Hosting Provided By

UPDATE: Privilege Separation after kernel upgrade

From: David Komanek <xdavid(at)lib-eth.natur.cuni.cz>
Date: Wed Nov 06 2002 - 10:50:15 EST

Hi all,

to the original question, now I am adding the debug output from sshd. I forgot to include it in the previous mail, sorry.

BR,

David Komanek

Forwarded message ---------- Date: Wed, 6 Nov 2002 16:31:10 +0100 (CET) From: David Komanek <xdavid@lib-eth.natur.cuni.cz> To: secureshell@securityfocus.com Subject: Privilege Separation after kernel upgrade

Hi all,

I noticed strange problem after installing the 2.4.18-3BOOT kernel on RedHatLinux 7.2, concerning privsep. When privsep is turned on, users cannot log in, but root is allowed. In the messages log appears following:

Nov  6 15:56:31 host sshd[11337]: fatal: mm_send_fd: UsePrivilegeSeparation=yes not supported
Nov  6 15:56:31 host sshd[11337]: syslogin_perform_logout: logout() returned an error
Nov  6 15:56:31 host sshd[11341]: fatal: mm_receive_fd: UsePrivilegeSeparation=yes not supported

I laso tried to edit config.h to disable system mmap, but with no success to solve this issue.

Do you need help?

Problems are with both OpenSSH 3.4p1 and 3.5p1.

Cannot upgrade to 2.4.18-17BOOT kernel because of third-party modules.

Does anybody know what the messages mean ?

Thanks,

David Komanek

debug3: RNG is ready, skipping seeding
debug1: sshd version OpenSSH_3.5p1
debug1: private host key: #0 type 0 RSA1
debug3: Not a RSA1 key file /usr/local/etc/ssh_host_rsa_key.
debug1: read PEM private key done: type RSA
debug1: private host key: #1 type 1 RSA
debug3: Not a RSA1 key file /usr/local/etc/ssh_host_dsa_key.
debug1: read PEM private key done: type DSA
debug1: private host key: #2 type 2 DSA
socket: Address family not supported by protocol
debug1: Bind to port 2222 on 0.0.0.0.

Server listening on 0.0.0.0 port 2222.
Generating 768 bit RSA key.
RSA key generation complete.
debug1: Server will not fork when running in debugging mode. Connection from xx.xx.xx.xx port 2039
debug1: Client protocol version 1.5; client software version TTSSH/1.5.4 Win32

debug1: no match: TTSSH/1.5.4 Win32
debug1: Local version string SSH-1.99-OpenSSH_3.5p1
debug2: Network child is on pid 12638
debug3: preauth child monitor started
debug3: mm_request_receive entering
debug3: privsep user:group 90:90
debug1: permanently_set_uid: 90/90
debug1: Sent 768 bit server key and 1024 bit host key.
debug1: Encryption type: 3des
debug3: mm_request_send entering: type 28
debug3: mm_request_receive_expect entering: type 29
debug3: mm_request_receive entering
debug3: monitor_read: checking request 28
debug3: mm_request_send entering: type 29
debug2: monitor_read: 28 used once, disabling now
debug3: mm_request_receive entering
debug3: mm_ssh1_session_id entering
debug3: mm_request_send entering: type 30
debug1: cipher_init: set keylen (16 -> 32)
debug1: cipher_init: set keylen (16 -> 32)
debug1: Received session key; encryption turned on.
debug3: monitor_read: checking request 30
debug3: mm_answer_sessid entering
debug2: monitor_read: 30 used once, disabling now
debug3: mm_request_receive entering
debug1: Installing crc compensation attack detector.
debug3: mm_getpwnamallow entering
debug3: mm_request_send entering: type 6
debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM
debug3: mm_request_receive_expect entering: type 7
debug3: mm_request_receive entering
debug3: monitor_read: checking request 6
debug3: mm_answer_pwnamallow
debug3: allowed_user: today 11997 sp_expire -1 sp_lstchg 11997 sp_max
Do you need more help? 
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software:Learn more about Pantek's Technical Support offerings
Place an order for 24/7/365 Technical Support here
Learn more about Pantek, who we are, and what we do
Chat with a Live Operator
Related securityfocus.com Links
bugtraq
certification
focus-bsd
focus-ids
focus-ih
focus-linux
focus-ms
focus-sun
focus-unix-other
focus-virus
forensics
incidents
libnet
linux-secnews
ms-secnews
pen-test
secpapers
secprog
sectools
secureshell
security-basics
securityjobs
sf-news
vuln-dev
webappsec
Request more information about Pantek

