IBM i Global

IBM i 

A space for professionals working with IBM’s integrated OS for Power systems to exchange ideas, ask questions, and share expertise on topics like RPG and COBOL development, application modernization, open source integration, system administration, and business continuity.


#Power


#IBMi
#Power
 View Only

  • 1.  SSH sign-on fails with "Access denied" for a single profile when others work fine

    Posted 4 days ago

    Looking for some ideas on this weird problem.  I have a single profile (my profile actually) that fails logging in with its password via SSH.  This happens only on one of our partitions.  We have another partition that the same userid/password works fine to log in via SSH.

    Has anyone experienced such an issue?

    Thanks, Scott



    ------------------------------
    Scott Schollenberger
    ------------------------------


  • 2.  RE: SSH sign-on fails with "Access denied" for a single profile when others work fine

    Posted 4 days ago
    Hello, it can be related with the public key authentication for that user, check the home directory, the ssh directory and authorized_keys file permissions and ownership.
    You can also start from PASE shell a separate sshd daemon in debug mode and test from a client:
    /usr/sbin/sshd -p 2201 -ddd
    Fom a client
    Ssh -p 2201 testuser@yoursystem
    In the PASE session you would see debug messages where probably you'll find the problem.

    Best Regards

    -------------------------

    Andreu Rul

    CTO

    Telf: +34 663 817 144

     

     

    signature_256849821

     




    Original Message


  • 3.  RE: SSH sign-on fails with "Access denied" for a single profile when others work fine

    Posted 4 days ago

    As Andreu has highlighted it's normally related to the .ssh directory in your home profile area as it requires certain permissions. When trying the ssh connection you can use the -v (which is the debug argument) to show the different logging information.

    You can also use -vv or -vvv for more debug level. You need to check the authorities, and owners on the IFS paths. 

    The last option is whether the ssh config has been modified to deny and allow only certain users.

    Hope this helps.



    ------------------------------
    James Cole
    ------------------------------

    Original Message


  • 4.  RE: SSH sign-on fails with "Access denied" for a single profile when others work fine

    Posted 4 days ago

    Thanks Andreu and James - your advice to start a separate sshd in debug mode is what ultimately led me to the real problem.

    It turned out not to be permissions on ~/.ssh or authorized_keys, and not an sshd_config restriction. The debug output showed:

    User <profile> not allowed because shell /QOpenSys/QIBM/ProdData/OPS/tools/bin/bash does not exist
Failed password for invalid user ...

    So sshd was rejecting the profile itself because the PASE shell path stored for that user pointed to an old 5733-OPS bash executable that no longer exists on that LPAR. I'm not sure how it got set like that.  It was the only profile on the LPAR that had such a path set.

    I confirmed it with:

    SELECT AUTHORIZATION_NAME, PASE_SHELL_PATH
FROM QSYS2.USER_INFO;

    and fixed it by updating the shell to a valid one:

    CALL QSYS2.SET_PASE_SHELL_INFO(
    '<USER>',
    '/QOpenSys/pkgs/bin/bash'
);

    After correcting the shell path, the user could authenticate normally and VS Code's Code for IBM i extension also worked again.

    Thanks again, Scott



    ------------------------------
    Scott Schollenberger
    ------------------------------

    Original Message


  • 5.  RE: SSH sign-on fails with "Access denied" for a single profile when others work fine

    Posted 4 days ago
    Edited by Sylvain Manceau 4 days ago

    For further reference: https://ibmi-oss-docs.readthedocs.io/en/latest/troubleshooting/SETTING_BASH.html.



    ------------------------------
    Sylvain Manceau
    Blue
    ------------------------------

    Original Message


  • 6.  RE: SSH sign-on fails with "Access denied" for a single profile when others work fine

    Posted 3 days ago

    Thanks, Sylvain for that link. 



    ------------------------------
    Scott Schollenberger
    ------------------------------

    Original Message


Related Content