0

Whenever one of our server's admins tries to access our machine running Mac OS X Server 10.5 via SSH, I get the following error exactly every 10 seconds in the security log:

sshd[32575]: /etc/sshd_config line 70: Unsupported option KerberosGetAFSToken

sshd[32575]: error: PAM: Authentication failure for (username) from 129.1.95.241

sshd[32575]: Failed keyboard-interactive/pam for (username) from 129.1.95.241

The user is able to log in and work as normal, but this error is dominating the log file. At first we discovered he had a left-over public ssh key on his system, but even after deleting that the error persists. The error keeps appearing every 10 seconds, even when the user is no longer logged into the server!

Has anyone seen this issue before? How can these errors be generated from the same IP even when that machine does not have an open connection to the server? Where else should I look?

Thanks very much for your help!

1
  • 1
    I'd go to that machine and see if you can find the process that's opening a periodic network connection on that port to the server first. Jun 9, 2011 at 12:58

2 Answers 2

0

Sounds like some rogue script that runs on 129.1.95.241 and tries to log in. I'd have a look at that host directly.

Or if it's not under your control block it with the firewall. If it indeed is needed than somebody will come screaming at you at you'll have the option to "repair" this. If you have a contact for the server probably drop a mail with some deadline to give a warning.

1
  • Found it! You were right, the client machine had a monitoring tool in the background that was trying to access the server over and over. Thanks for the help, everyone! Jun 9, 2011 at 14:54
1

You might want to look at this

It's for Ubuntu but I believe it might be related.

Basically it's as if the ssh client is looking to authenticate using GSSAPI. I read that the client will try a rekey. This rekey transmits the new credentials to the server.

That would explain the logs being populated every 10 seconds.

Edit: I also found this mailing list tread that talks about GSSAPI and it covers AFS as well...pretty much what you see in your logs. AFS, Kerberos and PAM...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .