X2Go Bug report logs - #966
x2goclient SSH fails with keyboard-interactive + banner

version graph

Package: x2goclient; Maintainer for x2goclient is X2Go Developers <x2go-dev@lists.x2go.org>; Source for x2goclient is src:x2goclient.

Reported by: Andrew Cherry <acherry@alcf.anl.gov>

Date: Fri, 20 Nov 2015 17:05:02 UTC

Severity: normal

Tags: pending

Found in version 4.0.5.1

Fixed in version 4.1.1.0

Done: X2Go Release Manager X2Go Release Manager <git-admin@x2go.org>

Bug is archived. No further changes may be made.

Full log

Message #20 received at 966@bugs.x2go.org (full text, mbox, reply):

Received: (at 966) by bugs.x2go.org; 29 Aug 2017 20:19:08 +0000
From acherry@alcf.anl.gov  Tue Aug 29 22:18:54 2017
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=3.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,RCVD_IN_DNSWL_BLOCKED,URIBL_BLOCKED autolearn=ham
	autolearn_force=no version=3.4.1
Received: from localhost (localhost [127.0.0.1])
	by ymir.das-netzwerkteam.de (Postfix) with ESMTP id 3FB8B5DACF
	for <966@bugs.x2go.org>; Tue, 29 Aug 2017 22:18:53 +0200 (CEST)
X-Virus-Scanned: Debian amavisd-new at ymir.das-netzwerkteam.de
Received: from ymir.das-netzwerkteam.de ([127.0.0.1])
	by localhost (ymir.das-netzwerkteam.de [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 5fSwkeqQlWPd for <966@bugs.x2go.org>;
	Tue, 29 Aug 2017 22:18:03 +0200 (CEST)
Received: from mailrelay.anl.gov (mailrelay.anl.gov [130.202.101.22])
	by ymir.das-netzwerkteam.de (Postfix) with ESMTPS id 595805DACE
	for <966@bugs.x2go.org>; Tue, 29 Aug 2017 22:18:00 +0200 (CEST)
Received: from mailgateway.anl.gov (mailgateway.anl.gov [130.202.101.28])
	(using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mailrelay.anl.gov (Postfix) with ESMTPS id 0E679200030
	for <966@bugs.x2go.org>; Tue, 29 Aug 2017 15:17:58 -0500 (CDT)
X-IronPort-AV: E=Sophos;i="5.41,445,1498539600"; 
   d="scan'208";a="164294948"
Received: from hybrid-luckman.anl.gov (HELO LUCKMAN.anl.gov) ([146.137.81.14])
  by mailgateway.anl.gov with ESMTP/TLS/DHE-RSA-AES256-SHA; 29 Aug 2017 15:17:58 -0500
Received: from gcc01-dm2-obe.outbound.protection.outlook.com (23.103.198.56)
 by hybridexchange.anl.gov (146.137.81.14) with Microsoft SMTP Server (TLS) id
 14.3.319.2; Tue, 29 Aug 2017 15:17:58 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=ArgonneDOE.onmicrosoft.com; s=selector1-alcf-anl-gov;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version;
 bh=aRaAGMbSqfwTmtZQnF93QKDQ/K+0EQfCJAbIf9dvC2w=;
 b=bw4qV+cq3weRnv96vZQ9WOhaK11e2qwg9I2FfLQlBDMzJq9QKcVTwiN9UQVVRu8r9qwd5mKOhOPCsCLvrvzDP7KTu7MpUYi8G/TZLCKhCGFEvEjcjL3SqhGLkmJ36ph8WUx547XyD7/NMLY/RzVR171ESv/SLb9v7A2dGt9ybl4=
Received: from BN3PR09MB0401.namprd09.prod.outlook.com (10.160.115.21) by
 BN3PR09MB0402.namprd09.prod.outlook.com (10.160.115.22) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id
 15.20.13.10; Tue, 29 Aug 2017 20:17:55 +0000
Received: from BN3PR09MB0401.namprd09.prod.outlook.com ([10.160.115.21]) by
 BN3PR09MB0401.namprd09.prod.outlook.com ([10.160.115.21]) with mapi id
 15.20.0013.010; Tue, 29 Aug 2017 20:17:55 +0000
From: "Cherry, Andrew J." <acherry@alcf.anl.gov>
To: "Cherry, Andrew J." <acherry@alcf.anl.gov>
CC: "966@bugs.x2go.org" <966@bugs.x2go.org>
Subject: Re: Banner issue update
Thread-Topic: Banner issue update
Thread-Index: AQHTIOcnC+zZDSSdW0K4gis9YcoQCaKbxfwA
Date: Tue, 29 Aug 2017 20:17:55 +0000
Message-ID: <387FE67D-CA29-41C0-90FE-2CE278CF232B@anl.gov>
References: <F6769B3D-89EA-4E1B-831A-84EBBB985A96@anl.gov>
In-Reply-To: <F6769B3D-89EA-4E1B-831A-84EBBB985A96@anl.gov>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is )
 smtp.mailfrom=acherry@alcf.anl.gov; 
x-originating-ip: [69.141.60.239]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1;BN3PR09MB0402;20:kMyZiNdw/6SIhjJa1sh0aTHaw3KP0CUhjJr/TJ5Fg6AvziJnuQgUGqvqxovoCGkEwonZzOzJgFBJX0+WuN6fCF0B66e+gtC/Gu78Qxneo7vpZp+BA5VY5G8Pv9DPMCfE/vjKGqHzzDTGg+TcZoyS/9fkLBMC+65fbzYi8RTGVtU=
x-ms-exchange-antispam-srfa-diagnostics: SSOS;SSOR;
x-forefront-antispam-report: SFV:SKI;SCL:-1;SFV:NSPM;SFS:(10009020)(6009001)(199003)(377454003)(189002)(24454002)(25786009)(82746002)(97736004)(68736007)(53936002)(76176999)(54356999)(50986999)(66066001)(6436002)(7116003)(5660300001)(42882006)(2950100002)(102836003)(3846002)(6116002)(2900100001)(4326008)(83716003)(86362001)(6200100001)(15650500001)(6506006)(229853002)(33656002)(3480700004)(14454004)(99286003)(8936002)(81166006)(8676002)(81156014)(2906002)(551544002)(7736002)(305945005)(9686003)(6512007)(106356001)(105586002)(6246003)(110136004)(36756003)(53546010)(101416001)(189998001)(478600001)(3660700001)(3280700002)(6486002)(6862004)(77096006);DIR:OUT;SFP:1101;SCL:1;SRVR:BN3PR09MB0402;H:BN3PR09MB0401.namprd09.prod.outlook.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en;
x-ms-office365-filtering-correlation-id: c0d8e883-dcfa-4251-ec66-08d4ef1b08bf
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254152)(300000503095)(300135400095)(2017052603199)(201703131423075)(201703031133081)(201702281549075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095);SRVR:BN3PR09MB0402;
x-ms-traffictypediagnostic: BN3PR09MB0402:
x-exchange-antispam-report-test: UriScan:(192374486261705);
x-microsoft-antispam-prvs: <BN3PR09MB040221393B5A5840F71D4DB8999F0@BN3PR09MB0402.namprd09.prod.outlook.com>
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(601004)(2401047)(8121501046)(5005006)(100000703101)(100105400095)(3002001)(93006095)(93001095)(10201501046)(6041248)(20161123562025)(20161123558100)(20161123564025)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:BN3PR09MB0402;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:BN3PR09MB0402;
x-forefront-prvs: 0414DF926F
received-spf: None (protection.outlook.com: alcf.anl.gov does not designate
 permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2DBB583588422840922B8C8185538CCB@namprd09.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Aug 2017 20:17:55.4627
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 0cfca185-25f7-49e3-8ae7-704d5326e285
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR09MB0402
X-OriginatorOrg: alcf.anl.gov

