2

I'm running into this problem where if my rsync to an Amazon CentOS instance breaks mid-transfer (with a Ctrl+C for example), subsequent logins to the server no longer works. The Server just responds with a Permission Denied.

I purposely recreated the problem on the server and compared with another "working" remote and noticed that the following process (obtained via netstat)

/tmp/ssh-xxxxxxxxxx/agent.10287

is replaced with 

/var/run/rpcbind.sock

which undoubtedly is the remnant of the failed rsync.

My real question is, how do I prevent this from happening? I'm lucky to have maintained a connection with the server this time, but it won't be the case in a real rsync situation. I'm doing this via Mac OSX btw.

EDIT:

These are the errors in /var/log/audit/audit.log

sorry, a bit of digging gave me these error messages (/var/logs/audit/audit.log)

type=USER_AUTH msg=audit(1449596011.035:1271): pid=29682 uid=0 auid=4294967295 ses=4294967295 msg='op=pubkey acct="ec2-user" exe="/usr/sbin/sshd" hostname=? addr=x.x.x.x terminal=ssh res=failed'

type=USER_AUTH msg=audit(1449596011.071:1272): pid=29682 uid=0 auid=4294967295 ses=4294967295 msg='op=pubkey acct="ec2-user" exe="/usr/sbin/sshd" hostname=? addr=x.x.x.x terminal=ssh res=failed'

type=CRYPTO_KEY_USER msg=audit(1449596011.107:1273): pid=29682 uid=0 auid=4294967295 ses=4294967295 msg='op=destroy kind=server fp=        3a:38:b2:ce:9b:ad:68:7e:6b:26:10:aa:88:e4:32:cc direction=? spid=29683 suid=74  exe="/usr/sbin/sshd" hostname=? addr=x.x.x.x terminal=? res=success'

type=CRYPTO_KEY_USER msg=audit(1449596011.107:1274): pid=29682 uid=0 auid=4294967295 ses=4294967295 msg='op=destroy kind=session fp=? direction=both spid=29683 suid=74 rport=55760 laddr=172.30.0.175 lport=22  exe="/usr/sbin/sshd" hostname=? addr=x.x.x.x terminal=? res=success'

type=USER_ERR msg=audit(1449596011.107:1275): pid=29682 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:bad_ident grantors=? acct="?" exe="/usr/sbin/sshd" hostname=216-191-83-42.dedicated.allstream.net addr=x.x.x.x terminal=ssh res=failed'

type=CRYPTO_KEY_USER msg=audit(1449596011.107:1276): pid=29682 uid=0 auid=4294967295 ses=4294967295 msg='op=destroy kind=server fp=3f:3c:c8:a4:e7:63:46:84:5c:11:d1:19:28:66:b9:54 direction=? spid=29682 suid=0  exe="/usr/sbin/sshd" hostname=? addr=x.x.x.x terminal=? res=success'

type=CRYPTO_KEY_USER msg=audit(1449596011.107:1277): pid=29682 uid=0 auid=4294967295 ses=4294967295 msg='op=destroy kind=server fp=cc:6a:de:3e:ed:95:10:ee:21:28:6d:3f:7e:1e:2a:6d direction=? spid=29682 suid=0  exe="/usr/sbin/sshd" hostname=? addr=x.x.x.x terminal=? res=success'

type=CRYPTO_KEY_USER msg=audit(1449596011.107:1278): pid=29682 uid=0 auid=4294967295 ses=4294967295 msg='op=destroy kind=server fp=3a:38:b2:ce:9b:ad:68:7e:6b:26:10:aa:88:e4:32:cc direction=? spid=29682 suid=0  exe="/usr/sbin/sshd" hostname=? addr=x.x.x.x terminal=? res=success'

type=USER_LOGIN msg=audit(1449596011.107:1279): pid=29682 uid=0 auid=4294967295 ses=4294967295 msg='op=login acct="ec2-user" exe="/usr/sbin/sshd" hostname=? addr=x.x.x.x terminal=ssh res=failed'
Improve this question
7
  • What is the MaxSessions and MaxStartups fields in sshd_config set to?
    – Gmck
    Dec 8, 2015 at 16:36
  • What do you see in server log for these "denied" logins? Why they are rejected? It will be probably some wrong setup. What do you have changed in sshd_config? Do you use any special login scripts?
    – Jakuje
    Dec 8, 2015 at 17:08
  • Gmck - all of the ssh logins are the default config. I've set MaxSessions to 10 and MaxStartups to 10:30:100 with no luck Jakuje - I've been using the default setting for everything. How do I check the denied logs? I'm not seeing any relevant logs in /var/log
    – user2403366
    Dec 8, 2015 at 17:24
  • What are you trying to rsync? If it's something like /etc/passwd, that's just asking for trouble. With more info, I might be able to help. I just answered a similar rsync question here: serverfault.com/questions/741346/… Consider how distros update packages. They download all first, then install from the local [in your case remote] disk semi-atomically.
    – Craig Estey
    Dec 8, 2015 at 20:16
  • I've been trying to move about 2 GB worth of PHP and image files from local to remote (to the /home/ec2-user directory specifically) . I originally encountered this problem when I tried to stop the sync so that I can move them in smaller chunks. I'm not sure what other kind of information I can provide, I've done netstat -l and ssh -vvv to compare with other working instances and I can't find anything out of the ordinary on both the server and client side :( the only thing I can think of now is that I might have gone over some sort of limit cause it's a micro instance.
    – user2403366
    Dec 9, 2015 at 14:56

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .