From owner-freebsd-questions Thu Jun 27 1: 4:25 2002 Delivered-To: freebsd-questions@freebsd.org Received: from benny.geektank.org (ip152.courtyard-off-main.sea.interquest.net [66.135.148.152]) by hub.freebsd.org (Postfix) with ESMTP id EFEFD37B401 for ; Thu, 27 Jun 2002 01:04:20 -0700 (PDT) Received: from localhost (tmchow@localhost) by benny.geektank.org (8.11.6/8.11.6) with ESMTP id g5R849P15561 for ; Thu, 27 Jun 2002 01:04:10 -0700 (PDT) (envelope-from questions3@geektank.org) Date: Thu, 27 Jun 2002 01:04:09 -0700 (PDT) From: questions3@geektank.org X-X-Sender: tmchow@benny.geektank.org To: questions@freebsd.org Subject: Can't use Privsep in OpenSSH 3.4p1 Message-ID: <20020627005900.R15532-100000@benny.geektank.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG I just upgraded to OpenSSH 3.4 portable but can't use the privilege separation feature. If it's enabled, I can't receive any incoming connections. I've done a verbose dump of trying to connect to local host (see bottom of email). After the last line of the dump, it just sits there and does nothing. If I disable privilege separation, everything works ok and connections are accepted as normal. I verified that the sshd user exists and the /var/empty dir was created by the port with teh right permissions. Anyone have any thoughts? ---- dump -------------- OpenSSH_3.4p1, SSH protocols 1.5/2.0, OpenSSL 0x0090601f debug1: Reading configuration data /etc/ssh/ssh_config debug1: Rhosts Authentication disabled, originating port will not be trusted. debug1: ssh_connect: needpriv 0 debug1: Connecting to localhost [127.0.0.1] port 22. debug1: Connection established. debug1: identity file /root/.ssh/identity type 0 debug1: identity file /root/.ssh/id_rsa type -1 debug1: identity file /root/.ssh/id_dsa type -1 debug1: Remote protocol version 1.99, remote software version OpenSSH_3.4p1 debug1: match: OpenSSH_3.4p1 pat OpenSSH* Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_3.4p1 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-cbc hmac-md5 none debug1: kex: client->server aes128-cbc hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: dh_gen_key: priv key bits set: 136/256 debug1: bits set: 1061/2049 debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Host 'localhost' is known and matches the RSA host key. debug1: Found key in /root/.ssh/known_hosts:5 debug1: bits set: 1020/2049 debug1: ssh_rsa_verify: signature correct debug1: kex_derive_keys debug1: newkeys: mode 1 debug1: SSH2_MSG_NEWKEYS sent debug1: waiting for SSH2_MSG_NEWKEYS debug1: newkeys: mode 0 debug1: SSH2_MSG_NEWKEYS received debug1: done: ssh_kex2. debug1: send SSH2_MSG_SERVICE_REQUEST debug1: service_accept: ssh-userauth debug1: got SSH2_MSG_SERVICE_ACCEPT To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message