Memory Fault when doing invalid command on HPUX

From: Shane Hockings <hockingss(at)powertel.com.au>
Date: Tue Nov 05 2002 - 18:22:00 EST

I have just installed openssh 3.5p1 on my HPUX 11.11 box. I get the same behaviour that I was getting when I had 2.5 installed. When I use ssh to run a command on another box, if the command is invalid, I get errors.

As an example, if I do
[server] sshd -d -e
ssh -2 -l hockings s1hpk3 "ls /ThisDirectoryDoesntExist"

(where I haven't created that directory, and hockings is my username on the box s1hpk3)
(The ssh client is still v2.5p1, the server is 3.5p1)

 I get a "Memory Fault" Error reported on the client end and the server jumps back to the command prompt. On my old 2.5 install I was getting either nothing, a memory fault error, a (correct) file not found type message, or a core dump.

Sorry I can't be of more help in troubleshooting, I don't know much about the backend of ssh. I've included the debug info - if someone could help me I'd appreciate it. (sshd -d -d -d is available if required but I haven't posted it due to the length)

Thanks in advance!
Shane

---

---

Server listening on 0.0.0.0 port 22.
Generating 768 bit RSA key.
RSA key generation complete. debug1: Server will not fork when running in debugging mode.
Connection from 10.0.70.35 port 750

debug1: Client protocol version 2.0; client software version OpenSSH_2.5.1p1
debug1: match: OpenSSH_2.5.1p1 pat OpenSSH_2.5.0p1*,OpenSSH_2.5.1p1*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-1.99-OpenSSH_3.5p1
debug1: permanently_set_uid: 9999/9999
debug1: list_hostkey_types: ssh-rsa,ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: client->server 3des-cbc hmac-sha1 none
debug1: kex: server->client 3des-cbc hmac-sha1 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received
debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent
debug1: dh_gen_key: priv key bits set: 203/384
debug1: bits set: 2055/4095
debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
debug1: bits set: 2058/4095
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent
debug1: kex_derive_keys
debug1: newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: waiting for SSH2_MSG_NEWKEYS
debug1: newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
debug1: userauth-request for user hockings service ssh-connection method

none debug1: attempt 0 failures 0 debug1: Starting up PAM with username "hockings" debug1: PAM setting rhost to "s1hpk7.powertel.com.au" Failed none for hockings from 10.0.70.35 port 750 ssh2 Failed none for hockings from 10.0.70.35 port 750 ssh2 debug1: userauth-request for user hockings service ssh-connection method publickey debug1: attempt 1 failures 1 debug1: temporarily_use_uid: 2200/20 (e=0/3)

debug1: trying public key file /home/hockings/.ssh/authorized_keys debug1:
restore_uid: 0/3 debug1: temporarily_use_uid: 2200/20 (e=0/3)
debug1: trying public key file /home/hockings/.ssh/authorized_keys2

debug1: matching key found: file /home/hockings/.ssh/authorized_keys2, line 1
Found matching DSA key: [I've deleted the key for security reasons] debug1: restore_uid: 0/3
debug1: ssh_dss_verify: signature correct Accepted publickey for hockings from 10.0.70.35 port 750 ssh2 Accepted publickey for hockings from 10.0.70.35 port 750 ssh2 debug1: monitor_child_preauth: hockings has been authenticated by privileged process

debug1: PAM establishing creds
debug1: permanently_set_uid: 2200/20
debug1: newkeys: mode 0
debug1: newkeys: mode 1
debug1: Entering interactive session for SSH2.
debug1: fd 8 setting O_NONBLOCK
debug1: fd 9 setting O_NONBLOCK
debug1: server_init_dispatch_20
debug1: server_input_channel_open: ctype session rchan 0 win 65536 max 32768
debug1: input_session_request
debug1: channel 0: new [server-session]
debug1: session_new: init
debug1: session_new: session 0
debug1: session_open: channel 0
debug1: session_open: session 0: link with channel 0
Do you need help?
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software:
Learn more about Pantek's Technical Support offerings
Place an order for 24/7/365 Technical Support here
Learn more about Pantek, who we are, and what we do
Chat with a Live Operator
Related securityfocus.com Links
bugtraq
certification
focus-bsd
focus-ids
focus-ih
focus-linux
focus-ms
focus-sun
focus-unix-other
focus-virus
forensics
incidents
libnet
linux-secnews
ms-secnews
pen-test
secpapers
secprog
sectools
secureshell
security-basics
securityjobs
sf-news
vuln-dev
webappsec
Request more information about Pantek
debug1: server_input_channel_open: confirm session
debug1: server_input_channel_req: channel 0 request exec reply 0
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req exec
debug1: PAM establishing creds
debug1: fd 12 setting O_NONBLOCK
debug1: fd 11 setting O_NONBLOCK
debug1: fd 14 setting O_NONBLOCK
debug1: Received SIGCHLD.
debug1: session_by_pid: pid 1658
debug1: session_exit_message: session 0 channel 0 pid 1658
debug1: channel request 0: exit-status
debug1: session_exit_message: release channel 0
debug1: channel 0: write failed
debug1: channel 0: close_write
debug1: channel 0: output open -> closed
debug1: session_close: session 0 pid 1658
debug1: channel 0: read<=0 rfd 12 len 0
debug1: channel 0: read failed
debug1: channel 0: close_read
debug1: channel 0: input open -> drain
debug1: channel 0: ibuf empty
debug1: channel 0: send eof
debug1: channel 0: input drain -> closed
debug1: channel 0: send close

Connection closed by 10.0.70.35
debug1: channel_free: channel 0: server-session, nchannels 1 Closing connection to 10.0.70.35
debug1: Cannot delete credentials[9]: Authentication failed

---

PowerTel Limited, winners of
Best Corporate/Wholesale Broadband Initiative, Australian Telecom Awards 2002 Broadband Wholesale Carrier of the year, CommsWorld Telecomms Awards 2001 Best Emerging Telco, Australian Telecom Awards 2001

---

This email (including all attachments) is intended solely for the named addressee. It is confidential and may contain commercially sensitive information. If you receive it in error, please let us know by reply email, delete it from your system and destroy any copies.

This email is also subject to copyright. No part of it should be reproduced, adapted or transmitted without the prior written consent of the copyright owner.

Emails may be interfered with, may contain computer viruses or other defects and may not be successfully replicated on other systems. We give no warranties in relation to these matters. If you have any doubts about the authenticity of an email purportedly sent by us, please contact us immediately.

---

Received on Sat Nov 9 00:55:59 2002