From ilug-admin@linux.ie  Thu Aug  1 18:02:33 2002
Return-Path: <ilug-admin@linux.ie>
Delivered-To: yyyy@localhost.netnoteinc.com
Received: from localhost (localhost [127.0.0.1])
	by phobos.labs.netnoteinc.com (Postfix) with ESMTP id 7753B440F3
	for <jm@localhost>; Thu,  1 Aug 2002 13:02:31 -0400 (EDT)
Received: from phobos [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Thu, 01 Aug 2002 18:02:31 +0100 (IST)
Received: from lugh.tuatha.org (root@lugh.tuatha.org [194.125.145.45]) by
    dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g71H1m223009 for
    <jm-ilug@jmason.org>; Thu, 1 Aug 2002 18:01:48 +0100
Received: from lugh (root@localhost [127.0.0.1]) by lugh.tuatha.org
    (8.9.3/8.9.3) with ESMTP id RAA23165; Thu, 1 Aug 2002 17:58:27 +0100
X-Authentication-Warning: lugh.tuatha.org: Host root@localhost [127.0.0.1]
    claimed to be lugh
Received: from relay.dub-t3-1.nwcgroup.com
    (postfix@relay.dub-t3-1.nwcgroup.com [195.129.80.16]) by lugh.tuatha.org
    (8.9.3/8.9.3) with ESMTP id RAA23139 for <ilug@linux.ie>; Thu,
    1 Aug 2002 17:58:21 +0100
Received: from mail.magicgoeshere.com (unknown [194.125.152.60]) by
    relay.dub-t3-1.nwcgroup.com (Postfix) with ESMTP id 8832270088 for
    <ilug@linux.ie>; Thu,  1 Aug 2002 15:43:41 +0100 (IST)
Received: from bagend.magicgoeshere.com (ts10-012.dublin.indigo.ie
    [194.125.174.139]) by mail.magicgoeshere.com (Postfix) with ESMTP id
    5D837F9A3 for <ilug@linux.ie>; Thu,  1 Aug 2002 15:28:24 +0100 (IST)
Received: by bagend.magicgoeshere.com (Postfix, from userid 501) id
    A11C83D976; Thu,  1 Aug 2002 15:51:12 +0100 (IST)
Date: Thu, 1 Aug 2002 15:51:12 +0100
From: Niall O Broin <niall@linux.ie>
To: ilug@linux.ie
Message-Id: <20020801145112.GB2500@bagend.makalumedia.com>
Reply-To: ilug@linux.ie
Mail-Followup-To: Niall O Broin <niall@linux.ie>, ilug@linux.ie
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.3.27i
Subject: [ILUG] Strange ssh problem
Sender: ilug-admin@linux.ie
Errors-To: ilug-admin@linux.ie
X-Mailman-Version: 1.1
Precedence: bulk
List-Id: Irish Linux Users' Group <ilug.linux.ie>
X-Beenthere: ilug@linux.ie

I have a strange problem with one user in a small network using ssh.
Everyone in the network uses ssh and they run an ssh-agent on login. This
works fine for conveniently wandering around the network and to some of our
external boxes - or did, until today. Suddenly, when one user (alfred) tries
to ssh anywhere he's asked for a password. He says He changed nothing (don't
they all) but I do actually believe him. I used ssh-keygen to make new keys
but that didn't help. 

I created a new user alfio into whose home directory I copied alfred's .ssh
directory - alfio can wander around free as a bird without being asked for a
password ever (except of course for the passphrase to load the identiy into
the agent).

In case there was something else in Alfred' environment, I copied .??* from
alfred's home directory to alfio's, remembering to change ownership
afterwards. Still alfio is as free as a bird.

We use only SSH2 with DSA keys. An extract from a ssh -v for alfio is below

debug1: got SSH2_MSG_SERVICE_ACCEPT
debug1: authentications that can continue: publickey,password
debug1: next auth method to try is publickey
debug1: userauth_pubkey_agent: testing agent key /home/alfio/.ssh/id_dsa
debug1: input_userauth_pk_ok: pkalg ssh-dss blen 434 lastkey 0x80916f0 hint -1
debug1: ssh-userauth2 successful: method publickey

and before starting this ssh attempt, ssh-add -l for alfio said:

1024 07:4c:7c:90:0d:28:41:3a:95:c2:81:3d:ba:c4:3d:03 /home/alfio/.ssh/id_dsa (DSA)

whereas with alfred the same segment of the debug log went

debug1: got SSH2_MSG_SERVICE_ACCEPT
debug1: authentications that can continue: publickey,password
debug1: next auth method to try is publickey
debug1: userauth_pubkey_agent: testing agent key /nfshome/alfred/.ssh/id_dsa
debug1: authentications that can continue: publickey,password

and before starting this ssh attempt, ssh-add -l for alfred said:

1024 07:4c:7c:90:0d:28:41:3a:95:c2:81:3d:ba:c4:3d:03 /home/alfred/.ssh/id_dsa (DSA)


This problem is definitely related to alfred as a user - it happens when he
logs in on differing workstations (all NFS mounting the same home
directories) and the other users (including good old alfio) don't have any
problems.


Niall

-- 
Irish Linux Users' Group: ilug@linux.ie
http://www.linux.ie/mailman/listinfo/ilug for (un)subscription information.
List maintainer: listmaster@linux.ie