gcb's questions

this is building on answers for Can systemd execute a command *before* a restart?

the current way to "start or restart" a service is:

systemctl is-active nginx && systemctl reload nginx || systemctl start nginx

I'm wondering if there's a better way using targets and such. I am having the feeling I am still trying to use systemd tooling as other init tools.

The case where i'd use this is after manual tweaks to the conf, which may work but crash during stress testing, and so i need to start or restart after new tweaks to the configuration file. Obviously the 'solution' here may be something that is not acceptable in production, as this is done on a vm/dev box.

I plugged an old raid ARRAY to a new system and get this error on anything that I try to do with mdadm.

# mdadm --detail --scan 
ARRAY /dev/md/arch1:2021 metadata=1.2 UUID=c4c7cbde:5f6913a9:eb1c82ff:8fe6cd45

# mdadm --detail 
mdadm: Value "arch1:2021" cannot be set as devname. Reason: Not POSIX compatible. Value ignored.
mdadm: No devices given.

Everything still works fine. I can mount and use the Array. And the "non-compliant" name appears as a device file just fine

 # ls -la /dev/md/
total 0
drwxr-xr-x  2 root root   60 2024-08-09 03:16 .
drwxr-xr-x 20 root root 4580 2024-08-09 03:16 ..
lrwxrwxrwx  1 root root    8 2024-08-09 03:16 arch1:2021 -> ../md127

device file which i can use

 # mdadm --detail /dev/md/arch1\:2021 
/dev/md/arch1:2021:
           Version : 1.2
     Creation Time : Wed Jul  7 06:29:08 2021
        Raid Level : raid1

What's the best way to just update the name in the safest way possible?

Linux kernel would allow me to add routes with gateways that were merely reachable, since there's no issue with them in practice. But nowadays i get "Error: Nexthop has invalid gateway" which is fine to follow specs and make adhoc testing of things a pain.

Is there any way to bypass this check and force my route?

And yes, I do want to fire my private lan routed packages over a public interface, the reasons are valid, low volume and harmless :)

This is not about ExecStartPre

One use case when tweaking services is to test a config file before restarting the service.

for example.

$ vim /etc/nginx.conf
$ nginx -t && restart_nginx

the equivalent with systemd is to still having to remember the check before issuing a restart.

Is there something that prevents that very-likely human error? something like ExecRestartStopPre? That is, something it will execute before the stop step of a restart?

On my journald logs, i see entries like:

systemd[865]: app-org.kde.konsole-fbe1036742844b1ea3cd54e064c0a794.scope: Killing process 14893

Aparently konsole does start one scope per instance (and there's a bug to add one per tab) but having several konsoles open, i get:

$ systemctl list-unit-files --all | grep konsole
$ systemctl list-units --all | grep konsole
$ systemctl list-units --type scope
init.scope
session-1.scope

many questions here on spliting DKIM txt records, but my dns provider only allows 255 chars for each key. no fancy way to enter multiple values like the other platforms mentioned all the other questions.

I went ahead and entered multiple TXT entries with the same name:

entry    type   value
[z._domainkey] [TXT] [v=DKIM1;k=rsa;...]
[z._domainkey] [TXT] [...restofkey]

which does show on my queries, but sometimes out of order:

$ drill txt z._domainkey.example.com.
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 7181
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; z._domainkey.example.com.       IN      TXT

;; ANSWER SECTION:
z._domainkey.example.com.  1796    IN      TXT     "v=DKIM1;k=rsa;"
z._domainkey.example.com.  1796    IN      TXT     "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAh957KTmtf+f1GCrdVKydz2x0NDs1Cx/g/AYIlx2QcyOpXzd3DNC8saykKjfwYEIGq47UdnLQdJztINPu5QsphwSnpQiGqV28EltNp1poNNeUwSno7vrUTQI44vkD7OosCh+yLVD5AWCqxOr0l4C6kp2UuXvEc6zANPQrbOuVABm"
z._domainkey.example.com.  1796    IN      TXT     "Gf2nLFvcR4iswFC3JpLOdZr259BelASlU2WApIeDK/a8Qo096WzpFCeFtamIxZFkeHdCSmrS7zrtDrxxvXzYhXIFharkWeY5cXKzZ7vUGR14Zie9gzNzoz5NoibngkBH6dw5C70lU5ynVwx+/U+TCEKOZu1X9K/ZC5/1NrsW83QIDAQAB"

(already tried to split right on the middle, in 64bytes like base64 usually is, using online splitter tools, in two, 3 and 4 pieces. all give the same end result)

all validators (including the one from my MX handler) says that is invalid.

Is there anything else i have to do to split the values? do i have to repeat the p= part or something else? how DNS clients know the order to concatenate the multiple TXT entries? why validation tools that give the split values also fail to validate them when split? e.g. https://www.mailhardener.com/tools/dns-record-splitter

all validators just show one record that has the v=DKIM1;k=rsa;p=... part as a invalid dkim record, and the one that is just the continuation of the key as an entirely different record that is not even a valid dkim.

for example https://dkimcore.org/c/keycheck says

* v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0... (This might be a valid DKIM record)
* r259BelASlU2WApIeDK/a8Qo096WzpFCeFtam... (This doesn't look like a DKIM record)

I have a systemd host with 4 ethernet ports.

one port is reserved for isolated containers. It is set as:

# /etc/systemd/network/20-eth3-reserved.network
[Match]
Name=eth3
[Link]
Unmanaged=yes

I also set aliases for the ports, each on its link file, e.g.

# /etc/systemd/network/12-alias-eth3.link
[Match]
MACAddress=42:42:42:42:42:03
[Link]
Name=eth3

I would later use the unmanaged interface in a systemd-nspawn container with

# /etc/systemd/nspawn/container1.nspawn
...
[Network]
Private=yes
VirtualEthernet=no
Interface=eth3

At some point (Sept) it was working fine. But a few months ago, the interface with unmanaged setting just vanishes from the system.

nspawn fails to bring up the container saying the interface was not found.

ip link shows no eth3, nor the mac address.

lshw weirdly shows all managed ports, but DO NOT list the macaddress (serial field) for the disabled one.

dmesg shows all ports just fine, and list the correct mac address of them all, including disabled one. Later on, it also show the alias being applied!

[Wed Nov 10 11:44:31 2021] igb 0000:03:00.3 eth3: renamed from enps0f4

So systemd does see the device just fine even after the problem started.

networkclt shows all managed ports plus lo as unmanaged. But no sign of eth3.

I don't mind finding the solution to this if there's a better way to 'reserve' a physical interface to be used with nspawn instead of Unmanaged=yes

Is it possible to reload changes in /etc/systemd/network/* in a live system?

already tried systemctl daemon-reload, systemctl restart systemd-networkd.service, networkctl... nothing seems to avoid a full reboot.

one common paradigm on all other syslog implementations (rsyslog, syslog-ng, readlog, etc) is to exchange log entries via UDP514 in plain text format.

How do I enable systemd-journal-remote to receive logs in such format?

(I know there are plugins to more complex log providers to emulate the new https format used by default by systemd-journal-remote, but i'm dealing with dumb appliances that can only send the old, original, plain text format)

I am looking for factual knowledge or actual measurements to validate or not my idea. Please, hold answers without data just saying it is a weird idea because not the most common setup.

short question: Are the concrete problems on running two raids such as

sda    sdb  
sda1 + sdb1 => raid0 md1
sda2 + sdb2 => raid1 md2

both disks are GPT partitions with same model and layout. there's also spare disks with a single partition acting as spares for md1.

long version: I have a small server that had 2 HDD software raid1 (mdadm) for backup data. Data usage is very low (<10%). and 2 HDD for raid0 (disposable vm images).

I am now replacing the (still good) old drivers with new ones and the capacity is much bigger. My plan was to just increase the raid capacities, but now i am thinking about keeping the same and using partition raid instead of whole disk (that alone seems to offer many benefits)

My idea now is to partition the new driver (double capacity) in two partitions. One for raid0 another for raid1. both doesn't see much use other than occasional spikes (that are almost guaranteed to not happen at the same time as backups happen when the vm pool is offline)

I've set up a bridged network vm (i.e. virtual network hub, vm:192.168.1.2, host real network card: 192.168.1.1)

There's no network cable. As I do not care for one on this host->vm setup.

The vm sets up the network just fine.

On the host, ifup enp3s0 and ip link set enp3s0 up and networkctl up enp3s0 all exit with status code 0 but none do bring the interface up (nor generate any log messages anywhere i can see). As soon as I plug in a cable to the network I do not care about, even if just a dummy load for the level 3, everything starts up and works fine.

What is the correct way to actually bring the interface up onto the virtual HUB, without caring for a irrelevant physical cable?

(Some other answers to this problem mention wicd/network-manager causing problems. I do not have them on my system.)

For one service I need a couple directories available inside /tmp. But I also want to use systemd's PrivateTmp=yes. Is there something like AssertPathExists=/tmp/x that also creates the path?

Systemd has a nice feature that is private temporary directory (/tmp). But it is not clear from the dense manual what are the correct ways to use it and implementation gotchas (get the feeling the manual is more a spec for devs and contributors)

Enabling this setting has the side effect of adding Requires= and After= dependencies on all mount units necessary to access /tmp and /var/tmp.

from https://www.freedesktop.org/software/systemd/man/systemd.exec.html#PrivateTmp=

This is a little cryptic for non-systemd-insiders. I am assuming my filesystem, which for simplicity sake let's say i only have /, will receive a Requires=, guess it is left as an exercise to figure out what it will require... maybe i should put the homework tag here? :)

Starting on https://www.freedesktop.org/software/systemd/man/systemd.mount.html#x-systemd.requires=

But that doesn't sound right. It says that Requires= on mount units are only for hierarchy. I guess.

Let's move on to https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Requires=

But this also does not explain anything. It only says that one unit may require another. I guess.

I'm (wildly) guessing it uses https://www.freedesktop.org/software/systemd/man/systemd.exec.html#ReadWritePaths= So in my example the systemd unit mount for / will have a Requires=[BindPaths=[/tmp/systemd-noise,/tmp]] or however one writes that in systemd-speak?

let's ask systemd

# systemctl show httpd
...
Requires=system.slice sysinit.target -.mount tmp.mount
...
RequiresMountsFor=/tmp /var/tmp

Not very helpful either.

I'm trying to wrap my head mostly on:

1) how exactly systemd denies access to the actual /tmp on the filesystem. And

2) how the process (let's say a cgi running from a systemd started apache) can figure out where the /tmp it have access to is at?

I do not have any need for Authentication/authorization modules on apache2.4, so I proceed to comment out all the Auth modules and all the Require directives.

The server goes up fine, but i get a 500 error for everything. And the logs show

AH00025: configuration error:  couldn't check user: /<path-requested>

Every mention of that error just repeats "enable mod_authz_core.so". Can't even find that error in the source.

The documentation says "If you have information on your web site that is sensitive or intended for only a small group of people, the techniques in this article will help you make sure that the people that see those pages are the people that you wanted to see them." but ignores the case where you do not have sensitive information :)

here is the list of installed modules

Compiled in modules:
  core.c
  mod_so.c
  http_core.c

Here's my conf file (with mod_authz_core+Require commented, to show what i must add to 'workaround'):

ServerRoot "/etc/httpd"

Listen 8000

LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
    StartServers             5
    MinSpareServers          5
    MaxSpareServers         10
    MaxRequestWorkers      250
    MaxConnectionsPerChild   0

#LoadModule authz_core_module modules/mod_authz_core.so
LoadModule reqtimeout_module modules/mod_reqtimeout.so
LoadModule log_config_module modules/mod_log_config.so
  ErrorLog "/var/log/httpd/error_log"
  LogLevel warn
  LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
  LogFormat "%h %l %u %t \"%r\" %>s %b" common
  CustomLog "/var/log/httpd/access_log" common

LoadModule env_module modules/mod_env.so
LoadModule headers_module modules/mod_headers.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
LoadModule unixd_module modules/mod_unixd.so
  User http
  Group http

LoadModule status_module modules/mod_status.so
<Location "/status">
    SetHandler server-status
</Location>

LoadModule dir_module modules/mod_dir.so
  DirectoryIndex index.html
  DirectorySlash Off

LoadModule php7_module modules/libphp7.so

ServerAdmin [email protected]
ServerName localhost:8000

<Directory />
    AllowOverride none
    #Require all denied
</Directory>

DocumentRoot "/srv/http"
<Directory "/srv/http">
    <FilesMatch "\.html$">
        SetHandler application/x-httpd-php
    </FilesMatch>
    Options -Indexes -FollowSymLinks
    #Require all granted
</Directory>

Timeout 60
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5
UseCanonicalName On
AccessFileName off
ServerTokens Full
ServerSignature Off
HostnameLookups Off

here's a sample session:

$ apachectl configtest
Syntax OK

$ sudo sudo -u http cat /srv/http/index.html
(make sure http user can access the files, all OK)

$ sudo systemctl restart httpd

$ tail -f -c0 /var/log/httpd/*

now i request /index.html...

==> /var/log/httpd/error_log <==
[datetime] [core:crit] [pid 3978] [client ip:62758] AH00025: configuration error:  couldn't check user: /index.html

==> /var/log/httpd/access_log <==
ip - - [datetime] "GET /index.html HTTP/1.1" 500 528

==> /var/log/httpd/error_log <==
[datetime] [core:crit] [pid 3975] [client ip:62759] AH00025: configuration error:  couldn't check user: /favicon.ico

==> /var/log/httpd/access_log <==
ip - - [datetime] "GET /favicon.ico HTTP/1.1" 500 528

I'm running commands on a remote host via ssh where i'd like to have locale vars set. I do not care about the full profile scripts from a true interactive shell, just the locale vars.