One more note about reproducing this -- I've found that pam_echo.so only prints the banner *before* the password prompt if sshd is configured with "ChallengeResponseAuthentication yes" (which we happen to have due to our CryptoCard token usage).

-Andrew

> On Aug 29, 2017, at 12:52 PM, Cherry, Andrew J. <acherry@alcf.anl.gov> wrote:
> 
> I've done some additional testing, prompted by your mention of the banner being configured using the Banner option in sshd_config.  It turns out we are *not* using the sshd config option -- instead, we are displaying the banner using the pam_echo module, configured with the following line in /etc/pam.d/sshd:
> 
> auth        optional    pam_echo.so file=/etc/issue.net
> 
> What I've found so far is that the same /etc/issue.net plays nice with x2go when configured via the Banner option, but causes an auth failure when configured using pam_echo.so.
> 
> I'm going to do some more digging to see if I can figure out what the difference is.  Oddly, if I cut/paste the output from the OpenSSH client (on Linux) up to and including the Password: prompt, and do a diff between the two, they are byte-for-byte identical.
> 
> By the way, the reason we use pam_echo.so instead of the Banner option is because we actually have two banners -- /etc/issue/net for the standard security boilerplate which is always displayed, and /etc/issue.alcf which is normally empty but is populated with information during our scheduled maintenance windows when logins are disabled.  However, I've confirmed that the problem still occurs even if I configure pam_echo.so to only display /etc/issue.net
> 
> -Andrew
>

Send a report that this bug log contains spam.

X2Go Developers <owner@bugs.x2go.org>. Last modified: Sat Nov 23 13:46:26 2024; Machine Name: ymir.das-netzwerkteam.de

X2Go Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.