Re: login works via ssh but not via telnet (211 Views)
Reply
Frequent Advisor
Brett Simpson
Posts: 75
Registered: ‎07-07-2003
Message 1 of 25 (212 Views)
Accepted Solution

login works via ssh but not via telnet

I created a user account and it works when loggin in via ssh. It doesn't work via telnet. I also just realized that root is accessible via ssh but not telnet. Any ideas?

Thanks
Esteemed Contributor
Sunny123_1
Posts: 413
Registered: ‎05-06-2009
Message 2 of 25 (212 Views)

Re: login works via ssh but not via telnet

Hi

Check your /etc/inetd.conf file and look for telnet option i think it has # mark.

Also check /var/adm/inetd.sec file and look any telnet deny is there or not

Hope this help.

Regards
Sunny
Trusted Contributor
Basheer_2
Posts: 571
Registered: ‎09-12-2002
Message 3 of 25 (212 Views)

Re: login works via ssh but not via telnet

This is good.

Usually now a days sysadmins disable all the traditional insecure services to secure the system.

sunny has given all the correct steps.

Trusted Contributor
Basheer_2
Posts: 571
Registered: ‎09-12-2002
Message 4 of 25 (212 Views)

Re: login works via ssh but not via telnet

if you still need it.

follow Sunny's steps and also there should be entries in the /etc/services file.
Exalted Contributor
Steven E. Protter
Posts: 33,806
Registered: ‎08-15-2002
Message 5 of 25 (212 Views)

Re: login works via ssh but not via telnet

Shalom,

Check inetd.conf

Probably telnet is disabled.

netstat -an | grep ":23 "

See if telnet is listening.

If it is, see if inetd.sec is blocking telnet or TCP wrappers configuration is interfering.

Check logs /var/adm/syslog/syslog.log

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
Frequent Advisor
Brett Simpson
Posts: 75
Registered: ‎07-07-2003
Message 6 of 25 (212 Views)

Re: login works via ssh but not via telnet

I've checked /etc/inetd.conf and there are no commented lines regarding telnet. /var/adm/inetd.sec does not exist on this server.

I can also telnet to other non-root users without a problem.
Acclaimed Contributor
James R. Ferguson
Posts: 21,184
Registered: ‎07-06-2000
Message 7 of 25 (212 Views)

Re: login works via ssh but not via telnet

Hi Brett:

> I can also telnet to other non-root users without a problem.

Look for your '/etc/securetty' file. It undoubtedly exists and has a line with the word "console" in it. The presence of this file inhibits root logins to the listed devices.

Regards!

...JRF...
Frequent Advisor
Brett Simpson
Posts: 75
Registered: ‎07-07-2003
Message 8 of 25 (212 Views)

Re: login works via ssh but not via telnet

Telnet is not disabled at all. I can connect, just get a reply that login is incorrect. This only happens on root and certain other non-root users.
Frequent Advisor
Brett Simpson
Posts: 75
Registered: ‎07-07-2003
Message 9 of 25 (212 Views)

Re: login works via ssh but not via telnet

James,
Shouldn't that entry in /etc/securetty also disable root login via ssh? I can login to the root account via ssh. The console entry is in /etc/securetty, but doesn't stop login from ssh. I also commented it out and still the same results.

That also doesn't really explain why I can login via telnet to some non-root users, but can't with others.

This is also a system that I just inherited, so I didn't set it up.
Acclaimed Contributor
James R. Ferguson
Posts: 21,184
Registered: ‎07-06-2000
Message 10 of 25 (212 Views)

Re: login works via ssh but not via telnet

Hi (again) Brett:

> Shouldn't that entry in /etc/securetty also disable root login via ssh? I can login to the root account via ssh.

No, 'ssh' uses 'PermitRootLogin' in '/opt/ssh/etc/sshd_config'. Change it to "no" (and remove the comment mark) and restart the 'sshd' daemon.

Regards!

...JRF...
Acclaimed Contributor
James R. Ferguson
Posts: 21,184
Registered: ‎07-06-2000
Message 11 of 25 (211 Views)

Re: login works via ssh but not via telnet

Hi:

By the way, Brett, you should read and honor:

http://forums13.itrc.hp.com/service/forums/helptips.do?#28

Evaluating the help you received not only says "thanks" but helps trollers find suitable solutions to their questions later.

Regards!

