Re: SSH1 and SSH2 Keys Auth

Hi Tina,

>> > I have a Script which uses Rsync with SSH Authentication to copy
>> files from one server to another. It is a cronjob which executes
<snip>
>> of any note in the hour before the first fubar? Check messages, last
>> and secure.
>
> I have checked the lastlog, secure,messages, All logs exceprt the secure
> says that somebody tried to FTP as root which was cancelled and nothing
> else.

Could you show us the few lines before and after the attempt? I'm assuming
that you're running wu-ftpd... what version?

>> > I am not looking for the solution from this list but could anyone
>> suggest me where should i look what could be wrong. I checked from
<snip>
>> south. You didn't do any changes to the systems at all, including
>> running up2date or adding/deleting users?
>
> No i didn't Change I just upgarded SSH1 to SSH2 a week before and then
> also it was working fine.

So the FTP incident appears to be the key here, would you agree? Are you
running any IDS, like maybe portsentry? If not, it's worth looking into to
help track these things. So is tripwire, which will alert you to any
changes to any binaries on your system.

In the meantime, take a look in the proc directory tree, see if you can
find any dot-txt files.

>> > I did a search in Google but it tell me how to setup the Auth.
>>
>> Thank you. Troubleshooting is much easier if you've done some
<snip>
>> to delete the newline breaks, and !whammo! I was back in business.

> Even I thought of the same and I found newline breaks in my script and i
> cleared them all but still it asks for the passwd.

Did you restart sshd afterwards? Also, did you restart the ssh-key thingy?

-- 
Keith Mastin
BeechTree Information Technology Services Inc.
Toronto, Canada
(416)696 6070