From owner-freebsd-security Tue Feb 19 13: 2: 0 2002 Delivered-To: freebsd-security@freebsd.org Received: from brain-stream.com (brain-stream.com [209.95.107.206]) by hub.freebsd.org (Postfix) with ESMTP id 1995637B404 for ; Tue, 19 Feb 2002 13:01:53 -0800 (PST) Received: from laptop.pobox.com (h00609708e398.ne.mediaone.net [24.128.187.79]) by brain-stream.com (8.9.3/8.9.3) with ESMTP id NAA07114 for ; Tue, 19 Feb 2002 13:01:43 -0800 (PST) Message-Id: <5.1.0.14.2.20020219160112.025494f0@pop.earthlink.net> X-Sender: bdelong@pop.earthlink.net (Unverified) X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Tue, 19 Feb 2002 16:01:42 -0500 To: freebsd-security@FreeBSD.ORG From: "B.K. DeLong" Subject: SSHD problems: Forked child when logging in locally Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Hi all - No one at questions@ has answered this yet so I figured I'd pass it your way: I recently lost the ability to ssh into my firewall from the local side of the network, though ironically I can still ssh to it from the outside. I'm running FreeBSD 4.5-STABLE and OpenSSH_3.0.2. When I try to ssh into the machine (192.168.2.1) from my Win98 SE laptop using ssh2 in SecureCRT 3.3 (192.168.2.11) my authlog shows: sshd[90]: debug1: Forked child 178. Then I close SecureCRT since nothing shows up in the window. Several seconds after I close it, this appears in my authlod: sshd[178]: Connection from 192.168.2.11 port 2696 sshd[178]: Connection from 192.168.2.11 port 2696 sshd[178]: Did not receive identification string from 192.168.2.11. sshd[178]: debug1: Calling cleanup 0x805ef04(0x0) I tried the same with putty on the same machine....with exactly the same results. My hosts.allow should be all set: sshd : 192.168.2.0/255.255.255.0 : allow And my ipf.rules file is setup correctly: ######################################## # INSIDE INTERFACE (xl1) [192.168.2.1] # ######################################## # Incoming Traffic #Allow in all TCP, UDP and ICMP traffic & keep state pass in quick on xl1 proto tcp from 192.168.2.0/24 to any keep state pass in quick on xl1 proto udp from 192.168.2.0/24 to any keep state pass in quick on xl1 proto icmp from 192.168.2.0/24 to any keep state block in log quick on xl1 all # Outgoing Traffic #Allow out all TCP, UDP, and ICMP traffic & keep state pass out quick on xl1 proto tcp from any to 192.168.2.0/24 keep state pass out quick on xl1 proto udp from any to 192.168.2.0/24 keep state pass out quick on xl1 proto icmp from any to 192.168.2.0/24 keep state block out log quick on xl1 all ------------------------------------------------- Any ideas? Thanks in advance. -- B.K. DeLong bkdelong@pobox.com 617.877.3271 http://www.brain-stream.com Play. http://www.the-leaky-cauldron.org Potter. http://www.attrition.org Security. http://www.artemisiabotanicals.com Herb. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message