99999

debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
debug3: mm_request_send entering: type 7
debug2: monitor_read: 6 used once, disabling now
debug3: mm_request_receive entering
debug1: Attempting authentication for test.
debug3: mm_auth_password entering
debug3: mm_request_send entering: type 10
debug3: mm_auth_password: waiting for MONITOR_ANS_AUTHPASSWORD
debug3: mm_request_receive_expect entering: type 11
debug3: mm_request_receive entering
debug3: monitor_read: checking request 10
debug3: mm_answer_authpassword: sending result 0
debug3: mm_request_send entering: type 11

Failed none for test from xx.xx.xx.xx port 2039

debug3: mm_request_receive entering
debug3: mm_auth_password: user not authenticated
debug3: mm_auth_password entering
debug3: mm_request_send entering: type 10
debug3: mm_auth_password: waiting for MONITOR_ANS_AUTHPASSWORD
debug3: mm_request_receive_expect entering: type 11
debug3: mm_request_receive entering
debug3: monitor_read: checking request 10
debug3: mm_answer_authpassword: sending result 1
debug3: mm_request_send entering: type 11

Accepted password for test from xx.xx.xx.xx port 2039

debug1: monitor_child_preauth: test has been authenticated by privileged process
debug3: mm_get_keystate: Waiting for new keys
debug3: mm_request_receive_expect entering: type 24
debug3: mm_request_receive entering
debug3: mm_auth_password: user authenticated

Accepted password for test from xx.xx.xx.xx port 2039

debug3: mm_send_keystate: Sending ssh1 KEY+IV
debug3: cipher_get_keyiv: Copying 3DES IV
debug3: cipher_get_keyiv: Copying 3DES IV
debug3: mm_send_keystate: Sending compression state
debug3: mm_request_send entering: type 24
debug3: mm_send_keystate: Finished sending state
debug3: mm_get_keystate: Getting compression state
debug3: mm_get_keystate: Getting Network I/O buffers
debug2: User child is on pid 12639
debug3: mm_request_receive entering
Can we help you? 
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software:Learn more about Pantek's Technical Support offerings
Place an order for 24/7/365 Technical Support here
Learn more about Pantek, who we are, and what we do
Chat with a Live Operator
Related securityfocus.com Links
bugtraq
certification
focus-bsd
focus-ids
focus-ih
focus-linux
focus-ms
focus-sun
focus-unix-other
focus-virus
forensics
incidents
libnet
linux-secnews
ms-secnews
pen-test
secpapers
secprog
sectools
secureshell
security-basics
securityjobs
sf-news
vuln-dev
webappsec
Request more information about Pantek
debug1: permanently_set_uid: 504/100
debug1: cipher_init: set keylen (16 -> 32)
debug1: cipher_init: set keylen (16 -> 32)
debug3: cipher_set_keyiv: Installed 3DES IV
debug3: cipher_set_keyiv: Installed 3DES IV
debug1: session_new: init
debug1: session_new: session 0
debug1: Installing crc compensation attack detector.
debug2: SSH_PROTOFLAG_SCREEN_NUMBER: 1
debug1: x11_create_display_inet: Socket family 10 not supported
debug1: bind port 6010: Address already in use
debug1: x11_create_display_inet: Socket family 10 not supported
debug1: fd 7 setting O_NONBLOCK
debug2: fd 7 is O_NONBLOCK
debug1: channel 0: new [X11 inet listener]
debug1: Allocating pty.
debug3: mm_request_send entering: type 25
debug3: monitor_read: checking request 25
debug3: mm_answer_pty entering
debug1: session_new: init
debug1: session_new: session 0
debug3: mm_request_send entering: type 26

mm_send_fd: UsePrivilegeSeparation=yes not supported debug1: Calling cleanup 0x80599fc(0x80936e0) debug1: session_pty_cleanup: session 0 release /dev/pts/1 syslogin_perform_logout: logout() returned an error

debug3: mm_pty_allocate: waiting for MONITOR_ANS_PTY
debug3: mm_request_receive_expect entering: type 26
debug3: mm_request_receive entering

mm_receive_fd: UsePrivilegeSeparation=yes not supported

debug1: Calling cleanup 0x805f648(0x0)
debug1: channel_free: channel 0: X11 inet listener, nchannels 1
debug3: channel_free: status: The following connections are open:
debug3: channel_close_fds: channel 0: r 7 w 7 e -1
debug1: Calling cleanup 0x806adec(0x0)

Received on Sat Nov 9 01:00:26 2002

This message: [ Message body ]
Next message: dave-mlist(at)bfnet.com: "ssh from Linux to cygwin/WXP: X forwarding "wrong authentication""
Previous message: David Komanek: "Privilege Separation after kernel upgrade"
Reply: dave-mlist(at)bfnet.com: "ssh from Linux to cygwin/WXP: X forwarding "wrong authentication""

Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ] [ By messages with attachments ]

This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:02:51 EDT