Home / user-2502

sclarson's questions

Martin Hope
sclarson
Asked: 2015-05-13 12:20:00 +0800 CST
  • 2

Connecting from the client to the server:

$ ssh -vvv [email protected]
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: /etc/ssh_config line 102: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 10.0.50.170 [10.0.50.170] port 17622.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load "/Users/userlocal/.ssh/id_rsa" as a RSA1 public key
debug1: identity file /Users/userlocal/.ssh/id_rsa type -1
debug1: identity file /Users/userlocal/.ssh/id_rsa-cert type -1
debug1: identity file /Users/userlocal/.ssh/id_dsa type -1
debug1: identity file /Users/userlocal/.ssh/id_dsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9p1 Debian-5ubuntu1.4
debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1.4 pat OpenSSH_5*
debug2: fd 3 setting O_NONBLOCK
debug3: put_host_port: [10.0.50.170]:17622
debug3: load_hostkeys: loading entries for host "[10.0.50.170]:17622" from file "/Users/userlocal/.ssh/known_hosts"
debug3: load_hostkeys: found key type RSA in file /Users/userlocal/.ssh/known_hosts:13
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],[email protected],ssh-rsa
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],ssh-rsa,[email protected],[email protected],ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: none,[email protected]
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 124/256
debug2: bits set: 523/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA bd:f6:21:3e:83:5f:d2:39:07:f7:9d:22:fe:16:3d:aa
debug3: put_host_port: [10.0.50.170]:17622
debug3: put_host_port: [10.0.50.170]:17622
debug3: load_hostkeys: loading entries for host "[10.0.50.170]:17622" from file "/Users/userlocal/.ssh/known_hosts"
debug3: load_hostkeys: found key type RSA in file /Users/userlocal/.ssh/known_hosts:13
debug3: load_hostkeys: loaded 1 keys
debug3: load_hostkeys: loading entries for host "[10.0.50.170]:17622" from file "/Users/userlocal/.ssh/known_hosts"
debug3: load_hostkeys: found key type RSA in file /Users/userlocal/.ssh/known_hosts:13
debug3: load_hostkeys: loaded 1 keys
debug1: Host '[10.0.50.170]:17622' is known and matches the RSA host key.
debug1: Found key in /Users/userlocal/.ssh/known_hosts:13
debug2: bits set: 510/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /Users/userlocal/.ssh/id_rsa (0x7f80b26004a0),
debug2: key: /Users/userlocal/.ssh/id_rsa (0x0),
debug2: key: /Users/userlocal/.ssh/id_dsa (0x0),
debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/userlocal/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 149
debug2: input_userauth_pk_ok: fp 03:8e:bc:ca:5f:e8:1f:40:4d:ce:18:c8:06:63:3c:7a
debug3: sign_and_send_pubkey: RSA 03:8e:bc:ca:5f:e8:1f:40:4d:ce:18:c8:06:63:3c:7a
debug3: input_userauth_banner
Access denied for this host
Connection closed by 10.0.50.170

Server /var/log/auth.log output (partial)

debug1: Found matching RSA key: <blah>
debug1: restore_uid: 0/0
debug1: do_pam_account: called
Failed publickey for user from 10.0.0.1
debug1: userauth_send_banner: sent [preauth]
fatal: Access denied for user user by PAM account configuration [preauth]
debug1: do_cleanup [preauth]
debug1: monitor_read_log: child log fd closed
debug1: do_cleanup
debug1: PAM: cleanup
debug1: pam_unix(cron:session)

SSHD_Config 

    # Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 17622
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile     %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2

HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

ldap.conf

pam_member_attribute memberuid

base dc=mydomain,dc=com

timelimit 180
bind_timelimit 180
idle_timelimit 2700
bind_policy soft
pam_lookup_policy yes
pam_check_host_attr yes
nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,ftp,games,gnats,hplip,irc,kernoops,landscape,libuuid,lightdm,list,lp,mail,ma
n,messagebus,mysql,news,nslcd,ntp,nx,postfix,proxy,pulse,root,rtkit,saned,smmsp,smmta,snmp,speech-dispatcher,sshd,stunnel4,sync,sys,syslog,usbmux,uu
cp,uvncrep,whoopsie,www-data

pam_password epox
uri ldaps://prdlnxauth1.mydomain.com ldaps://prdlnxauth2.mydomain.com

nsswitch.conf

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         ldap compat
group:          ldap compat
shadow:         ldap compat