The minimum test is to have ssh remotehost locale to output something other than "POSIX" or empty values.

I already tried to set SendEnv LANG on my ssh config. But that did not work.

The only workaround that does work is to manually export the locale to a hardcoded value each time i run a command. e.g. ssh vma LANG=en_US.utf-8 locale or more realistically ssh vma export LANG=en_US.utf-8; series; of; commands;

default shell is bash but i'm guessing a possible solution would be on the ssh side alone?

This is a follow up on How to make the 'less' command handle UTF-8?

If I want to set options for less globally, so that each user doesn't have to fiddle with their own env vars (.basrc, etc) individually, where should it be set?

/etc/bashrc is not a good option as then I'd have to set one up for each shell.

The man page for less mention a lesskey file that has a #env section where i can set this, but there is no mention of where to put it. It does mention that I can use env vars LESSKEY_SYSTEM and LESSKEY to point to the file... but that creates a chicken vs egg problem.

Other distros man pages mention /usr/local/etc/sysless but that is not used on ubuntu from my tests.

I have ForwardAgent yes for a few hosts. One of them started failing recently and I can't find the reason.

when I ssh to all hosts and execute ssh-add -l i can see one key just fine. If i ssh to that one host, i get "Could not open a connection to your authentication agent."

I already tried ssh agent forwarding fails with "Could not open a connection to your authentication agent" but it wasn't applicable in my case. I get no debug statement about not being able to write to /tmp as that one did.

here is my ssh -vvv output:

...
debug1: Authentication succeeded (publickey).
Authenticated to host_that_fails ([1.2.3.4]:22).
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug2: callback start
debug1: Requesting authentication agent forwarding.
debug2: channel 0: request [email protected] confirm 0
debug2: fd 3 setting TCP_NODELAY
debug3: ssh_packet_set_tos: set IP_TOS 0x10
debug2: client_session2_setup: id 0
debug2: channel 0: request pty-req confirm 1
debug1: Sending environment.
...
debug1: Sending env LANG = en_US.UTF-8
debug2: channel 0: request env confirm 0
...

One the failing host I can see the env variables

SSH_CLIENT=1.2.3.1 45320 22
SSH_TTY=/dev/pts/0
SSH_CONNECTION=1.2.3.1 45320 1.2.3.4

on the hosts that still work i can also see SSH_AUTH_SOCK

Anyone have any idea what is going wrong here?

this is probably expanding on Using Rsync to backup to an external drive

I usually, manually, back up my data to an external drive. I start by creating a directory on the external drive with today's date and coping the important data there. That way i have a backup for system error and for human error (just go to the previous date)

Is there any way to automate that with rsync? or maybe something like rsyncing a "transparent" git repository (everything automatically commited at certain daily or hourly intervals) with my local data if that isn't too crazy? Also how bad would be scouring such repo after a year of automated backups?

or just plain rsync, but having something like daily backups as long as there is space on the external drive?

data are mostly small text files (text, source code) or medium pictures (~6mb) but by the hundreds of thousands.

I just uploaded my public key to a server, ensured permissions are right, and when i try to log it simply refuses it.

after enabling loglevel DEBUG in sshd_config i get:

