0

I have a server running Ubuntu SE 10.10. Two Windows 7 machines are attempting to WinSCP / Putty into it using the same credentials. Both are definitely connecting to the correct host, but one gets an Access Denied error.

IPs of the two windows machines are on the same subnet. Output of /var/log/auth.log on the server (obfuscated) includes many occurrences of the following:

May  6 16:41:23 myserver sshd[9217]: Failed password for myuser from xxx.xxx.62.119 port 54669 ssh2
May  6 16:43:15 myserver sshd[9220]: Accepted password for myuser from xxx.xxx.58.144 port 56938 ssh2
May  6 16:45:07 myserver sshd[9286]: Accepted password for myuser from xxx.xxx.62.125 port 64913 ssh2
May  6 16:45:07 myserver sshd[9286]: pam_unix(sshd:session): session opened for user myuser by (uid=0)

Where IP ending in 62.119 is the problem PC, 62.125 is the PC without problems, and 58.144 is another Ubuntu machine (also succesful at login). So the 'myuser@myserver' account itself isn't locked, it only seems to be the one host with problems.

I also see the following:

May  6 16:39:08 myserver sshd[9215]: Invalid user myuser@myserver from xxx.xxx.62.119
May  6 16:39:08 myserver sshd[9215]: Failed none for invalid user myuser@myserver from xxx.xxx.62.119 port 54641 ssh2
May  6 16:39:10 myserver sshd[9215]: pam_unix(sshd:auth): check pass; user unknown
May  6 16:39:10 myserver sshd[9215]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=remotehost.co.za
May  6 16:39:11 myserver sshd[9215]: Failed password for invalid user myuser@myserver from xxx.xxx.62.119 port 54641 ssh2
May  6 16:41:21 turk sshd[9217]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=remotehost.co.za  user=myuser

I'm not running DenyHost, I'm not sure what default Ubuntu settings there are that are capable of blocking certain hosts after a certain number of attempts. Could the user on the blocked machine have entered an incorrect password too many times and is now blocked (but only from that host)? Where can I do the unlocking?

Improve this question

1 Answer 1

Reset to default
0

I suspect the user at the other machine is using an incorrect ssh command line. Notice that the user value in the log is myuser@myserver instead of just myuser. Maybe they are doing:

ssh -l myuser@myserver myserver

instead of:

ssh -l myuser myserver

or

ssh myuser@myserver

both if which would be correct.

Improve this answer
2
  • The values are correct in the first set of output I give - I think the second lot is just being logged differently. Also I looked over the user's shoulder while putty / winscp values were being filled in and I didn't see anything wrong.
    – iftheshoefritz
    May 6, 2011 at 19:26
  • Make sure he used the right case for the username. It is case sensitive and many windows users are used to usernames being case insensitive. I just tried logging into my Ubuntu box with the first letter of my username capitalized and got the same log output you are getting.
    – TimS
    May 6, 2011 at 20:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .