I am trying to connect to a new user account I created via SSH with the command
useradd -s /bin/false -d /home/username james
I added/edited the password via SSH with the command
passwd james
When trying to connect to my server using this user and pass via FileZilla I get the following error messages.
Response: 331 User James OK. Password required
Command: PASS *****
Response: 530 Login authentication failed
Error: Critical error
Error: Could not connect to server
When I try to login with this user/pass through SFTP I get the following error messages
Status: Connected to domain.com
Error: Connection closed by server with exitcode 1
Error: Could not connect to server
Either way it seems it doesn't allow me to use this newuser anywhere.
My server details
Linux 2.6.18-308.11.1.el5 GNU/Linux
(Red Hat 4.1.2-52)
Centos
Regarding FTP, the FTP server commonly used on Linux systems requires users to have a shell that's listed in the file /etc/shells. For example, this online ftpd man page says that, among other things, "The user must have a standard shell returned by getusershell(3).". The page for getusershell() shows that it reads shells from /etc/shells.
You could probably make FTP work adding /bin/false to /etc/shells. Your Linux system might have a more suitable shell available, like /usr/sbin/nologin.
Regarding SFTP, the ssh server normally provides SFTP service by by invoking a program called sftp-server. If you examine the server's sshd_config file, you'll probably find a line like this:
Subsystem sftp /usr/lib/openssh/sftp-server
sshd runs the subsystem program as a shell command, using the user's shell. If you set the user's shell to /bin/false, then sshd ends up running the command:
/bin/false -c /usr/lib/openssh/sftp-server
/bin/false ignores its command-line arguments and exits with code 1, so the SFTP client's session drops immediately after it starts.
sshd has an internal SFTP server component that can be used instead of the external program. The usual way of limiting SSH access to SFTP for some users is to set up a Match group within sshd_config, forcing the internal-sftp command for certain classes of users. Here are a couple examples of that:
http://en.wikibooks.org/wiki/OpenSSH/Cookbook/SFTP#SFTP-only_Accounts
https://serverfault.com/questions/354615/allow-sftp-but-disallow-ssh
Dont use "-s /bin/false". Use "-s /sbin/nologin" instead and it should be fine.
Make sure your account password hasn't expired. Mine did, and Filezilla exited with error code 1.
After logging onto the server and updating the account password (prompted immediately after connecting), I am now able to connect with SFTP & Filezilla.
Probably is a password related issue, check account
chage -l <user>
account must not be expired.
FTP doesn't allow /usr/sbin/nologin user
Response: 220 Welcome to the Scent Library's File Service.
Command: USER ftpuser
Response: 331 Please specify the password.
Command: PASS ******
Response: 530 Login incorrect.
filezilla 530 error - but password is correct
vsftpd: 530 Login incorrect
530 Login or password incorrect!
How can I connect via FTP using FileZilla? I get a 530 error.
Response: 220 Welcome to Test FTP service.
Command: USER ftpuser
Response: 331 Please specify the password.
Command: PASS ******
Response: 530 Login incorrect.
Error: Critical error
Error: Could not connect to server
Change user's shell
usermod -s /usr/sbin/nologin username
Then edit "/etc/shells" file and add this line
/usr/sbin/nologin
In order to connect to the server using ftp, you also need to run a ftp server / service or daemon.
An example of such ftp server is "vsftpd"
After installing it, you will also need to configure it and allow anonymous ftp access or ftp access to existing users
You will find the configuration file in the path "/etc/vsftpd/vsftpd.conf"
The below link might be useful for you --
https://www.digitalocean.com/community/tutorials/how-to-set-up-vsftpd-on-centos-6--2
Related
I've setup Cygwin and want to ssh with domain user account on windows server 2012 R2. It works fine if I start the sshd service with "Local system account" but if I start the service with a cygserver local account or domain\cygserver then the service starts fine but when I try to ssh I see the message sshd: PID 1944: fatal: seteuid 1801: No such device or address.
ssh in verbose mode on the client shows the following:
debug1: Authentication succeeded (publickey).
Connection to 10.10.10.10 closed by remote host.
Connection to 10.10.10.10 closed.
debug1: Exit status -1
Some articles like https://blog.peterwurst.com/2016/09/15/ssh-server-on-windows-with-cygwin/ suggest to enable the following GPO with cygserver account in it. I tried them still the same error.
Act as part of the operating system
Create a token object
Log on as a service
Replace a process level token
I've verified .ssh and authorized_keys permission and the user home directory exists and also passwd file has the /bin/bash shell for the user.
Any suggestion on how to resolve this issue?
I had this issue, and the solution was to start the CYGWIN ntsec servicem, before starting the CYGWIN OpenSSH service.
Verify the subject user and SSHD account are not locked / disabled.
Confirm that password login works. PKI and password login take different paths to create a process token.
I also had this issue in the log
seteuid XXXXXXXX: No such device or address
and this made the trick
passwd -R
I am running Linux on an embedded system with Buildroot+Dropbear. I am using systemd for init, if that matters.
Logging in via SSH works properly for root, but not as a regular user (gives "Permission denied, please try again."). The user's shell is redirected to a custom program with this entry in /etc/passwd:
admin:x:1000:1000:Custom user:/home/admin:/opt/customCLI
Logging in as the admin user works fine when the shell is /bin/sh. /opt/customCLI is a program I wrote that accepts a minimal set of commands.
Is there a way to support SSH logins directly to a custom program?
Add your program to /etc/shells
Some login tools will reject logins to users with unknown shells. This prevents the back door of using SSH to modify files or forward ports while being locked out with /usr/sbin/nologin or /bin/false.
I'm trying to ftp files from a windows computer to a Linux server (Redhad 6.1 with vsftpd). I can successfully login from the windows computer using:
ftp *servername*
and entering my credentials. However I need to ftp to the server and place a file in a directory because the users in the company will only have control of placing the file needed on the server. I am using the
ftp -s:filename.ftp *servername*
command and get an error during the login:
530 Login incorrect.
Login failed.
here is the code in the filename.ftp file:
user *username* *password*
sudo cd /dbx2/ekiexport
bi
put myfile.csv
bye
I have even tried:
user *username* pass *password*
sudo cd /dbx2/ekiexport
bi
put myfile.csv
bye
I know I can just ftp to the server to place the files there myself, but I need the users to run the script when they need to access the file. That's why I need to use the ftp -s:filename
I have a file on my desktop that I need to FTP to a server. As I've been navigating this server, I need to login with initial credentials to access the box and then needed to run sudo -u [username] ksh to access the folder I need. (No password)
In Filezilla however, I only enter credentials once and therefore, don't have the option to sudo as the user and get permissions to the folder.
Am I going about this process wrong and if so, what's the usual way to do this?
There is no way to switch user on the ftp protocol. You need to know the correct credentials in the first place.
The closest you could come would be to ftp the files to a directory you do have access to, log in with a shell, and then move the files using shell commands after switching user.
Having an issue when executing 'knife ssh' command.
I've configured properly the SSH keys for remote connection so that seems to work fine when trying to connect manually doing: ssh root#myhost.domain.com cause it automatically gives me access to myhost.domain.com without request for a password.
After that, I tried to run the following knife command to execute a recipe in my remote machine but I'm getting this error:
# knife ssh -C 1 "tags:amx_host AND chef_environment:dev" "chef-client -o recipe[amx]" -i root_dev -x root
WARNING: Failed to connect to myhost.domain.com -- Net::SSH::AuthenticationFailed: Authentication failed for user root#myhost.domain.com#myhost.domain.com
Seems like knife is identifying an invalid user name root#myhost.domain.com which should be just root instead.
Please, does anyone have any clues on how can I avoid this error or why SSH is taking a wrong user: root#myhost.domain.com instead of just root?
Typo issue: was taking a non-existing identity key file: root-dev for the remote connection