Nov 22 06:53:36 host-1 sshd[8612]: debug1: Forked child 8617.
Nov 22 06:53:36 host-1 sshd[8617]: Set /proc/self/oom_score_adj to 0
Nov 22 06:53:36 host-1 sshd[8617]: debug1: rexec start in 5 out 5 newsock 5 pipe 7 sock 8
Nov 22 06:53:36 host-1 sshd[8617]: debug1: inetd sockets after dupping: 3, 3
Nov 22 06:53:36 host-1 sshd[8617]: Connection from some_ip port 50466
Nov 22 06:53:36 host-1 sshd[8617]: debug1: HPN Disabled: 0, HPN Buffer Size: 87380
Nov 22 06:53:36 host-1 sshd[8617]: debug1: Client protocol version 2.0; client software version OpenSSH_6.0p1 Debian-3
Nov 22 06:53:36 host-1 sshd[8617]: SSH: Server;Ltype: Version;Remote: some_ip-50466;Protocol: 2.0;Client: OpenSSH_6.0p1 Debian-3
Nov 22 06:53:36 host-1 sshd[8617]: debug1: match: OpenSSH_6.0p1 Debian-3 pat OpenSSH*
Nov 22 06:53:36 host-1 sshd[8617]: debug1: Remote is NON-HPN aware
Nov 22 06:53:36 host-1 sshd[8617]: debug1: Enabling compatibility mode for protocol 2.0
Nov 22 06:53:36 host-1 sshd[8617]: debug1: Local version string SSH-2.0-OpenSSH_5.8p1-hpn13v10
Nov 22 06:53:36 host-1 sshd[8617]: debug1: Config token is loglevel
Nov 22 06:53:36 host-1 sshd[8617]: debug1: Config token is passwordauthentication
Nov 22 06:53:36 host-1 sshd[8617]: debug1: Config token is permitemptypasswords
Nov 22 06:53:36 host-1 sshd[8617]: debug1: Config token is usepam
Nov 22 06:53:36 host-1 sshd[8617]: debug1: Config token is subsystem
Nov 22 06:53:36 host-1 sshd[8617]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
Nov 22 06:53:36 host-1 sshd[8617]: debug1: trying public key file /home/xxx/.ssh/authorized_keys
Nov 22 06:53:36 host-1 sshd[8617]: debug1: fd 4 clearing O_NONBLOCK
Nov 22 06:53:36 host-1 sshd[8617]: debug1: restore_uid: 0/0
Nov 22 06:53:36 host-1 sshd[8617]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
Nov 22 06:53:36 host-1 sshd[8617]: debug1: trying public key file /home/xxx/.ssh/authorized_keys2
Nov 22 06:53:36 host-1 sshd[8617]: debug1: Could not open authorized keys '/home/xxx/.ssh/authorized_keys2': No such file or directory
Nov 22 06:53:36 host-1 sshd[8617]: debug1: restore_uid: 0/0
Nov 22 06:53:36 host-1 sshd[8617]: Failed publickey for xxx from some_ip port 50466 ssh2
Nov 22 06:53:36 host-1 sshd[8617]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
Nov 22 06:53:36 host-1 sshd[8617]: debug1: trying public key file /home/xxx/.ssh/authorized_keys
Nov 22 06:53:36 host-1 sshd[8617]: debug1: fd 4 clearing O_NONBLOCK
Nov 22 06:53:36 host-1 sshd[8617]: debug1: restore_uid: 0/0
Nov 22 06:53:36 host-1 sshd[8617]: debug1: temporarily_use_uid: 1000/1000 (e=0/0)
Nov 22 06:53:36 host-1 sshd[8617]: debug1: trying public key file /home/xxx/.ssh/authorized_keys2
Nov 22 06:53:36 host-1 sshd[8617]: debug1: Could not open authorized keys '/home/xxx/.ssh/authorized_keys2': No such file or directory
Nov 22 06:53:36 host-1 sshd[8617]: debug1: restore_uid: 0/0
Nov 22 06:53:36 host-1 sshd[8617]: Failed publickey for xxx from some_ip port 50466 ssh2
Nov 22 06:53:36 host-1 sshd[8617]: debug1: do_cleanup

it keep trying authorized_keys2 (which i though were deprecated everywhere) but it does open authorized_keys at some time (the correct file with my keys) and then says absolutely nothing more about it and goes back to authorized_keys2

what's wrong here?

I do have in my sshd_config:

PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys

and there's no authorized_keys2 string in that file anywhere. And yes, sshd restarted before tests.

I guess i can just use authorized_keys2 but want to understand what's happening here. Any clues?

edit: ssh -v host

client$ ssh -v host
OpenSSH_6.0p1 Debian-3, OpenSSL 1.0.1c 10 May 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to host [someip] port 22.
debug1: Connection established.
debug1: identity file /home/xxx/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-2048
debug1: identity file /home/xxx/.ssh/id_rsa-cert type -1
debug1: identity file /home/xxx/.ssh/id_dsa type 2
debug1: Checking blacklist file /usr/share/ssh/blacklist.DSA-1024
debug1: Checking blacklist file /etc/ssh/blacklist.DSA-1024
debug1: identity file /home/xxx/.ssh/id_dsa-cert type -1
debug1: identity file /home/xxx/.ssh/id_ecdsa type -1
debug1: identity file /home/xxx/.ssh/id_ecdsa-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.8p1-hpn13v10
debug1: match: OpenSSH_5.8p1-hpn13v10 pat OpenSSH_5*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-3
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA xx:xx...
debug1: Host 'host' is known and matches the ECDSA host key.
debug1: Found key in /home/xxx/.ssh/known_hosts:11
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering DSA public key: /home/xxx/.ssh/id_dsa
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Offering RSA public key: /home/xxx/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Trying private key: /home/xxx/.ssh/id_ecdsa
debug1: Next authentication method: keyboard-interactive
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: password
xxx@host's password: