RE: [Jailkit-users] Trouble with authorized_keys2 file

[Jason Richard]

Wow, I apparently am too tired and should go home.  I could have swore I 
checked that.  Changed it to nfm:nfm and it is working perfect.  Thanks

Jason

-----Original Message-----
From: address@hidden [mailto:address@hidden On Behalf Of Lincoln Zuljewic Silva
Sent: Tuesday, September 21, 2010 1:14 PM
To: address@hidden
Subject: Re: [Jailkit-users] Trouble with authorized_keys2 file

Why the owner of the /home/retail/nfm/.ssh is root?

It should be "nfm".

 $ cd nfm/
 $ ls -la
total 28
drwxr--r-- 3 nfm  nfm  4096 Sep 21 08:26 ./
drwxr-xr-x 3 root root 4096 Sep 21 12:23 ../
-rw-r--r-- 1 nfm  nfm    34 Sep 21 08:19 .bash_logout
-rw-r--r-- 1 nfm  nfm   176 Sep 21 08:19 .bash_profile
-rw-r--r-- 1 nfm  nfm  1790 Sep 21 08:19 .bashrc
-rw-r--r-- 1 nfm  nfm   515 Sep 21 08:19 .emacs
drwx------ 2 root root 4096 Sep 21 12:36 .ssh/     <----#####

