John Parker | 12 Sep 2008 00:21
Picon

OpenSSH-5.1p1 issue with ScreenOS

Just FYI in case others haven't run into this yet: after upgrading my
OpenSSH client to the latest 5.1-portable, I found to my horror that
ssh sessions to NetScreens (ScreenOS 5.4r10, 6.1.0r3) were immediately
disconnecting.  Looking at the event log through webui showed
successful-auth, but no real error messages.  Same basic symptoms for
both password and pubkey-auth.  Running ssh in verbose mode gave a few
hints, it looks like a new 5.1 security feature isn't being handled
correctly by the NetScreen sshd:

--------------
http://openssh.com/txt/release-5.1
<snip>
New features:
 * Added a no-more-sessions <at> openssh.com global request extension that is
   sent from ssh(1) to sshd(8) when the client knows that it will never
   request another session (i.e. when session multiplexing is disabled).
   This allows a server to disallow further session requests and
   terminate the session in cases where the client has been hijacked.
--------------

I can only venture to guess that, when ScreenOS receives the client
message "no more sessions after this one", it's interpreting as
"...including this one"?  Anyway, by the Edisonian approach  :)   I
discovered that the following option will get you back in:

ControlMaster=ask (or "yes", or "auto" -- anything but the default "no")

As in, "ssh -o ControlMaster=ask me <at> my.firewall.org"

I wouldn't recommend adding this to your ssh_config, unless you can do
(Continue reading)


Gmane