...JRF...
Frequent Advisor
Brett Simpson
Posts: 75
Registered: ‎07-07-2003
Message 12 of 25 (211 Views)

Re: login works via ssh but not via telnet

James,
Thanks and I will start doing that.
Frequent Advisor
Brett Simpson
Posts: 75
Registered: ‎07-07-2003
Message 13 of 25 (211 Views)

Re: login works via ssh but not via telnet

Still hasn't really addressed my non-root users issue. I've checked everything that's been suggested. Still don't know why I can login to some non-root users via telnet, but not others.
Esteemed Contributor
Tingli
Posts: 613
Registered: ‎08-13-2007
Message 14 of 25 (211 Views)

Re: login works via ssh but not via telnet

Maybe you are lucky enough to find information from file /var/adm/syslog/syslog.log with the failed telnet login.
Acclaimed Contributor
James R. Ferguson
Posts: 21,184
Registered: ‎07-06-2000
Message 15 of 25 (211 Views)

Re: login works via ssh but not via telnet

Hi (again) Brett:

> Still don't know why I can login to some non-root users via telnet, but not others.

Ok, I missed the "non-root" subset. I would begin by comparing the profiles of non-root users who can sucessfully login with those who cannot.

Regards!

...JRF...
Honored Contributor
Mel Burslan
Posts: 3,214
Registered: ‎08-26-1998
Message 16 of 25 (211 Views)

Re: login works via ssh but not via telnet

ssh might authenticate by means of a pass-phrase which is different than that of a password. If your ssh authentication is set up using pass-phrases and when you telnet, you are trying to use the same pass-phrase as password, you might be failing because your password is set as some other string on the failing accounts whereas it might be set to the same in working accounts.

Can you run the command below and post the debug output here:

ssh -vvv user@hostname

don't worry, the pass-phrase or password will not show in your screen capture.
________________________________
UNIX because I majored in cryptology...
Frequent Advisor
Brett Simpson
Posts: 75
Registered: ‎07-07-2003
Message 17 of 25 (211 Views)

Re: login works via ssh but not via telnet

There is nothing in syslog at all. James, that was my next step. Thanks.
Frequent Advisor
Brett Simpson
Posts: 75
Registered: ‎07-07-2003
Message 18 of 25 (211 Views)

Re: login works via ssh but not via telnet

Mel, Here goes:

OpenSSH_3.9, OpenSSL 0.9.7d 17 Mar 2004
HP-UX Secure Shell-A.03.91.002, HP-UX Secure Shell version
debug1: Reading configuration data /opt/ssh/etc/ssh_config
debug3: RNG is ready, skipping seeding
debug2: ssh_connect: needpriv 0
debug1: Connecting to cbpux30 [164.103.219.11] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/3
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_4.5p1+sftpfilecontrol-v1.1-hpn12v14
debug1: match: OpenSSH_4.5p1+sftpfilecontrol-v1.1-hpn12v14 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.9
debug2: fd 4 setting O_NONBLOCK
debug3: RNG is ready, skipping seeding
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_init: found hmac-md5
debug1: kex: server->client aes128-cbc hmac-md5 none
debug2: mac_init: found hmac-md5
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 125/256
debug2: bits set: 491/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: check_host_in_hostfile: filename /root/.ssh/known_hosts
debug3: check_host_in_hostfile: match line 8
debug3: check_host_in_hostfile: filename /root/.ssh/known_hosts
debug3: check_host_in_hostfile: filename /opt/ssh/etc/ssh_known_hosts
debug1: Host 'cbpux30' is known and matches the RSA host key.
debug1: Found key in /root/.ssh/known_hosts:8
Warning: Permanently added the RSA host key for IP address '164.103.219.11' to the list of known hosts.
debug2: bits set: 509/1024
debug1: ssh_rsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /root/.ssh/id_rsa (00000000)
debug2: key: /root/.ssh/id_dsa (00000000)
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug3: start over, passed a different list publickey,password,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug3: no such identity: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug3: no such identity: /root/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug2: we sent a keyboard-interactive packet, wait for reply
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
Password:
debug3: packet_send2: adding 32 (len 23 padlen 9 extra_pad 64)
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 0
debug3: packet_send2: adding 48 (len 10 padlen 6 extra_pad 64)
debug1: Authentication succeeded (keyboard-interactive).
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug1: Entering interactive session.
debug2: callback start
debug2: client_session2_setup: id 0
debug2: channel 0: request pty-req confirm 0
debug3: tty_make_modes: ospeed 9600
debug3: tty_make_modes: ispeed 0
debug3: tty_make_modes: 1 3
debug3: tty_make_modes: 2 28
debug3: tty_make_modes: 3 127
debug3: tty_make_modes: 4 21
debug3: tty_make_modes: 5 4
debug3: tty_make_modes: 6 0
debug3: tty_make_modes: 7 255
debug3: tty_make_modes: 8 17
debug3: tty_make_modes: 9 19
debug3: tty_make_modes: 10 26
debug3: tty_make_modes: 11 255
debug3: tty_make_modes: 13 255
debug3: tty_make_modes: 14 255
debug3: tty_make_modes: 16 255
debug3: tty_make_modes: 30 1
debug3: tty_make_modes: 31 0
debug3: tty_make_modes: 32 0
debug3: tty_make_modes: 33 1
debug3: tty_make_modes: 34 0
debug3: tty_make_modes: 35 0
debug3: tty_make_modes: 36 1
debug3: tty_make_modes: 37 0
debug3: tty_make_modes: 38 1
debug3: tty_make_modes: 39 0
debug3: tty_make_modes: 40 1
debug3: tty_make_modes: 41 0
debug3: tty_make_modes: 50 1
debug3: tty_make_modes: 51 1
debug3: tty_make_modes: 52 0
debug3: tty_make_modes: 53 1
debug3: tty_make_modes: 54 1
debug3: tty_make_modes: 55 1
debug3: tty_make_modes: 56 0
debug3: tty_make_modes: 57 0
debug3: tty_make_modes: 58 0
debug3: tty_make_modes: 59 0
debug3: tty_make_modes: 60 0
debug3: tty_make_modes: 61 0
debug3: tty_make_modes: 62 0
debug3: tty_make_modes: 70 1
debug3: tty_make_modes: 71 0
debug3: tty_make_modes: 72 1
debug3: tty_make_modes: 73 0
debug3: tty_make_modes: 74 0
debug3: tty_make_modes: 75 0
debug3: tty_make_modes: 90 1
debug3: tty_make_modes: 91 1
debug3: tty_make_modes: 92 1
debug3: tty_make_modes: 93 0
debug2: channel 0: request shell confirm 0
debug2: fd 4 setting TCP_NODELAY
debug2: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug2: channel 0: rcvd adjust 131072
Last successful login: Tue Jun 16 08:27:37 MDT 2009 localhost
Last authentication failure: Tue Jun 16 07:47:19 MDT 2009 localhost
Honored Contributor
Mel Burslan
Posts: 3,214
Registered: ‎08-26-1998
Message 19 of 25 (211 Views)

