mainSavannah Administration - Support: sr #109618, SSH authentication failure to...

 
 

sr #109618: SSH authentication failure to dl.sv.nongnu.org

Submitter:  Colin Watson <cjwatson>
Submitted:  Sat 05 Jan 2019 01:24:31 PM UTC
   
 
Category:  Download area - developer access Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  rwp
Operating System:  GNU/Linux Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 06 Jan 2019 12:28:18 AM UTC, comment #1: 

Thank you for the problem report.  They are appreciated it.  As you know all of the GNU & FSF machines are moving ISPs now.  The entire collection of inter-working Savannah systems were moved over the last two days. It's been a long two days.

I literally called in a fix through Karl earlier today when I remembered something and realized why part of it was broken and had Karl fix it over the phone for me.  I was almost out of cell phone coverage and no keyboard.  Thanks Karl! Here is the full story on this problem.

Thursday I had been locked out of the system because the configuration required a working database connection even for root to log in.  I modified the sshd_config to avoid that for root.  On download I copied the configuration from vcs0 which was the first to run the new sshd_config.  And made a gratuitous change of AuthorizedKeysCommandUser user from root to nobody on both systems because it seemed it should not be needed.  However the program itself lived in /root/bin and /root on download0 was restricted while it was not on vcs0, allowing it to work on vcs0 as nobody but causing it to break on download0 as nobody.  The quick fix was to restore it to running as root so it can read the directory.  It's a very short perl program and not scary but seemed reasonable to run it as non-root if possible.

However that was only half of the problem.  It fixed the ssh key problem.  But the backend NFS server was not mapping uids.  Because in order to avoid being locked out there when the db connection was severed I had removed the nss-msyql module from /etc/nsswitch.conf for the IP migration.  I didn't think it had needed to be there on the NFS backend.  But I was wrong. It is used on the NFS backend to map uids.

Confusingly the nfs kernel server apparently needs nss working at nfs start time and does not pick up the working configuration later.  This required the nss mysql module to be restored, the nfs kernel restarted, and the mount point umount/re-mount (yes the mount needed re-mounting) in order to have uid mapping working.

All of that done I am now able to upload files to download.

Please try it now.  I think it should be working for you.  Thank you again for the problem report.  I will add a test in our regression suite for upload to download.


Bob Proulx <rwp>
Site Administrator
Sat 05 Jan 2019 01:24:31 PM UTC, original submission:  

I can't upload releases of my projects at the moment:

  $ scp man-db-2.8.5.tar.xz* dl.sv.nongnu.org:/releases/man-db/
  Received disconnect from 209.51.188.200 port 22:2: Too many authentication failures for cjwatson

I've checked (via scp -vvv) that the public keys being offered match those configured in my Savannah account; and I've been uploading this way for years with no previous problems.

I just tried swapping the order of the Ed25519 and RSA keys in my account on the off-chance that that might matter, but it made no difference.  Perhaps this has something to do with the recent IP address migration work?

Colin Watson <cjwatson>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by cjwatson (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-01-06 rwp StatusNone Done
        Assigned toNone rwp
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code