Regards,
Lincoln

On Tue, Sep 21, 2010 at 3:10 PM, Jason Richard
<address@hidden> wrote:
> I couldn't find much in the log, so I turned on debug.  I see it trying to 
> look at the authorized_keys2 file, but than fails, but doesn't say why.  The 
> uid for the user nfm is 612 and the nfm group is 606, so those look right.
>
> Sep 21 12:58:10 sccr101_temp sshd[23488]: debug1: rexec start in 4 out 4 
> newsock 4 pipe 6 sock 7
> Sep 21 12:58:10 sccr101_temp sshd[23301]: debug1: Forked child 23488.
> Sep 21 12:58:10 sccr101_temp sshd[23488]: debug1: inetd sockets after 
> dupping: 3, 3
> Sep 21 12:58:10 sccr101_temp sshd[23488]: Connection from 172.23.1.213 port 
> 1596
> Sep 21 12:58:10 sccr101_temp sshd[23488]: debug1: Client protocol version 
> 2.0; client software version WinSCP_release_4.2.8
> Sep 21 12:58:10 sccr101_temp sshd[23488]: debug1: no match: 
> WinSCP_release_4.2.8
> Sep 21 12:58:10 sccr101_temp sshd[23488]: debug1: Enabling compatibility mode 
> for protocol 2.0
> Sep 21 12:58:10 sccr101_temp sshd[23488]: debug1: Local version string 
> SSH-2.0-OpenSSH_4.3
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: permanently_set_uid: 74/74
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: list_hostkey_types: 
> ssh-rsa,ssh-dss
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: SSH2_MSG_KEXINIT sent
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: SSH2_MSG_KEXINIT received
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: kex: client->server 
> aes256-ctr hmac-sha1 none
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: kex: server->client 
> aes256-ctr hmac-sha1 none
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: 
> SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: SSH2_MSG_KEX_DH_GEX_GROUP 
> sent
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: expecting 
> SSH2_MSG_KEX_DH_GEX_INIT
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: SSH2_MSG_KEX_DH_GEX_REPLY 
> sent
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: SSH2_MSG_NEWKEYS sent
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: expecting SSH2_MSG_NEWKEYS
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: SSH2_MSG_NEWKEYS received
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: KEX done
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: userauth-request for user 
> nfm service ssh-connection method none
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: attempt 0 failures 0
> Sep 21 12:58:10 sccr101_temp sshd[23488]: debug1: PAM: initializing for "nfm"
> Sep 21 12:58:10 sccr101_temp sshd[23488]: debug1: PAM: setting PAM_RHOST to 
> "sccr350.securitycoverage.com"
> Sep 21 12:58:10 sccr101_temp sshd[23488]: debug1: PAM: setting PAM_TTY to 
> "ssh"
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: userauth-request for user 
> nfm service ssh-connection method publickey
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: attempt 1 failures 1
> Sep 21 12:58:10 sccr101_temp sshd[23489]: debug1: test whether pkalg/pkblob 
> are acceptable
> Sep 21 12:58:10 sccr101_temp sshd[23488]: debug1: temporarily_use_uid: 
> 612/606 (e=0/0)
> Sep 21 12:58:10 sccr101_temp sshd[23488]: debug1: trying public key file 
> /home/retail/nfm/./home/nfm/.ssh/authorized_keys2
> Sep 21 12:58:10 sccr101_temp sshd[23488]: debug1: restore_uid: 0/0
> Sep 21 12:58:10 sccr101_temp sshd[23488]: debug1: temporarily_use_uid: 
> 612/606 (e=0/0)
> Sep 21 12:58:10 sccr101_temp sshd[23488]: debug1: trying public key file 
> /home/retail/nfm/./home/nfm/.ssh/authorized_keys2
> Sep 21 12:58:10 sccr101_temp sshd[23488]: debug1: restore_uid: 0/0
> Sep 21 12:58:10 sccr101_temp sshd[23488]: Failed publickey for nfm from 
> 172.23.1.213 port 1596 ssh2
>
> -----Original Message-----
> From: address@hidden [mailto:address@hidden On Behalf Of Lincoln Zuljewic 
> Silva
> Sent: Tuesday, September 21, 2010 1:07 PM
> To: address@hidden
> Subject: Re: [Jailkit-users] Trouble with authorized_keys2 file
>
> Does /var/log/secure say something?
>
> Probably a problem with the $HOME of the user...
>
> Regards,
> Lincoln
>
> On Tue, Sep 21, 2010 at 2:43 PM, Jason Richard
> <address@hidden> wrote:
>> I created a user using the below commands.  I can log in when I use the
>> password, but I am trying to setup the authorized_keys2 file and that is not
>> working.  I looked at other threads about this and they all say to check the
>> permissions.  I'm pretty sure I have them right, but I have included a full
>> list of the directory tree as well.  Anyone have any ideas what I might be
>> missing?  If necessary, this is on a CentOS 5.5 machine.  Thanks
>>
>>
>>
>> jk_init -v -j /home/retail/nfm jk_lsh scp sftp
>>
>> groupadd nfm
>>
>> useradd nfm -g nfm
>>
>> echo test_pass | passwd --stdin nfm
>>
>> jk_cp -j /home/retail/nfm /usr/sbin/jk_lsh
>>
>> jk_jailuser -m -j /home/retail/nfm/ nfm
>>
>> chown nfm:nfm /home/retail/nfm/home/nfm
>>
>> echo "[nfm]" > /home/retail/nfm/etc/jailkit/jk_lsh.ini
>>
>> echo "paths= /usr/libexec/openssh/" >>
>> /home/retail/nfm/etc/jailkit/jk_lsh.ini
>>
>> echo "executables= /usr/libexec/openssh/sftp-server" >>
>> /home/retail/nfm/etc/jailkit/jk_lsh.ini
>>
>> echo "allow_word_expansion = 0" >> /home/retail/nfm/etc/jailkit/jk_lsh.ini
>>
>> echo "umask = 002" >> /home/retail/nfm/etc/jailkit/jk_lsh.ini
>>
>>
>>
>>
>>
>> $ cd /home/retail/
>>
>>  $ ls -la
>>
>> total 32
>>
>> drwxr-xr-x 7 root root 4096 Sep 21 08:19 ./
>>
>> drwxr-xr-x 8 root root 4096 Sep 21 09:21 ../
>>
>> drwxr-xr-x 7 root root 4096 Sep 21 08:14 amtv/
>>
>> drwxr-xr-x 7 root root 4096 Sep 21 08:19 assurant/
>>
>> drwxr-xr-x 7 root root 4096 Sep 21 08:19 electronic_express/
>>
>> drwxr-xr-x 7 root root 4096 Sep 21 12:40 nfm/
>>
>> drwxr-xr-x 7 root root 4096 Sep 21 08:19 ntelos/
>>
>>  $ cd nfm/
>>
>>  $ ls -la
>>
>> total 28
>>
>> drwxr-xr-x 7 root root 4096 Sep 21 12:40 ./
>>
>> drwxr-xr-x 7 root root 4096 Sep 21 08:19 ../
>>
>> drwxr-xr-x 2 root root 4096 Sep 21 12:20 dev/
>>
>> drwxr-xr-x 3 root root 4096 Sep 21 12:28 etc/
>>
>> drwxr-xr-x 3 root root 4096 Sep 21 12:23 home/
>>
>> drwxr-xr-x 2 root root 4096 Sep 21 08:19 lib/
>>
>> drwxr-xr-x 5 root root 4096 Sep 21 08:19 usr/
>>
>>  $ cd home/
>>
>>  $ ls -la
>>
>> total 12
>>
>> drwxr-xr-x 3 root root 4096 Sep 21 12:23 ./
>>
>> drwxr-xr-x 7 root root 4096 Sep 21 12:40 ../
>>
>> drwxr--r-- 3 nfm  nfm  4096 Sep 21 08:26 nfm/
>>
>>  $ cd nfm/
>>
>>  $ ls -la
>>
>> total 28
>>
>> drwxr--r-- 3 nfm  nfm  4096 Sep 21 08:26 ./
>>
>> drwxr-xr-x 3 root root 4096 Sep 21 12:23 ../
>>
>> -rw-r--r-- 1 nfm  nfm    34 Sep 21 08:19 .bash_logout
>>
>> -rw-r--r-- 1 nfm  nfm   176 Sep 21 08:19 .bash_profile
>>
>> -rw-r--r-- 1 nfm  nfm  1790 Sep 21 08:19 .bashrc
>>
>> -rw-r--r-- 1 nfm  nfm   515 Sep 21 08:19 .emacs
>>
>> drwx------ 2 root root 4096 Sep 21 12:36 .ssh/
>>
>>  $ cd .ssh/
>>
>>  $ ls -la
>>
>> total 16
>>
>> drwx------ 2 root root 4096 Sep 21 12:36 ./
>>
>> drwxr--r-- 3 nfm  nfm  4096 Sep 21 08:26 ../
>>
>> -rw------- 1 nfm  nfm  1430 Sep 21 12:13 authorized_keys
>>
>> -rw------- 1 nfm  nfm  1429 Sep 21 12:36 authorized_keys2
>>
>>
>>
>>
>>
>> Jason
>>
>> _______________________________________________
>> Jailkit-users mailing list
>> address@hidden
>> http://lists.nongnu.org/mailman/listinfo/jailkit-users
>>
>>
>
>
>
> --
> Lincoln Zuljewic Silva
> More contact info.: http://www.system.adm.br/contact.php
>
> "How often must a question be asked before it's considered a
> frequently asked question?"
>
> _______________________________________________
> Jailkit-users mailing list
> address@hidden
> http://lists.nongnu.org/mailman/listinfo/jailkit-users
>
> _______________________________________________
> Jailkit-users mailing list
> address@hidden
> http://lists.nongnu.org/mailman/listinfo/jailkit-users
>



-- 
Lincoln Zuljewic Silva
More contact info.: http://www.system.adm.br/contact.php

"How often must a question be asked before it's considered a
frequently asked question?"

_______________________________________________
Jailkit-users mailing list
address@hidden
http://lists.nongnu.org/mailman/listinfo/jailkit-users