12 Sep 2008 00:21
OpenSSH-5.1p1 issue with ScreenOS
John Parker <parkerjv <at> gmail.com>
2008-09-11 22:21:11 GMT
2008-09-11 22:21:11 GMT
Just FYI in case others haven't run into this yet: after upgrading my OpenSSH client to the latest 5.1-portable, I found to my horror that ssh sessions to NetScreens (ScreenOS 5.4r10, 6.1.0r3) were immediately disconnecting. Looking at the event log through webui showed successful-auth, but no real error messages. Same basic symptoms for both password and pubkey-auth. Running ssh in verbose mode gave a few hints, it looks like a new 5.1 security feature isn't being handled correctly by the NetScreen sshd: -------------- http://openssh.com/txt/release-5.1 <snip> New features: * Added a no-more-sessions <at> openssh.com global request extension that is sent from ssh(1) to sshd(8) when the client knows that it will never request another session (i.e. when session multiplexing is disabled). This allows a server to disallow further session requests and terminate the session in cases where the client has been hijacked. -------------- I can only venture to guess that, when ScreenOS receives the client message "no more sessions after this one", it's interpreting as "...including this one"? Anyway, by the Edisonian approach :) I discovered that the following option will get you back in: ControlMaster=ask (or "yes", or "auto" -- anything but the default "no") As in, "ssh -o ControlMaster=ask me <at> my.firewall.org" I wouldn't recommend adding this to your ssh_config, unless you can do(Continue reading)
RSS Feed