Problème avec OpenSSH ( SSHd et SSH )

Mon Ssh avec un client externe fonctionne bien sauf que moi ce que je veut faire ne fonctionne pas de l'interne... ( ssh MP3@172.16.2.2 " Une Commande" )

Voici le Fichier sshd_Config
#       $OpenBSD: sshd_config,v 1.73 2005/12/06 22:38:28 reyk Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options change a
# default value.

Port 22
#Protocol 2,1
Protocol 2
#AddressFamily any
#ListenAddress *
#ListenAddress ::

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 768

# Logging
# obsoletes QuietMode and FascistLogging
SyslogFacility AUTH
SyslogFacility AUTHPRIV
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin NO
#StrictModes yes
#MaxAuthTries 6

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile     .ssh/authorized_keys

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication yes
PermitEmptyPasswords yes
#PasswordAuthentication yes

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes
#ChallengeResponseAuthentication no   

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
#GSSAPICleanupCredentials yes

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication mechanism.
# Depending on your PAM configuration, this may bypass the setting of
# PasswordAuthentication, PermitEmptyPasswords, and
# "PermitRootLogin without-password". If you just want the PAM account and
# session checks to run without PAM authentication, then enable this but set
# ChallengeResponseAuthentication=no
#UsePAM no
# UsePAM yes                 

# Accept locale-related environment variables
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin yes
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#ShowPatchLevel no
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10
#PermitTunnel no
#BatchMode yes
# no default banner path
#Banner /etc/motd

# override default of no subsystems
Subsystem       sftp    /usr/libexec/openssh/sftp-server



et voici mon ssh_Config
#       $OpenBSD: ssh_config,v 1.21 2005/12/06 22:38:27 reyk Exp $

# This is the ssh client system-wide configuration file.  See
# ssh_config(5) for more information.  This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.

# Configuration data is parsed as follows:
#  1. command line options
#  2. user-specific file
#  3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.

# Site-wide defaults for some commonly used options.  For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.

# Host *
#   ForwardAgent no
#   ForwardX11 no
#   RhostsRSAAuthentication no
RSAAuthentication yes
PasswordAuthentication yes
#   HostbasedAuthentication no
#   BatchMode no
#   CheckHostIP yes
#   AddressFamily any
#   ConnectTimeout 0
#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/identity
#   IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#   Port 22
#   Protocol 2,1
#   Cipher 3des
#   Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
#   EscapeChar ~
#   Tunnel no
#   TunnelDevice any:any
#   PermitLocalCommand no

#Host 172.16.2.2
#   ForwardAgent no
#ForwardX11 no
#   RhostsRSAAuthentication no
#   RSAAuthentication yes
#   PasswordAuthentication yes
#   HostbasedAuthentication no
BatchMode yes
#   CheckHostIP yes
#   AddressFamily any
#   ConnectTimeout 0
#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/identity
#   IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#Port 22
#Protocol 2,1
#   Cipher 3des
#   Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
#   EscapeChar ~
#   Tunnel no
#   TunnelDevice any:any
PermitLocalCommand yes   
Host *
        GSSAPIAuthentication yes          
# If this option is set to yes then remote X11 clients will have full access
# to the original X11 display. As virtually no X11 client supports the untrusted
# mode correctly we set this to yes.
        ForwardX11Trusted yes
# Send locale-related environment variables
        SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
        SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
        SendEnv LC_IDENTIFICATION LC_ALL


mais mon problème ce situe quand je fait ( en local "prochainement pour mon php") :

[DevilZ@Fedora2 shell]# ssh MP3@172.16.2.2 killall odsnetradio -WINCH
Permission denied (publickey,gssapi-with-mic,password,keyboard-interactive).

j'ai donc fait quelles que recherche sur google mais rien trouver de vraiment concluent :/

J'aurrais besoin d'aide ... Merci
Configuration: Windows XP
Internet Explorer 7.0

13 réponses

  • Votes
  • Date
  • Date décroissante
  1. Bonjour,

    Pour que ssh ne demande pas de mot de passe, il faut forcer le mode clé publique. En mettant
    "RSAAuthentication no"
    "PubkeyAuthentication no"
    on est sûr d'être en mode mot de passe !

