Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

On my Red Hat server, the sshd will not accept my correct certificate login. However, If i start another sshd on another port, it works! (I assume the second sshd loads the same configruation files.)

second sshd started with: sudo /usr/sbin/sshd -p 54321 -d #-d is optional and prints debug output

ssh strange-host -p 22 -vvv prints:

debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Offering public key: /home/me/.ssh/id_dsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug3: Wrote 528 bytes for a total of 2389
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password

ssh strange-host -p 54321 -vvv prints:

debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Offering public key: /home/me/.ssh/id_dsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug3: Wrote 528 bytes for a total of 2389
debug1: Server accepts key: pkalg ssh-dss blen 433
debug2: input_userauth_pk_ok: SHA1 fp 0f:1c:df:27:f7:86:49:a8:47:7e:7f:f3:32:1c:7d:04:a3:73:a5:72

So the question is why the difference?

I have thought of no way to get any helpful logging from the "standard" sshd to troubleshoot the problem.

share|improve this question
    
Clearly, both instances have a totally different configuration. Did you restart the 'main' SSHD after reconfiguring? Why don't you configure your single instance to run on two ports? (mutiple Port definitions) What is the process behind port 22? (netstat -ntlp | grep \:22) Is this instance started with other options? (ps aux | grep 1234, replace pid from netstat output) –  gertvdijk Dec 12 '12 at 10:04
    
thanks for the input, the "main" is restarted. main cmdline is simply /usr/sbin/sshd (cat /proc/1234/cmdline). Starting main on another port wouldn't be good. I actually port-forwarded through "main" to even get to the secondary sshd as the firewall from my other host dont allow connecting through anything but 22. –  Hugo Dec 12 '12 at 10:09
    
this might be a hint, but the output should be normal: Dec 12 10:43:17 srvualo01 sshd[10821]: pam_krb5[10821]: error reading keytab 'FILE:/etc/krb5.keytab' –  Hugo Dec 12 '12 at 10:10

1 Answer 1

What do you get if you enable dubug output and compare the results e.g.

ssh -vvv          user@host 'echo Done'  2>&1 > ssh_port22.log
ssh -vvv -p 54321 user@host 'echo Done'  2>&1 > ssh_port54321.log
diff ssh_port22.log ssh_port54321.log
share|improve this answer
    
Thanks, I added the relevant output to the question as you suggested. –  Hugo Dec 12 '12 at 9:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.