLOCK
debug2: fd 5 setting O_NONBLOCK
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug2: callback start
debug2: client_session2_setup: id 0
debug2: fd 3 setting TCP_NODELAY
debug3: packet_set_tos: set IP_TOS 0x08
debug1: Sending command: scp -v -t -- /xxx/xxx/xxx
debug2: channel 0: request exec confirm 1
debug2: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug2: channel 0: rcvd adjust 2097152
debug2: channel_input_status_confirm: type 99 id 0
debug2: exec request accepted on channel 0


Pomuze jenom CTRL+C.

To vypise tohle debug1: channel 0: free: client-session, nchannels 1
debug3: channel 0: status: The following connections are open:
  #0 client-session (t4 r0 i0/0 o0/0 fd 4/5 cc -1)

debug1: fd 0 clearing O_NONBLOCK
debug1: fd 1 clearing O_NONBLOCK
Killed by signal 2.


Uz sem uplne zoufalej, protoze sem smazal jak .*rc soubory, tak bash_history v domovskym adresari usera, prava na chroot adresari sou taky v poradku a dle vsech veci je vsechno taky v poradku, jelikoz funguje sftp bez problemu.

Nevite, kde muze bejt jeste chyba? Podotykam, ze musi bejt chyba na RHEL stroji, protoze se AIX spravne overi a session je zalozena.

Diky za odpovedi.

PS: Google sem projel od shora dolu a proste ty chyby, ktery popisujou v ruznejch vlaknech v tech init scriptech nemam.

[Reklama]

[pajon]

Myslím, že som mal rovnaký problém. Moc si na to už nepamätám, ale problém bol v chroote. Skúsil by som vypnúť chroot a tak skúsiť

[kuja]

pajon:Ano, bez chrootu to funguje, ale já potřebuju chroot, jelikož je nežádoucí, aby si uživatel listoval složky jinde než ve svém home adresáři. Na jiných serverech mi totiž funguje bezproblémů. Kombinace stejná.

[pajon]

Skús sftp namiesto scp. Nie som si istý, že pokiaľ máš chroot nastavený v openssh serveri, tak scp funguje.

[Sten]

Kód: [Vybrat]

Subsystem sftp internal-sftpv nastavení SSH serveru máte?

[Reklama]

[PCnity]

sshd konfig (orezany) by sa hodil.

[kuja]

Prikladam sshd_config


# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options change a
# default value.

Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

# Disable legacy (protocol version 1) support in the server for new
# installations. In future the default will change to require explicit
# activation of protocol 1
Protocol 2,1

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 1024

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
SyslogFacility AUTHPRIV
LogLevel VERBOSE

# Authentication:

#LoginGraceTime 90
PermitRootLogin no
#StrictModes no
MaxAuthTries 6
MaxSessions 10

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile     .ssh/authorized_keys
#AuthorizedKeysCommand none
#AuthorizedKeysCommandRunAs nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes

PermitEmptyPasswords no
PasswordAuthentication yes

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
#UsePAM no
UsePAM yes

# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10
#PermitTunnel no
#ChrootDirectory none

# no default banner path
Banner /etc/issue.net

# override default of no subsystems
#Subsystem      sftp    /usr/libexec/openssh/sftp-server
Subsystem       sftp    internal-sftp

# Example of overriding settings on a per-user basis
#Match User anoncvs
#       X11Forwarding no
#       AllowTcpForwarding no
#       ForceCommand cvs server

Match User xxx
ChrootDirectory /home/xxx
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

btw Na jinem serveru to funguje bez problemu. Takze proto me tohle chovani trosku vykolejilo. A evidentne je chyba nekde na cili, protoze spojeni projde.

[oh lord]

/sbin/nologin je ta chyba

[kuja]

oh lord: Bohuzel to dela i pri pouziti jineho shellu, pouze u /dev/null to neoveri pres RSA klice, coz je nastaveno v PAM. Takze dekuji za smer, ale tam uz sem byl

btw. Co navrhujes za zmenu?


Jo a podotykam, ze verze OpenSSH jsou RHEL 5.3p1 a AIX 5.8p1, coz by melo bejt ok.

[Sten]

Ještě taková klasika: vlastní ten adresář, do kterého se chrootujete, root?

A ještě bych tam zkusil vyrobit adresář dev se zařízeními null, zero a urandom.

[JardaP .]

oh lord: Bohuzel to dela i pri pouziti jineho shellu, pouze u /dev/null to neoveri pres RSA klice, coz je nastaveno v PAM. Takze dekuji za smer, ale tam uz sem byl

V Linuxu a BSD existuji specialni shelly pro tyto ucely. Napriklad zde: http://www.debian-administration.org/articles/94 nebo rssh. Nemate neco takoveho k dispozici take?

[kuja]

oh lord: Bohuzel to dela i pri pouziti jineho shellu, pouze u /dev/null to neoveri pres RSA klice, coz je nastaveno v PAM. Takze dekuji za smer, ale tam uz sem byl

V Linuxu a BSD existuji specialni shelly pro tyto ucely. Napriklad zde: http://www.debian-administration.org/articles/94 nebo rssh. Nemate neco takoveho k dispozici take?

Dobry den,

bohuzel se musi vyuzivat pouze to co je nainstalovano v konkretni distribuci. Nedaji se pridavat dalsi neschvalene balicky kvuli auditu.

[kuja]

Takze se nakonec podelim se resenim. Je to jednoduche a bohuzel na OpenSSH od verze 5 neni mozne vyuzit SCP v chrootu. Ono totiz SCP bezi v compatibility modu, ktery jiz neni uplne secure a OpenSSH ho v non-interactive modu nepodporuje. Tyhle informace sem nasel v release notes od verze 5.1p1. Na jinych serverech bezelo jeste komercni Reflection SSH, ktere vyuziva pro SCP maskovane SFTP, takze komunikace normalne probiha. Nicmene syntaxe SFTP je natolik pouzitelna i z radky, ze se to da velmi obstojne vyuzit jako SCP. Vsem zucastnenym dekuji.