    - la clé publique du client doit se trouver dans le fichier $HOME/.ssh/authorized_keys du serveur. Il faut bien sûr que le client ait généré sa paire de clés par "ssh-keygen" et ait mis sa clé privée en $HOME/.ssh/identity (côté client).
    - le répertoire $HOME/.ssh doit appartenir (chown) au propriétaire de $HOME et être en protection 700 (interdit aux autres).
    - sur le serveur il vaut mieux refuser l'accès par mot de passe ("PasswordAuthentication no" dans /etc/ssh/sshd_config du serveur)

    Manu
    1. Bonjour à toi et merci de vouloir m'aidé :)

      Pour que ssh ne demande pas de mot de passe, il faut forcer le mode clé publique. En mettant
      "RSAAuthentication no"
      "PubkeyAuthentication no"
      on est sûr d'être en mode mot de passe !

      * voila ce ci est fait sont tous a NO

      - Il faut bien sûr que le client ait généré sa paire de clés par "ssh-keygen" et ait mis sa clé privée en $HOME/.ssh/identity (côté client).

      * Fait j'ai mie Style -- Oertt pour le user MP3

      sur le serveur il vaut mieux refuser l'accès par mot de passe ("PasswordAuthentication no" dans /etc/ssh/sshd_config du serveur)

      * Fait mais marche toujours pas... il me sort ceci ( Permission denied (keyboard-interactive). )

      pour cette ligne --- la clé publique du client doit se trouver dans le fichier $HOME/.ssh/authorized_keys du serveur.

      * je ne sais pas quoi en faire ..

      [MP3@Fedora2 ~]$ ssh -v MP3@172.16.2.2 ps x
      OpenSSH_4.3p2, OpenSSL 0.9.8b 04 May 2006
      debug1: Reading configuration data /etc/ssh/ssh_config
      debug1: Applying options for *
      debug1: Connecting to 172.16.2.2 [172.16.2.2] port 22.
      debug1: Connection established.
      debug1: identity file /home/MP3/.ssh/identity type -1
      debug1: identity file /home/MP3/.ssh/id_rsa type 1
      debug1: identity file /home/MP3/.ssh/id_dsa type -1
      debug1: Remote protocol version 2.0, remote software version OpenSSH_4.3
      debug1: match: OpenSSH_4.3 pat OpenSSH*
      debug1: Enabling compatibility mode for protocol 2.0
      debug1: Local version string SSH-2.0-OpenSSH_4.3
      debug1: SSH2_MSG_KEXINIT sent
      debug1: SSH2_MSG_KEXINIT received
      debug1: kex: server->client aes128-cbc hmac-md5 none
      debug1: kex: client->server aes128-cbc hmac-md5 none
      debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
      debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
      debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
      debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
      debug1: Host '172.16.2.2' is known and matches the RSA host key.
      debug1: Found key in /home/MP3/.ssh/known_hosts:2
      debug1: ssh_rsa_verify: signature correct
      debug1: SSH2_MSG_NEWKEYS sent
      debug1: expecting SSH2_MSG_NEWKEYS
      debug1: SSH2_MSG_NEWKEYS received
      debug1: SSH2_MSG_SERVICE_REQUEST sent
      debug1: SSH2_MSG_SERVICE_ACCEPT received
      debug1: Authentications that can continue: keyboard-interactive
      debug1: Next authentication method: keyboard-interactive
      debug1: Authentications that can continue: keyboard-interactive
      debug1: No more authentication methods to try.
      Permission denied (keyboard-interactive).
  2. Bonjour,

    Je crois que je n'ai pas été suffisamment clair. J'écrivais :

    « En mettant
    "RSAAuthentication no"
    "PubkeyAuthentication no"
    on est sûr d'être en mode mot de passe ! »

    Votre résultat le confirme (sachant que c'est le log côté serveur qui permettrait d'en être sûr),

    mais vous ne voulez pas du mode mot de passe ; il vous faut donc faire le contraire, à savoir ne pas mettre ces lignes (ou mettre yes).