Re: login works via ssh but not via telnet

Hmmm... so you are actually using the password authentication via ssh. And you are providing the same password to the telnet session and it won't work. Right ?

In this case I am going to go out on a limb and say something your terminal emulator doing is causing you this grief. What, I can not say, but a wrong terminal type emulation, might prevent some characters from being typed. Also, are you using any auto-login scripts on your terminal emulators ?

As a suggestion, did you try typing your password on a notepad (or other ascii editor) and pasting it to ssh and telnet sessions simultaneously ?
________________________________
UNIX because I majored in cryptology...
Exalted Contributor
Steven E. Protter
Posts: 33,806
Registered: ‎08-15-2002
Message 20 of 25 (211 Views)

Re: login works via ssh but not via telnet

Shalom again,

Off the wall suggestion.

Stop using telnet. Authentication is in clear text. ssh is a good replacement.

You might want to generate a new public ssh key without a pass phrase.

Check the permissions and ownership of the files in .ssh and the permissions and ownership of the .ssh folder

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
Frequent Advisor
Brett Simpson
Posts: 75
Registered: ‎07-07-2003
Message 21 of 25 (211 Views)

Re: login works via ssh but not via telnet

Mel,
I am using the same password on both. This is only helping with some user accounts. My personal non-root account works just fine via ssh or telnet.

I would think that rules out the emulator issue. I definitely need to check the .profile.
Acclaimed Contributor
Dennis Handly
Posts: 25,206
Registered: ‎03-06-2006
Message 22 of 25 (211 Views)

Re: login works via ssh but not via telnet

>I would think that rules out the emulator issue.

I.e. no uses of # or @.
Exalted Contributor
Steven E. Protter
Posts: 33,806
Registered: ‎08-15-2002
Message 23 of 25 (211 Views)

Re: login works via ssh but not via telnet

Shalom again Brett.

If both systems are under your control, safely eliminate the password (ssh only).

http://www.hpux.ws/?p=10

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
Regular Advisor
Anoop P_2
Posts: 91
Registered: ‎01-21-2004
Message 24 of 25 (211 Views)

Re: login works via ssh but not via telnet

Check the entry in password file for those users who can login using ssh but not telnet:

user1:x:uid:gid:GECOS:home:shell

That x here would mean the account is not setup with a password at all, so they cant telnet.

check user home directory/.ssh folder for keys, mostly you'll find ssh keys that are setup, so user can login using keys.
Regular Advisor
Shankar_6
Posts: 151
Registered: ‎02-12-2005
Message 25 of 25 (211 Views)

Re: login works via ssh but not via telnet

Hi,

check for ur /etc/profile..may be it has something that denies login to specific user (in ur case it is root)..

if there is a console entry in ur /etc/securetty file then u cannot do a direct root login ..(need use su or sudo ..).In this case u can login as root only on console and not by telnet..

The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation.