new server, can't ssh in

[borkedpc]

I just purchased a second SB Debian server and when it came online I cannot ssh into my domains anymore.

Servers FQDN's are configured as:
server1.mydomain.com
server2.mydomain.com

I have not done anything yet with server2.mydomain.com. I haven't logged in or installed anything yet.

I can only ssh as root into server1. <ssh root@mydomain.com>. Now I cannot log into any of the other hosted domains <ssh user@anotherdomain.com>

Anyone have any ideas about what's wrong?

[QT]

It would be helpful if you can post an error. Or you can run ssh -v when you connect to see where it freezes.

[borkedpc]

Here's the debugging information from ssh:

OpenSSH_3.6.1p1+CAN-2004-0175, SSH protocols 1.5/2.0, OpenSSL 0x0090702f
debug1: Reading configuration data /etc/ssh_config
debug1: Rhosts Authentication disabled, originating port will not be trusted.
debug1: Connecting to borkedpc.com [66.139.78.73] port 22.
debug1: Connection established.
debug1: identity file /Users/scotts/.ssh/identity type -1
debug1: identity file /Users/scotts/.ssh/id_rsa type -1
debug1: identity file /Users/scotts/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_3.4p1 Debian 1:3.4p1-1.woody.3
debug1: match: OpenSSH_3.4p1 Debian 1:3.4p1-1.woody.3 pat OpenSSH_3.2*,OpenSSH_3.3*,OpenSSH_3.4*,OpenSSH_3.5 *
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.6.1p1+CAN-2004-0175
debug1: Miscellaneous failure
No credentials cache found

debug1: Miscellaneous failure
No credentials cache found

debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'borkedpc.com' is known and matches the RSA host key.
debug1: Found key in /Users/scotts/.ssh/known_hosts:4
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/scotts/.ssh/identity
debug1: Trying private key: /Users/scotts/.ssh/id_rsa
debug1: Trying private key: /Users/scotts/.ssh/id_dsa
debug1: Next authentication method: keyboard-interactive
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: password

Next it asks for a password. I type in the password and I get Permission Denied. This happens for any of the users on this server except root.

[fastduke]

This happens for any of the users on this server except root.

[QT]

Do you have any AllowUsers directives in your sshd_config?

[borkedpc]

Fastduke , root logs in with no problems.

QT , I do not have any AllowUsers directives in sshd_config.

Would I need to add all of the users to AllowUsers to get access?

And why did it work before the new server came online without the AllowUsers directive?

[borkedpc]

I added the users to AllowUsers and restarted ssh but still get permission denied error when I put in the password.

[fastduke]

do the users have a shell? i.e. /bin/bash

Have you tried uploading a public key and login with key authentication?

[borkedpc]

fastduke : Yes all of the users I'm trying to ssh in with have a shell.
All of these users were able to log in before this weekend. The only thing that changed was the new SB server going live.

[fastduke]

check to see if /etc/nologin exists

when the above file exists sshd will only allow root to login.

[borkedpc]

fastduke : That did it.

Thanks so much for the help.
Now I guess I need to find out why that file is there now and what put it there.

[fastduke]

Well I'm glad I could help. Although my thought process was backward(should have figured that one first).

[bow-wow]

Originally posted by borkedpc
fastduke
Now I guess I need to find out why that file is there now and what put it there. /etc/nologin is typically created at shutdown and boot time to prevent non-root users from logging in while the system is busy.

You might want to verify that rmnogin is set to run at boot (which removes /etc/nologin after the machine is booted up) ala:
/etc/rc2.d/S99rmnologin