Archlinux.fr [Forums]

# /etc/hosts.allow
sshd: 10.0.0.0/24

#
# /etc/hosts.allow
#
sshd: 192.168.0.0/255.255.255.0
distccd: 192.168.0.0/255.255.255.0
# End of file

j'ai même essayé de passer la clé publique via clé usb, mais non...

benjarobin a écrit :Plus simplement tu peux juste pour tester mettre ALL, car la syntaxe me semple correct

ssh -p 22 -v traaf@10.0.0.41
OpenSSH_5.2p1, OpenSSL 0.9.8k 25 Mar 2009
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to 10.0.0.41 [10.0.0.41] port 22.
debug1: Connection established.
debug1: identity file /home/traaf/.ssh/id_rsa type 1
debug1: identity file /home/traaf/.ssh/id_dsa type 2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.2
debug1: match: OpenSSH_5.2 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.2
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '10.0.0.41' is known and matches the RSA host key.
debug1: Found key in /home/traaf/.ssh/known_hosts:6
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: /home/traaf/.ssh/id_dsa
debug1: Server accepts key: pkalg ssh-dss blen 433
debug1: Authentication succeeded (publickey).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
Last login: Wed Jul 29 11:19:46 2009 from 10.0.0.10

Jul 29 11:04:00 Arch sudo: traaf : TTY=pts/2 ; PWD=/home/traaf ; USER=root ; COMMAND=/etc/rc.d/sshd restart
Jul 29 11:04:00 Arch sshd[5654]: Received signal 15; terminating.
Jul 29 11:04:01 Arch sshd[6179]: Server listening on 0.0.0.0 port 22.
Jul 29 11:05:28 Arch sshd[6181]: pam_access(sshd:account): failed to open accessfile=[/etc/security/access_ssh.conf]: No such file or directory
Jul 29 11:05:28 Arch sshd[6181]: pam_access(sshd:account): failed to parse the module arguments
Jul 29 11:23:59 Arch sudo: traaf : TTY=pts/0 ; PWD=/var/log ; USER=root ; COMMAND=/etc/rc.d/sshd start
Jul 29 11:23:59 Arch sshd[5196]: Server listening on 0.0.0.0 port 22.
Jul 29 11:24:05 Arch sshd[5198]: pam_access(sshd:account): failed to open accessfile=[/etc/security/access_ssh.conf]: No such file or directory
Jul 29 11:24:05 Arch sshd[5198]: pam_access(sshd:account): failed to parse the module arguments
Jul 29 11:44:37 Arch sshd[9431]: pam_access(sshd:account): failed to open accessfile=[/etc/security/access_ssh.conf]: No such file or directory
Jul 29 11:44:37 Arch sshd[9431]: pam_access(sshd:account): failed to parse the module arguments

Nic0 a écrit :Cela dis, je ne pense pas que le problème vienne de là

youshe a écrit :Je vais peut être dire une connerie mais en commentant dans /etc/host.deny la ligne ALL: ALL: DENY, ça change quelque chose ?

Fred

traaf a écrit :non, ca change rien

tuxce a écrit :@traaf, t'aurais pas fait un trafic de fichier de config inter distributions ?
si tu as modifié le sshd_config ou autre, tu peux les poster?

# $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $

# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.

#Port 22
#AddressFamily any
ListenAddress 0.0.0.0
#ListenAddress ::

# Disable legacy (protocol version 1) support in the server for new
# installations. In future the default will change to require explicit
# activation of protocol 1
Protocol 2

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 1024

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to no to disable s/key passwords
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10
#PermitTunnel no
#ChrootDirectory none

# no default banner path
#Banner none

# override default of no subsystems
Subsystem sftp /usr/lib/ssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# ForceCommand cvs server
AllowUsers traaf
Protocol 2
PermitRootLogin no

# $OpenBSD: ssh_config,v 1.25 2009/02/17 01:28:32 djm Exp $

# This is the ssh client system-wide configuration file. See
# ssh_config(5) for more information. This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.

# Configuration data is parsed as follows:
# 1. command line options
# 2. user-specific file
# 3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.

# Site-wide defaults for some commonly used options. For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.

Host *
# ForwardAgent no
# ForwardX11 no
# RhostsRSAAuthentication no
# RSAAuthentication yes
# PasswordAuthentication yes
# HostbasedAuthentication no
# GSSAPIAuthentication no
# GSSAPIDelegateCredentials no
# BatchMode no
# CheckHostIP yes
# AddressFamily any
# ConnectTimeout 0
# StrictHostKeyChecking ask
# IdentityFile ~/.ssh/identity
# IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa
# Port 22
Protocol 2
# Cipher 3des
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
# MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
# EscapeChar ~
# Tunnel no
# TunnelDevice any:any
# PermitLocalCommand no
# VisualHostKey no
HashKnownHosts yes
StrictHostKeyChecking ask

mélodie a écrit :

traaf a écrit :non, ca change rien

Et si tu essaies comme je propose ?

mélodie a écrit :
Une idée comme ça, (curiosité) ce n'est peut-être pas le 10.0.0.0/ qui gène, mais le 24 qui est après ? (D'où cela sort-il au juste ?)

/24 indicates the subnet mask is 255.255.255.0

in binary, it has 24 1s and 8 0s

11111111111111111111111100000000

so a /16 would be 255.255.0.0


11111111111111110000000000000000

I tried to remain child-like, all I acheived was childish.