SSH not allowing login - Nightly build on RPi4 over PXE

bangadrum · December 19, 2021 at 4:26 PM

Hi folks,

Switched to the nightly build to get support for de-interlacing, as I watch UK TV (via Mythtv server). Since switching to the nightly build I have been locked out of SSH. I have tried disabling/enabling, and changing the password, but I get the same error everytime which would usually indicate an incorrect password. I have checked that it is not a keyboard layout issue.

If it makes any odds, my RPi4 boots over PXE, running TFTP on a dnsmasq server.

Any ideas what's gone wrong and/or how to fix it?

**chewitt** · December 19, 2021 at 8:09 PM

Old (out of date ciphers) PuTTY version?

bangadrum · December 19, 2021 at 8:25 PM

I'm on linux, so just using Terminal in Ubuntu 20.04, which has previously worked fine. Have also tested from WebSSH iOS app on my phone - which previous to the update worked fine.

**mglae** · December 20, 2021 at 4:29 PM

What exactly do you type in ubuntu terminal? C/P the error message.

ssh verbosity can be increased with -v, -vv or -vvv.

**chewitt** · December 20, 2021 at 5:36 PM

Have you disabled password auth (enabled key-only auth) in settings?

bangadrum · December 20, 2021 at 7:19 PM

Thanks for getting back to me

I am typing the following, with the following responses:

ssh root@192.168.1.202

root@192.168.1.202's password:

Permission denied, please try again.

root@192.168.1.202's password:

Permission denied, please try again.

root@192.168.1.202's password:

root@192.168.1.202: Permission denied (publickey,password,keyboard-interactive).

I have not disabled password authentication. I have tried resetting the password several times, it makes no difference.

**mglae** · December 21, 2021 at 4:37 PM

Create a log via LibreELEC-Settings Addon after trying to log on via ssh -v root@192.168.1.202.

Or get terminal access by adding textmode to your kernel command line and use journalctl -u sshd to check the server and pastekodi to create a log.

bangadrum · December 22, 2021 at 5:46 PM

Log is at - http://ix.io/3J9S

ssh -v paste is below

So it looks like the fault is that the volatile files are written into .ssh are not getting written over PXE. This worked on LE9 - has something changed in the LE codebase, or is the issue in my PXE server?

Code

ssh -v root@192.168.1.202
OpenSSH_8.2p1 Ubuntu-4ubuntu0.3, OpenSSL 1.1.1f  31 Mar 2020
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 192.168.1.202 [192.168.1.202] port 22.
debug1: Connection established.
debug1: identity file /home/jon/.ssh/id_rsa type -1
debug1: identity file /home/jon/.ssh/id_rsa-cert type -1
debug1: identity file /home/jon/.ssh/id_dsa type -1
debug1: identity file /home/jon/.ssh/id_dsa-cert type -1
debug1: identity file /home/jon/.ssh/id_ecdsa type -1
debug1: identity file /home/jon/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/jon/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/jon/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/jon/.ssh/id_ed25519 type -1
debug1: identity file /home/jon/.ssh/id_ed25519-cert type -1
debug1: identity file /home/jon/.ssh/id_ed25519_sk type -1
debug1: identity file /home/jon/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/jon/.ssh/id_xmss type -1
debug1: identity file /home/jon/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.3
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.8
debug1: match: OpenSSH_8.8 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 192.168.1.202:22 as 'root'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:jovWb6a2uyg8asPz7O/I5J2B+lylLhBykGeoJIVmDuQ
debug1: Host '192.168.1.202' is known and matches the ECDSA host key.
debug1: Found key in /home/jon/.ssh/known_hosts:2
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: /home/jon/.ssh/id_rsa 
debug1: Will attempt key: /home/jon/.ssh/id_dsa 
debug1: Will attempt key: /home/jon/.ssh/id_ecdsa 
debug1: Will attempt key: /home/jon/.ssh/id_ecdsa_sk 
debug1: Will attempt key: /home/jon/.ssh/id_ed25519 
debug1: Will attempt key: /home/jon/.ssh/id_ed25519_sk 
debug1: Will attempt key: /home/jon/.ssh/id_xmss 
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /home/jon/.ssh/id_rsa
debug1: Trying private key: /home/jon/.ssh/id_dsa
debug1: Trying private key: /home/jon/.ssh/id_ecdsa
debug1: Trying private key: /home/jon/.ssh/id_ecdsa_sk
debug1: Trying private key: /home/jon/.ssh/id_ed25519
debug1: Trying private key: /home/jon/.ssh/id_ed25519_sk
debug1: Trying private key: /home/jon/.ssh/id_xmss
debug1: Next authentication method: keyboard-interactive
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: password
root@192.168.1.202's password: 
debug1: Authentications that can continue: publickey,password,keyboard-interactive
Permission denied, please try again.
root@192.168.1.202's password: 
debug1: Authentications that can continue: publickey,password,keyboard-interactive
Permission denied, please try again.
root@192.168.1.202's password: 
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: No more authentication methods to try.
root@192.168.1.202: Permission denied (publickey,password,keyboard-interactive).

Display More

**mglae** · December 23, 2021 at 9:03 AM

Code

========== /storage/.config ==========
total 92
drwxr-xr-x    2 1000     1000          4096 Dec 18 18:49 aacs
-rwxrwxrwx    1 1000     1000             3 Dec 22 17:39 boot.status
-rwxrwxrwx    1 1000     1000           284 Jul 22  2019 hosts.conf
[...]

NFS file system on /storage is mounted for user 1000:1000 but root:root (or 0:0) is required.

Check your NFS server configuration.

bangadrum · December 28, 2021 at 9:20 PM

Lovely. All fixed, caused by a root squash config in NFS. Interestingly not previously a problem with LE9.

Thanks all - much appreciated. Happy Christmas and New Year!