Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Running Ubuntu 12.04

I can successfully login via SSH using any user (root included), however whenever I attempt to SFTP into the server I get an authentication refused. Below is the error on client side (winscp), and below that the "/var/log/auth.log". It is worth noting that I can also SFTP locally. This shouldn't be a firewall problem, especially as a port scanner reveals that the server is listening on port 22.


Authentication log (see session log for details):
Using username "test-user".

Authentication failed.

Apr 29 07:34:29 HOST_NAME sshd[3453]: Accepted password for test-user from X.X.X.X port 43592 ssh2
Apr 29 07:34:29 HOST_NAME sshd[3453]: pam_unix(sshd:session): session opened for user test-user by (uid=0)
Apr 29 07:34:31 HOST_NAME sshd[3564]: subsystem request for sftp by user test-user
Apr 29 07:34:48 HOST_NAME sshd[3453]: pam_unix(sshd:session): session closed for user test-user

Not sure where else to really start from debugging this. I have already completely uninstalled OPENSSH-SERVER and re-installed. Let me know if there are further details required (exact commands will probably save time =P)

EDIT: /etc/ssh/sshd_config


# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0

Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes

RSAAuthentication no
PubkeyAuthentication no
#AuthorizedKeysFile     %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

share|improve this question
    
I installed another SSH client as a back up, and put it on a different port. I can SSH and SFTP via this new port, but still not via the default port 22 that OPENSSH is listening on. –  the_server_woes Apr 29 '13 at 22:42

2 Answers 2

up vote 1 down vote accepted

Comment out the "AcceptEnv LANG LC_*"

share|improve this answer
    
Thanks, this it it. –  the_server_woes May 8 '13 at 22:59

If this is a Red Hat/CentOS server, a possible cause could be SELinux. You may check it's status with the

getenforce

command and either change it to disable or to permissive as a temporary solution.

share|improve this answer
    
Thanks, but this is Ubuntu 12.04. I'll try again. I remember one of the first things I did when setting up the server a few years ago was disable all firewall stuff. –  the_server_woes Apr 29 '13 at 7:13
    
Just tried this anyway, and it said it was already disabled. –  the_server_woes Apr 29 '13 at 7:14
    
Can you try from a Linux client? If yes, try to increase verbosity (-vv) in order to see where it fails. –  Peter Apr 29 '13 at 7:30
    
Here you go. pastebin It stops after it authenticates at line: debug1: Sending subsystem: sftp –  the_server_woes Apr 29 '13 at 23:00
    
@the_server_woes Do you have the same problem with normal users? Or just root? In my servers, and I have quite a few, just after the "Sending subsystem: sftp" I see a "Connected to <servername>". Is your user setup correctly? Can you try with a normal user? –  Peter Apr 30 '13 at 6:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.