    Manu
    1. Uncomment the Line "PubkeyAuthentication yes" & "AuthorizedKeysFile" in "/etc/ssh/sshd_config" and then restart sshd "service sshd restart" It worked for me. I use a pub key to connect to my server
      1. Modérateur
        Salut,

        en local essaie avec
        ssh MP3@localhost " Une Commande"
        1. merci de ta réponse..

          je recoi ce ci

          [DevilZ@Fedora2 html]# ssh MP3@localhost " Une Commande"
          Host key verification failed.
          1. Modérateur
            fait
            ssh -v MP3@localhost " Une Commande" 
            et affiche ce que tu vois à l'écran
            1. [DevilZ@Fedora2 html]# ssh -v MP3@localhost " Une Commande"
              OpenSSH_4.3p2, OpenSSL 0.9.8b 04 May 2006
              debug1: Reading configuration data /etc/ssh/ssh_config
              debug1: Applying options for *
              debug1: Connecting to localhost [::1] port 22.
              debug1: Connection established.
              debug1: permanently_set_uid: 0/0
              debug1: identity file /root/.ssh/identity type -1
              debug1: identity file /root/.ssh/id_rsa type -1
              debug1: identity file /root/.ssh/id_dsa type -1
              debug1: Remote protocol version 2.0, remote software version OpenSSH_4.3
              debug1: match: OpenSSH_4.3 pat OpenSSH*
              debug1: Enabling compatibility mode for protocol 2.0
              debug1: Local version string SSH-2.0-OpenSSH_4.3
              debug1: SSH2_MSG_KEXINIT sent
              debug1: SSH2_MSG_KEXINIT received
              debug1: kex: server->client aes128-cbc hmac-md5 none
              debug1: kex: client->server aes128-cbc hmac-md5 none
              debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
              debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
              debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
              debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
              Host key verification failed.
              1. J'ai supprimer /root/.ssh/known_hosts
                [DevilZ@Fedora2 ~]# ssh MP3@localhost killall odsnetradio -WINCH
                Host key verification failed.
                [DevilZ@Fedora2 ~]# ssh -v MP3@localhost killall odsnetradio -WINCH
                OpenSSH_4.3p2, OpenSSL 0.9.8b 04 May 2006
                debug1: Reading configuration data /etc/ssh/ssh_config
                debug1: Applying options for *
                debug1: Connecting to localhost [::1] port 22.
                debug1: Connection established.
                debug1: permanently_set_uid: 0/0
                debug1: identity file /root/.ssh/identity type -1
                debug1: identity file /root/.ssh/id_rsa type -1
                debug1: identity file /root/.ssh/id_dsa type -1
                debug1: Remote protocol version 2.0, remote software version OpenSSH_4.3
                debug1: match: OpenSSH_4.3 pat OpenSSH*
                debug1: Enabling compatibility mode for protocol 2.0
                debug1: Local version string SSH-2.0-OpenSSH_4.3
                debug1: SSH2_MSG_KEXINIT sent
                debug1: SSH2_MSG_KEXINIT received
                debug1: kex: server->client aes128-cbc hmac-md5 none
                debug1: kex: client->server aes128-cbc hmac-md5 none
                debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
                debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
                debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
                debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
                Host key verification failed.

