unable to ssh to device after JHF upgrade

[LostBoY]

i recently upgraded my R81.20 Cluster to the latest JHF. however, post upgrade when i try to ssh the device via any user i  get an error "No supported authentication methods available (server sent public key)". I am suspecting the JHF changed something in the sshd_config or templ files..i tried to change the PasswordAuthentication variable to yes from no..after that i didnt get the "No supported authentication." error but the credentials somehow doesnt work.

any help in resolving this is appreciated.

thanks

[AkosBakos]

Hi @LostBoY 

Did you revert the settings?

I checked in my LAB, my cipher settings are this:

[Expert@gw-sakos-lab01:0]# clish -c "show configuration" | grep cipher
set ssh server cipher 3des-cbc off
set ssh server cipher aes128-cbc off
set ssh server cipher aes128-ctr on
set ssh server cipher aes128-gcm@openssh.com on
set ssh server cipher aes192-cbc off
set ssh server cipher aes192-ctr on
set ssh server cipher aes256-cbc off
set ssh server cipher aes256-ctr on
set ssh server cipher aes256-gcm@openssh.com on
set ssh server cipher chacha20-poly1305@openssh.com on
set ssh server cipher rijndael-cbc@lysator.liu.se off
[Expert@gw-sakos-lab01:0]#

These are the default, I did't change them.

What kind of ssh client is in use?

Akos

[LostBoY]

i tried logging in via putty.. it is with putty i get the no support auth error.. i can access the GUI of the device but the ssh seems to have broken

[the_rock]

Here is how you fix this problem. Funny enough, had customer yesterday with exact same issue. What you do is below ( no need to reboot or cpstop; cpstart after)

1) console into the device 

2) cd /etc/ssh

3) vi sshd_config

4) search for PasswordAuth

5) change all entries to yes

6) :wq! to save

Edit...after reading your post again, sounds like you already tried this, though I would make sure all entried with PasswordAuth do show as yes.

7) test and Im positive it will work

Andy

[LostBoY]

thanks for the reply..yea  i changed passauth to yes in the sshd config file post which i was able to get the login prompt but somehow none of the credentials work

[Duane_Toler]

I had the exact same phenomenon you described after a recent JHF update.  If you've ever made a custom configuration to the sshd template (like I have), then this will break.   R&D introduced a change that has an error in their xlate script because it inserts a block of text using 'sed'.  I have a TAC case opened for it, and R&D has a task opened and they're working on it now.  They have a potential fix that is being tested.

In the meantime, you need to use cprid on the management server to hack your way through it via rexec to the gateway.  You can also use Gaia API (Ansible or manually) to upload a default sshd_config file to the host.  You can either use cprid or Gaia API run-script to move the file into place (/etc/ssh) and restart SSHD.

It's not pretty, but it's your only option when the gateway is 10,000 mi (or km) away.

(Edit: clarity on what file to upload)

[the_rock]

O wow...so sounds @Duane_Toler when console access is not available, not too many other options : - (

Andy

[Duane_Toler]

Yep, the CPRID hack via SIC is your only remaining option.  You'll have to adapt sk106490 for the commands you need.  This should get you very close:

Assuming you get a clean SSH configuration uploaded via Gaia API put-file, you can move it into place (assuming you uploaded the file to /home/admin):

$CPDIR/bin/cprid_util -server <IP_address_of_Security_Gateway> -verbose rexec -rcmd "mv /home/admin/sshd_config /etc/ssh"

Restart SSHD (Gaia still uses the SysV style scripts, not systemd):

$CPDIR/bin/cprid_util -server <IP_address_of_Security_Gateway> -verbose rexec -rcmd "service sshd restart"

Gaia API is on by default and open to the 'admin' user.  You can use the Ansible module for it, or craft your own method manually.  You can't use SCP or SFTP because SSH is broken.

(Edit: typo)

[the_rock]

I will definitely save this process if I ever come into this situation (sure hope not)

Tx Duane!

Andy

[LostBoY]

i have the GUI access to the device.. i can upload the sshd file via that ? 

[PhoneBoy]

Not directly, but you can access the CLI:

Editing a file using vi might be problematic using this method.

[Pedro_Costa]

Good morning, I'm having the same problem and the TAC came back with some process to resolve this case.

[Duane_Toler]

Excellent! Let us know if it helps. If you're able to share the info, please post it here so others can benefit.

[the_rock]

Can you send what /etc/ssh/sshd_config file looks like?

Andy

[the_rock]

Can you please share the process if it ends up working for you?

Andy

[Pedro_Costa]

sorry I missed the point, I'm actually asking.

[the_rock]

Sounded like you meant TAC had process for it. Anyway, would you mind send content of /etc/ssh/sshd_config?

Andy

[Pedro_Costa]

Sorry for the delay, I'm attending to other calls, here's the sshd_config of the manager that has the problem

[Pedro_Costa]

another thing, it is accessible via ssh but only with the admin user

[the_rock]

I checked lines with PasswordAuthentication and they all shows yes at the end, so thats correct. Wait, you say ONLY admin can log in? How many other users are there? Can you create new user and assign admin privileges and test?

Andy

[Pedro_Costa]

I checked the lines with PasswordAuthentication and they all show "yes" at the end, so it's correct. - Yes, all the lines with PasswordAuthentication have "yes."

Wait a minute, you're saying ONLY the administrator can log in?

The only user authenticating via SSH is the admin user.

How many other users are there?

10 users.

Can you create a new user, assign administrator privileges, and test?

I've already tested this, created a new one, and added admin permissions, but the error still occurs.

[the_rock]

What is the exact error you get? Can you paste it please?

Andy

[Pedro_Costa]

Attached is the error that occurred when trying to access the manager's ssh

[the_rock]

I just found this link about that error. Not sure what ssh app you use, but if its putty, maybe try kitty (another version very similar to putty) or solar putty 4.2.2.0

Andy

PuTTY fatal error: "No supported authentication methods available" - Stack Overflow

[PhoneBoy]

It looks like the SSH server is only accepting Public Key authentication (not password).
When you changed the sshd_config, did you restart sshd?

[the_rock]

Always forget about that, good point. @Pedro_Costa , just run service sshd restart from expert mode

Andy