openssh unix dev - Sep 2003 - 3.7.1p1 PAM Problems in RedHat 6.2

I've corresponded with several different techs at a
major dedicated webhosting provider and they too
so far have not been able to determine why the
newest version of OpenSSH 3.7.1p1 is conflicting
with PAM on our server running RedHat linux 6.2.

I've also tried installing 3.7.1p1 on other RedHat 6.2
servers and the exact same PAM problems. But on
7.1 RedHat servers I've had absolutely no problems.

When I revert back to 3.5p1 with the exact same
config/install procedure everything works just fine.

In short, have others experienced similar problems
installing the newest OpenSSH on RedHat 6.2?

Welcome suggestions...

Ron Bennett

I've corresponded with several different techs at a
major dedicated webhosting provider and they too
so far have not been able to determine why the
newest version of OpenSSH 3.7.1p1 is conflicting
with PAM on our server running RedHat linux 6.2.

I've also tried installing 3.7.1p1 on other RedHat 6.2
servers and the exact same PAM problems. But on
7.1 RedHat servers I've had absolutely no problems.

When I revert back to 3.5p1 with the exact same
config/install procedure everything works just fine.

In short, have others experienced similar problems
installing the newest OpenSSH on RedHat 6.2?

Welcome suggestions...

Ron Bennett

I've corresponded with several different techs at a
major dedicated webhosting provider and they too
so far have not been able to determine why the
newest version of OpenSSH 3.7.1p1 is conflicting
with PAM on our server running RedHat linux 6.2.

I've also tried installing 3.7.1p1 on other RedHat 6.2
servers and the exact same PAM problems. But on
7.1 RedHat servers I've had absolutely no problems.

When I revert back to 3.5p1 with the exact same
config/install procedure everything works just fine.

In short, have others experienced similar problems
installing the newest OpenSSH on RedHat 6.2?

Welcome suggestions...

p.s. I apologize if this posted twice - it didn't appear
in archives so I assume it didn't post the first time.

Ron Bennett

On Wed, Sep 17, 2003 at 03:27:55PM -0400, Ron Bennett
wrote:
> the
> newest version of OpenSSH 3.7.1p1 is conflicting
> with PAM on our server running RedHat linux 6.2.
What behavior are you seeing?  I'm running a RH 6.2 install, and 3.7.1p1
generally seemed to work, other than PermitEmptyPasswords, which seemed
to do nothing when pam was enabled.

There seems to be significant PAM related trauma resulting from the 3.7+
PAM code re-write in Solaris and (at least older) Linuxes.

Patched versions of 3.6.1p1 seem to work just fine. :-)

				Josh

Ok...I've found the problem...actually others have
hinted to it in older posts, but I didn't even think of
trying a different ssh client until I started looking at
the configs as Vincent had suggested...the sshd
files turned out to be exactly identical so that wasn't
it, and tech support stated emphatically that ssh
was working for them; it wasn't consistently before
which had really confused the issue.

In a nutshell, there is a compatibility problem with
the sshd 3.7 series and SecureCRT 3.4.6. My next
stop is the SecureCRT site and Google for details
about changes I need to make SecureCRT work...for
now I'm simply sshing in from another linux machine.

Anyone know what changed to make SecureCRT
not work anymore with some sshd installs? Bizarre!

Thank you in advance for your continued assistance.

Ron


At 05:57 PM 9/17/2003 -0700, Joshua Hill wrote:
>On Wed, Sep 17, 2003 at 03:27:55PM -0400, Ron Bennett wrote:
> > the
> > newest version of OpenSSH 3.7.1p1 is conflicting
> > with PAM on our server running RedHat linux 6.2.
>
>What behavior are you seeing?  I'm running a RH 6.2 install, and 3.7.1p1
>generally seemed to work, other than PermitEmptyPasswords, which seemed
>to do nothing when pam was enabled.
>
>There seems to be significant PAM related trauma resulting from the 3.7+
>PAM code re-write in Solaris and (at least older) Linuxes.
>
>Patched versions of 3.6.1p1 seem to work just fine. :-)
>
>                                 Josh

At 09:55 PM 9/17/2003 -0400, Ron Bennett wrote:

<snipped>
>Anyone know what changed to make SecureCRT
>not work anymore with some sshd installs? Bizarre!
Addendum...keyboard interactive *on* in sshd_config
and using ssh2 with keyboard interactive logins in
SecureCRT works like a charm...

Not sure if this is an ideal login setup, but at this
point it's the only way I'm able to login into servers
and get work done. Welcome further suggestions.

On an aside, this only seems to be necessary for the
RedHat linux 6.2 servers I maintain...newer Redhat
versions work like a charm without keyboard interactive.

Ron

Ron Bennett wrote:
> Anyone know what changed to make SecureCRT
> not work anymore with some sshd installs? Bizarre!
Check if it has "keyboard-interactive" authentication enabled.

See:
http://bugzilla.mindrot.org/show_bug.cgi?id=648
http://bugzilla.mindrot.org/show_bug.cgi?id=669

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.