                je pense que je devrai recommencer mon fichier conf de sshd_config
                1. Modérateur
                  fait cette modif dans ton fichier et relance le server pour voir
                  RSAAuthentication no
                  PubkeyAuthentication no
                  1. non malheuresement sa ne marche pas plus ... ( a tu un fichier sshd_config et un ssh_config )

                    qui marche que je puisse seulement le modifier a mon reseau ?
                  2. @DevilZj'ai modifier mon ssh_config

                    j'ai enlever
                    # BatchMode yes
                    # PermitLocalCommand yes

                    et voilà
                    [DevilZ@Fedora2 ~]# ssh -v MP3@localhost killall odsnetradio -WINCH
                    OpenSSH_4.3p2, OpenSSL 0.9.8b 04 May 2006
                    debug1: Reading configuration data /etc/ssh/ssh_config
                    debug1: Applying options for *
                    debug1: Connecting to localhost [::1] port 22.
                    debug1: Connection established.
                    debug1: permanently_set_uid: 0/0
                    debug1: identity file /root/.ssh/identity type -1
                    debug1: identity file /root/.ssh/id_rsa type -1
                    debug1: identity file /root/.ssh/id_dsa type -1
                    debug1: Remote protocol version 2.0, remote software version OpenSSH_4.3
                    debug1: match: OpenSSH_4.3 pat OpenSSH*
                    debug1: Enabling compatibility mode for protocol 2.0
                    debug1: Local version string SSH-2.0-OpenSSH_4.3
                    debug1: SSH2_MSG_KEXINIT sent
                    debug1: SSH2_MSG_KEXINIT received
                    debug1: kex: server->client aes128-cbc hmac-md5 none
                    debug1: kex: client->server aes128-cbc hmac-md5 none
                    debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
                    debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
                    debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
                    debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
                    The authenticity of host 'localhost (::1)' can't be established.
                    RSA key fingerprint is ef:a3:fe:a8:18:84:f4:48:70:6a:9a:c1:5e:b5:1f:e6.
                    Are you sure you want to continue connecting (yes/no)? yes
                    Warning: Permanently added 'localhost' (RSA) to the list of known hosts.
                    debug1: ssh_rsa_verify: signature correct
                    debug1: SSH2_MSG_NEWKEYS sent
                    debug1: expecting SSH2_MSG_NEWKEYS
                    debug1: SSH2_MSG_NEWKEYS received
                    debug1: SSH2_MSG_SERVICE_REQUEST sent
                    Write failed: Broken pipe

                    sauf que moi ce ci est pour mon apache pour qu'il puisse lancé une commande en php sur mon ssh par un boutton :)
                2. Modérateur
                  Are you sure you want to continue connecting (yes/no)?
                  ici tu fait yes et c'est ok, tu as la connexion ;-)
                  pour ce qui et du code php il faut afficher ton code
                  1. voici la commande: ssh MP3@localhost killall odsnetradio -WINCH

                    et en local il me demande le mot de pass: et sinon il continue pas ...

                    il y a tu une facon qui le demande pas pour un user et qui execute la commande ...

                    mon code php est celui ci

                    <?php
                    /*
                        Simple script PHP pour changement de Playlist (sc_trans)
                        Date de création : 20/10/2006 à 04 h 40
                        Compatibilité : PHP4 / PHP5
                        Requis : Commande "exec" autoriser sur le serveur hébergant ce script
                    */
                    
                    exec('killall odsnetradio -WINCH');
                    ?>
                    
                  2. @DevilZoups .. je vous est donnée mon code php de test ..

                    <?php
                    /*
                        Simple script PHP pour changement de Playlist (sc_trans)
                        Date de création : 20/10/2006 à 04 h 40
                        Compatibilité : PHP4 / PHP5
                        Requis : Commande "exec" autoriser sur le serveur hébergant ce script
                    */
                    
                    exec('ssh MP3@172.16.2.2 killall odsnetradio -WINCH');
                    ?>
                    


                    voilà mais il block car cette commande demande un mot de pass.. comment le contrer ?
                3. salut, j'ai eu le même souci,

                  --> regardez dans le fichier /etc/ssh/denyuser

                  bye