My compilation of openssh 3.7.1p2 and 3.8p1 can not authenticate from HPUX 10.20 via rsa2 or dsa public key. The sshd daemon side works OK. I can use public key authentication from Linux or Windows TO HPUX without problems. I am using rsa2 keys and the keys as well as the access rights of my directory structure are ok. I can connect to the sshd on HPUX from other platforms with my key pair using public key authentication without problems. When I try ssh FROM HPUX to other hosts or even to myself sshd always asks for a password. It seems that the ssh client skips the public key authentication step as can be seen from the debug output below. The openssh version 3.6.1p1 does not show the described effect, i.e. I can connect from HP-UX using my rsa2 public key authentication without problems. As HP-UX does not support PAM I did not use the with-pam flag for compilation. The compile flags were the same for all revisions and as follows: CFLAGS="+O3 +ESlit +Optrs_strongly_typed -I$SRC/tcp_wrappers/$TCP_WRAPver" \ LDFLAGS="-L$SRC/tcp_wrappers/$TCP_WRAPver" \ ./configure --prefix=/opt/$VER \ --sysconfdir=/etc/opt/openssh \ --with-default-path="/usr/bin:/usr/sbin:/opt/$VER/bin" \ --with-ssl-dir=$SRC/openssl/$OPENSSLver \ --with-zlib=$SRC/zlib/$ZLIBver \ --with-prngd-socket=/var/run/egd-pool \ --with-tcp-wrappers \ --without-shadow \ --disable-suid-ssh I compiled against TCP_WRAPver=tcp_wrappers_7.6-ipv6.3 OPENSSLver=openssl-0.9.7c ZLIBver=zlib-1.2.1 PRNGDver=prngd-0.9.27 Parts from debug output: debug1: identity file /home/peterk/.ssh/identity type -1 debug2: key_type_from_name: unknown key type '-----BEGIN' debug2: key_type_from_name: unknown key type '-----END' debug1: identity file /home/peterk/.ssh/id_rsa type 1 debug1: identity file /home/peterk/.ssh/id_dsa type -1 debug1: Remote protocol version 1.99, remote software version OpenSSH_3.8p1 ... debug1: Authentications that can continue: publickey,password,keyboard-interactive debug1: Next authentication method: publickey debug2: we did not send a packet, disable method debug1: Next authentication method: keyboard-interactive debug2: userauth_kbdint debug2: we sent a keyboard-interactive packet, wait for reply debug1: Authentications that can continue: publickey,password,keyboard-interactive debug2: we did not send a packet, disable method
Created attachment 559 [details] debug output from ssh 3.8p1 connections
I just tried 3.7.1p2 on my 11.00 box and it worked ok: debug1: Offering public key: /home/dtucker/.ssh/id_rsa debug3: send_pubkey_test debug2: we sent a publickey packet, wait for reply [...] Peter, could you please create attachments of config.h after running configure, for both 3.6.1p2 and 3.8p1?
Created attachment 561 [details] config.h of openssh3.6.1p1 with buffer.adv patch
Created attachment 562 [details] make log of openssh3.6.1p1 with buffer.adv patch
Created attachment 563 [details] config.h of openssh3.8p1
Created attachment 564 [details] make log of openssh3.8p1
Created attachment 565 [details] openssh compile and build options
There have been reports[1][2] of OpenSSL builds not working properly on HP-UX. Does "make tests" in the openssl directory pass all of its tests? It looks like you are using the HP compiler? See if openssl can read the keys itself: openssl rsa -check -noout <$HOME/.ssh/id_rsa openssl rsa -modulus -noout <$HOME/.ssh/id_rsa [1] http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=108012097630716 [2] http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=107969091332191
I get exactly the same problems on 10.20, 11.00 and 11i with OpenSSH-3.8.1p1 and OpenSSL-0.9.7d. It appears to be due to the use the HP C compiler with "+Optrs_strongly_typed" to build OpenSSH. Compiler versions used: 10.20: fileset B.10.20.09; what strings A.10.32.30 11.00: fileset B.11.11.04 + PHSS_26792; what strings B.11.11.26792.GP 111: fileset B.11.11.06; what strings B.11.11.06 OpenSSL was also built with the HP compiler with stock options from "Configure hpux-parisc-cc".
Does removing +Optrs_strongly_typed from your CFLAGS help?
I finally compiled it with gcc 3.0.1 which was the latest version for HPUX10.20 which I could find. openssh now works almost perfect with the exception that the sshd daemon does not accept Ctrl-C interrupts, when it is started at boot time. If I invoke sshd from a terminal it inherits the intr key setting from the terminal and everything is OK. At boot time there is no tty though and I did not succeed to get the daemon to accept ^C.
Doesn't it use the default HP-UX interrupt char (ctrl-backspace)? An easy workaround would be to put something like this into your .profile: if [ ! -z `tty` ]; then stty intr ^C fi Where ^C is produced by typing CTRL-V CTRL-C.
Compiler problems, not a bug in OpenSSH itself.
Change all RESOLVED bug to CLOSED with the exception of the ones fixed post-4.4.