sslug-teknik team mailing list archive

[Kristian Nørgaard <kristian@xxxxxxxxxxxx>]

Jeg har problemer med at en baglæns ssh tunnel, hvor jeg bliver afvist 
med besked:
ssh_exchange_identification: Connection closed by remote host

Tidligere virkede følgende for mig:

1) computer1 kører sshd på port 2222

2) På computer2 udføres:
[computer2]$ ssh -p2222 kristian@computer1 -R 10022:127.0.0.1:2222

Efter login vises:
Tunnel is up
Press ctrl-c to close connection

3) Før kunne jeg så logge på computer2 fra computer1, ved at udføre

[computer1]$ ssh -p10022 kn@localhost

hvor kn er bruger på computer2

------------------------
Men nu får jeg:

[computer1]$ ssh -vvv -p10022 kn@localhost
OpenSSH_4.3p2 Debian-9, OpenSSL 0.9.8c 05 Sep 2006
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 127.0.0.1 [127.0.0.1] port 10023.
debug1: Connection established.
debug1: identity file /home/kn/.ssh/identity type -1
debug1: identity file /home/kn/.ssh/id_rsa type -1
debug3: Not a RSA1 key file /home/kn/.ssh/id_dsa.
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug3: key_read: missing keytype
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug3: key_read: missing whitespace
debug2: key_type_from_name: unknown key type '-----END'
debug3: key_read: missing keytype
debug1: identity file /home/kn/.ssh/id_dsa type 2
ssh_exchange_identification: Connection closed by remote host

---------------
Mange indlæg på web handler om /etc/hosts.allow og /etc/hosts.deny, alle 
linier i disse to filer er udkommenterede på computer1.

Kan nogen hjælpe mig.
Det er gået lang tid siden jeg brugte dette sidst, og der kan sagtens 
være sket ting omkring DNS lookup, hostnames, IP adresser...

mvh Kristian


PS: Og her er computer1's udgave af sshd_config:

---------------sshd_config -----------------
# Package generated configuration file
# See the sshd(8) manpage for defails

# What ports, IPs and protocols we listen for
Port 2222
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2,1
# HostKeys for protocol version 1
HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# ...but breaks Pam auth via kbdint, so we have to turn it off
# Use PAM authentication via keyboard-interactive so PAM modules can
# properly interface with the user (off due to PrivSep)
#PAMAuthenticationViaKbdInt no
# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 600
PermitRootLogin no
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile     %h/.ssh/authorized_keys

# rhosts authentication should not be used
#RhostsAuthentication no
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for 
RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Uncomment to disable s/key passwords
#ChallengeResponseAuthentication no

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication yes


# To change Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#AFSTokenPassing no
#KerberosTicketCleanup no

# Kerberos TGT Passing does only work with the AFS kaserver
#KerberosTgtPassing yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
#PrintLastLog no
KeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net
#ReverseMappingCheck yes

DenyUsers chm

Subsystem sftp /usr/lib/openssh/sftp-server

UsePAM yes