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

pam.conf is blank (all default comments)

etc/pam.d/atd

auth require pam_env.so
@include common-auth
@include common-account
session require pam_limits.so

etc/pam.d/common-auth

auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    [success=1 default=ignore]      pam_ldap.so use_first_pass
# here's the fallback if no module succeeds
auth    requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional                        pam_cap.so
# end of pam-auth-update config

etc/pam.d/common-account

# here are the per-package modules (the "Primary" block)
account [success=2 new_authtok_reqd=done default=ignore]        pam_unix.so
account [success=1 default=ignore]      pam_ldap.so
# here's the fallback if no module succeeds
account requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config

If I disable pam in the sshd config then key auth works fine but passwords won't. If I enable it the local users are OK but LDAP users won't work.

ssh
Martin Hope
sclarson
Asked: 2013-01-18 11:46:37 +0800 CST
  • 0

I'm running the following as a part of chef deployment of a windows server.

cscript /nologo C:\chef\wget.vbs /url:http://www.opscode.com/chef/install.msi /path:C:\Users\ADMINI~1\AppData\Local\Temp\chef-client-latest.msi

The error I get is:

CScript Error: Execution of the Windows Script Host failed. (0x800A0007)

The vbs file is created by this command:

C:\Users\Administrator>(
 echo.url = WScript.Arguments.Named("url")  
 echo.path = WScript.Arguments.Named("path")  
 echo.proxy = null  
 echo.Set objXMLHTTP = CreateObject("MSXML2.ServerXMLHTTP")  
 echo.Set wshShell = CreateObject( "WScript.Shell" )  
 echo.Set objUserVariables = wshShell.Environment("USER")  
 echo. 
 echo.'http proxy is optional  
 echo.'attempt to read from HTTP_PROXY env var first  
 echo.On Error Resume Next  
 echo. 
 echo.If NOT (objUserVariables("HTTP_PROXY") = "") Then   
 echo.proxy = objUserVariables("HTTP_PROXY")  
 echo. 
 echo.'fall back to named arg  
 echo.ElseIf NOT (WScript.Arguments.Named("proxy") = "") Then   
 echo.proxy = WScript.Arguments.Named("proxy")  
 echo.End If  
 echo. 
 echo.If NOT isNull(proxy) Then  
 echo.'setProxy method is only available on ServerXMLHTTP 6.0+  
 echo.Set objXMLHTTP = CreateObject("MSXML2.ServerXMLHTTP.6.0")  
 echo.objXMLHTTP.setProxy 2, proxy  
 echo.End If  
 echo. 
 echo.On Error Goto 0  
 echo. 
 echo.objXMLHTTP.open "GET", url, false   
 echo.objXMLHTTP.send() 
 echo.If objXMLHTTP.Status = 200 Then   
 echo.Set objADOStream = CreateObject("ADODB.Stream")  
 echo.objADOStream.Open 
 echo.objADOStream.Type = 1  
 echo.objADOStream.Write objXMLHTTP.ResponseBody  
 echo.objADOStream.Position = 0  
 echo.Set objFSO = Createobject("Scripting.FileSystemObject")  
 echo.If objFSO.Fileexists(path) Then objFSO.DeleteFile path  
 echo.Set objFSO = Nothing  
 echo.objADOStream.SaveToFile path  
 echo.objADOStream.Close 
 echo.Set objADOStream = Nothing  
 echo.End if  
 echo.Set objXMLHTTP = Nothing                                                                                                                                       
) 1>C:\chef\wget.vb

If I rdp into the server and run the same first command it works successfully.

windows-server-2008-r2
Martin Hope
sclarson
Asked: 2011-01-29 14:49:32 +0800 CST
  • 1

Trying to connect to an instance of SQL Server 2008 on a server we'll call Sputnik. There are no firewalls in between the two devices.

Right now I'm just trying to list databases

[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SqlServer.SMO") | Out-Null
[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SqlServer.SmoExtended") | Out-Null
[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SqlServer.ConnectionInfo") | Out-Null
[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SqlServer.SmoEnum") | Out-Null
$servername = "Sputnik"
$remoteServer = New-Object("Microsoft.SqlServer.Management.Smo.Server") $servername
$remoteServer.databases

The following error message occurs:

 The following exception was thrown when trying to enumerate the collection: 
 "Failed to connect to server Sputnik.".
 At line:1 char:15 + $remoteServer. <<<< databases 
 + CategoryInfo          : NotSpecified: (:) [], ExtendedTypeSystemException
 + FullyQualifiedErrorId : ExceptionInGetEnumerator
sql-server backup powershell