Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Whenever one of our server's admins tries to access our machine running Mac OS X Server 10.5 via SSH, I get the following error exactly every 10 seconds in the security log:

sshd[32575]: /etc/sshd_config line 70: Unsupported option KerberosGetAFSToken

sshd[32575]: error: PAM: Authentication failure for (username) from 129.1.95.241

sshd[32575]: Failed keyboard-interactive/pam for (username) from 129.1.95.241

The user is able to log in and work as normal, but this error is dominating the log file. At first we discovered he had a left-over public ssh key on his system, but even after deleting that the error persists. The error keeps appearing every 10 seconds, even when the user is no longer logged into the server!

Has anyone seen this issue before? How can these errors be generated from the same IP even when that machine does not have an open connection to the server? Where else should I look?

Thanks very much for your help!

share|improve this question
1  
I'd go to that machine and see if you can find the process that's opening a periodic network connection on that port to the server first. –  Bart Silverstrim Jun 9 '11 at 12:58
add comment

2 Answers

up vote 0 down vote accepted

Sounds like some rogue script that runs on 129.1.95.241 and tries to log in. I'd have a look at that host directly.

Or if it's not under your control block it with the firewall. If it indeed is needed than somebody will come screaming at you at you'll have the option to "repair" this. If you have a contact for the server probably drop a mail with some deadline to give a warning.

share|improve this answer
    
Found it! You were right, the client machine had a monitoring tool in the background that was trying to access the server over and over. Thanks for the help, everyone! –  Zach Esposito Jun 9 '11 at 14:54
add comment

You might want to look at this

It's for Ubuntu but I believe it might be related.

Basically it's as if the ssh client is looking to authenticate using GSSAPI. I read that the client will try a rekey. This rekey transmits the new credentials to the server.

That would explain the logs being populated every 10 seconds.

Edit: I also found this mailing list tread that talks about GSSAPI and it covers AFS as well...pretty much what you see in your logs. AFS, Kerberos and PAM...

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.