Ce site est optimisé pour être consulté depuis un navigateur moderne dans lequel JavaScript est activé.

SSH comportement bizarre sur nouvelle install

Nab!!daN

Salut a tous,

Voila je viens d'installer un lucid en VM et un problème très bizarre est arrive, comme les logs sont significatif, les voila:

:~$ sudo apt-get install ssh
[sudo] password for xyz: 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libfont-freetype-perl
Use 'apt-get autoremove' to remove them.
The following extra packages will be installed:
  openssh-server
Suggested packages:
  rssh molly-guard openssh-blacklist openssh-blacklist-extra
The following NEW packages will be installed:
  openssh-server ssh
0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
Need to get 0B/305kB of archives.
After this operation, 860kB of additional disk space will be used.
Do you want to continue [Y/n]? 
Preconfiguring packages ...
Selecting previously deselected package openssh-server.
(Reading database ... 186544 files and directories currently installed.)
Unpacking openssh-server (from .../openssh-server_1%3a5.3p1-3ubuntu3_amd64.deb) ...
Selecting previously deselected package ssh.
Unpacking ssh (from .../ssh_1%3a5.3p1-3ubuntu3_all.deb) ...
Processing triggers for ureadahead ...
ureadahead will be reprofiled on next reboot
Processing triggers for ufw ...
Processing triggers for man-db ...
Setting up openssh-server (1:5.3p1-3ubuntu3) ...
Creating SSH2 RSA key; this may take some time ...
Creating SSH2 DSA key; this may take some time ...
 * Stopping OpenBSD Secure Shell server sshd                                                                                                                                                            [ OK ] 
ssh start/running, process 2369

Setting up ssh (1:5.3p1-3ubuntu3) ...

jusque la rien de bien grave mais lors de la premiere connection (malgré le YES):

ssh xyz@127.0.0.1
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
RSA key fingerprint is 1b:ff:c2:91:a8:fe:b0:d8:87:e5:c2:84:c9:75:06:bc.
Are you sure you want to continue connecting (yes/no)? 
Host key verification failed.

C'est etonnant alors que je n'ais meme pas ouvert le /etc/sshd_conf ...

ssh -v localhost
OpenSSH_5.3p1 Debian-3ubuntu3, OpenSSL 0.9.8k 25 Mar 2009
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to localhost [::1] port 22.
debug1: Connection established.
debug1: identity file /home/xyz/.ssh/identity type -1
debug1: identity file /home/xyz/.ssh/id_rsa type -1
debug1: identity file /home/xyz/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3p1 Debian-3ubuntu3
debug1: match: OpenSSH_5.3p1 Debian-3ubuntu3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu3
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
The authenticity of host 'localhost (::1)' can't be established.
RSA key fingerprint is 1b:ff:c2:91:a8:fe:b0:d8:87:e5:c2:84:c9:75:06:bc.
Are you sure you want to continue connecting (yes/no)? 
Host key verification failed.

Des idées car la je suis perplexe et surtout sacrement étonné !

[supprimé]

Salut,

Essaye d'effacer le fichier known_hosts

rm ~/.ssh/known_hosts

puis reconnecte toi et réponds yes à la question

Are you sure you want to continue connecting (yes/no)?

Nab!!daN

Salut

Comme il n'y a jamais eu de connection reussit le fichier existe pas 🙂

Bon le sshd_conf a une drôle de tête, me souviens pas de cette tête sous ubuntu !

# This is the ssh client system-wide configuration file.  See
# ssh_config(5) for more information.  This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.

# Configuration data is parsed as follows:
#  1. command line options
#  2. user-specific file
#  3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.

# Site-wide defaults for some commonly used options.  For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.

Host *
#   ForwardAgent no
#   ForwardX11 no
#   ForwardX11Trusted yes
#   RhostsRSAAuthentication no
#   RSAAuthentication yes
#   PasswordAuthentication yes
#   HostbasedAuthentication no
#   GSSAPIAuthentication no
#   GSSAPIDelegateCredentials no
#   GSSAPIKeyExchange no
#   GSSAPITrustDNS no
#   BatchMode no
#   CheckHostIP yes
#   AddressFamily any
#   ConnectTimeout 0
#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/identity
#   IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#   Port 22
#   Protocol 2,1
#   Cipher 3des
#   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
#   MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
#   EscapeChar ~
#   Tunnel no
#   TunnelDevice any:any
#   PermitLocalCommand no
#   VisualHostKey no
    SendEnv LANG LC_*
    HashKnownHosts yes
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials no

Nab!!daN

Par contre le cote louche , c'est fraiche install et il demande une key, ca c'est loin d'être normal, peut être la poisse sur la beta2, j'ai update les paquets avant 😛

Bon il y a pas le feu au lac mais j'aime bien comprendre 😛

[supprimé]

Je viens de jeter un oeil sur mon ssh_config. Je n'ai pas de différence notable. Poste un peu le sshd_config pour voir ?

Nab!!daN

Re 😉

Somme toute très classique le sshd_config

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile	%h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

[supprimé]

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile    %h/.ssh/authorized_keys

Chez moi :

ServerKeyBits 1024

AuthorizedKeysFile    %h/.ssh/authorized_keys

sans le # devant la ligne ! (pour permettre le fichier des clé autorisées)

Nab!!daN

Idem,

 ssh localhost
The authenticity of host 'localhost (::1)' can't be established.
RSA key fingerprint is 1b:ff:c2:91:a8:fe:b0:d8:87:e5:c2:84:c9:75:06:bc.
Are you sure you want to continue connecting (yes/no)? 
Host key verification failed.

bon sinon ca pue le bug 😛 regarde:

sudo /etc/init.d/ssh stop
 * Stopping OpenBSD Secure Shell server sshd                             [ OK ]

puis

 ssh localhost
The authenticity of host 'localhost (::1)' can't be established.
RSA key fingerprint is 1b:ff:c2:91:a8:fe:b0:d8:87:e5:c2:84:c9:75:06:bc.
Are you sure you want to continue connecting (yes/no)? 
Host key verification failed.

trop funny !

[supprimé]

Ouais c'est bizarre en effet. Moi plus comprendre :/

Nab!!daN

Bon c'est une virtual machine 😛

Merci de m'avoir rassure, je pensais devenir fou lol lol

Bonne soirée 😉

[supprimé]

Ah ouais... probablement la VM qui fout le souc.
A+

Nab!!daN

Perso je pense pas, l'accès était depuis le host en lui même, pas en "remote", les virtual machines tourne super bien, je pense plus au gros bug de beta.

@ +

Bye !

Nab!!daN

Bon je viens de restore un snapshot, ca a merdouille quelque part (update foireux ??) mais ca marche maintenant, merci pour l'aide 😉

[supprimé]

De rien. Tu peux éditer ton premier post et ajouter RESOLU dans le titre ?

Nab!!daN

C'est fait 😉