SSH Connection Refused, Possibly Permission Issue

Question

Level 1

10 points

SSH Connection Refused, Possibly Permission Issue

we've had a rather bizarre problem with ssh for a while.
i'll describe it as best as i can, and hopefully someone here can come up with a fix.

first, how it happened. we are a rather large marketing firm, and we frequently push out software using Casper. we started to notice some Leopard machines locking themselves out of ssh after we pushed out some printer installation packages.

second, the main symptoms. ssh connection is refused. however, remote login is shown as ON in System Preference, as well as in the terminal (/sbin/service --list). "netstat -anf inet" does NOT show port 22 as a listening port.

naturally, i tried to restart remote login. when done in System Preference, status says "ssh is shutting down" or something to that effect and just hangs. when done in terminal, "systemsetup -setremotelogin on" returns "ssh is already on", "systemsetup -setremotelogin off" returns nothing and ssh is NOT turned off. "/sbin/service serviceName stop" and "/sbin/service serviceName start" also don't do a thing.

more information hopefully will find people who are looking into this thread:
1. the initial package push-out was performed on both Tiger and Leopard machines, and only Leopard machines were affected.
2. problem can be "temporarily" fixed by repairing permission and restarting, but it does come back. but because the problem doesn't come back right away (sometimes it comes back after days), we have not been able to determine what makes the problem come back. to me this suggest a permission issue that is triggered by some background process.

i'd appreciate any input. thanks.

Mac OS X (10.5.7)

Posted on Jul 13, 2009 10:52 AM

Reply

Answer 1

BobHarris

Level 9

56,927 points

Jul 13, 2009 12:39 PM in response to TsW Mac

Attempt to make an ssh connection using:


ssh -v -v -v username@remote.macs.address

the tripple -v -v -v is going to give you lot of diagnostic information. If you compare the output from a working ssh connection against an ssh connection that failes, it can help you identify where the connection is failing.

You said that after doing a repair permissions you could get things working again. ssh requires some specific files to have specific permissions (mostly restricted permissions).

If you look in


man ssh

and search for "permission" you will find the files and directories that must have specific permissions, otherwise ssh will assume that remote account is not secure and refuse to make a connection. Generally if ssh thinks there are ways for anyone to modify the $HOME/.ssh directory (rename it, delete it, replace it) or they can change the files inside of $HOME/.ssh, then ssh thinks the remote system is not secure and will not make the connection.

Reply

Answer 2

TsW Mac Author

Level 1

10 points

Jul 13, 2009 12:43 PM in response to BobHarris

thanks for the reply.
i am getting ready to step out, so i'll try it out tomorrow and i'll let you know of the result.
thanks again.

Reply

Answer 3

TsW Mac Author

Level 1

10 points

Jul 14, 2009 9:28 AM in response to BobHarris

this is the debug log from the terminal, which to me really doesn't say a whole lot except that the config file is read and the connection is refused.

ssh -v -v -v USER@192.0.0.1
OpenSSH_5.1p1, OpenSSL 0.9.7l 28 Sep 2006
debug1: Reading configuration data /etc/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to 192.0.0.1 [192.0.0.1] port 22.
debug1: connect to address 192.0.0.1 port 22: Connection refused
ssh: connect to host 192.0.0.1 port 22: Connection refused

i did spend some time reading the manual page for ssh, and i tried to repair manually some files' permission. my question now is, how do i restart the ssh process without restarting computer? my understanding is that in leopard ssh is opened by launchd only when it's necessary. can i simply kill launchd and restart it although the man page says that it's not supposed to be run directly?

also, just brain storming here, since ssh is only opened when necessary and netstat doesn't show port 22 as a listening port, could this not be a ssh problem but a problem somewhere else?

Reply

Answer 4

TsW Mac Author

Level 1

10 points

Jul 14, 2009 1:11 PM in response to TsW Mac

ok, I've identified the problem as a permission problem on a couple of configuration files. the user/group were set to _unknown, but by what process i can't identify. for now i have a cron script that runs every our to check the permission and fix if needed. thank you Bob, your post helped me a lot. now, if only i can find out what process messed up the permission of the files.

Reply

Answer 5

Aug 9, 2009 1:03 AM in response to TsW Mac

Hi TsW Mac,

Can you please tell me the files that had their permissions messed up?

Regards,
robin

Reply

Answer 6

KJK555

Level 4

2,906 points

Aug 9, 2009 1:41 AM in response to TsW Mac

you can also lock the files to prevent changes to them.
you may need terminal, (depending on their permissions).
sudo chflags uchg /path/to/file

to unlock:
sudo chflags nouchg /path/to/file

Kj

Reply

Answer 7

BobHarris

Level 9

56,927 points

Aug 9, 2009 8:24 AM in response to robinkansara

Can you please tell me the files that had their permissions messed up?

The files that require specific permissions are spelled out in


man ssh

Another useful diagnostic tool, is to use:


ssh -v -v -v username@good.system
ssh -v -v -v username@failing.system

now compare the diagnostic output and see where they diverge, and that will most likely indicate where the problem is located.

Reply