[JSch-users] com.jcraft.jsch.JSchException: Auth fail

[Waseem Wahid]

I'm a new jsch user. We are using jsch standalone (as well as from within ant -- sshexec and scp tasks). The problem is that it seems to work fine when connecting to servers (running linux and freebsd) inside our network (behind a firewall), but for connection to servers outside the network, we can't get it to work. I tried the Sftp.java example, as well the above mentioned ant tasks. The result is the same: It fails with the exception

com.jcraft.jsch.JSchException: Auth fail

I should mention that ssh/sftp works using clients such as putty or psftp.

Following is the debug trace for sshd:


BSDELR01:/root # sshd -ddd -p 1022
debug2: read_server_config: filename /etc/ssh/sshd_config
debug1: sshd version OpenSSH_3.8.1p1 FreeBSD-20040419
debug3: Not a RSA1 key file /etc/ssh/ssh_host_dsa_key.
debug1: read PEM private key done: type DSA
debug1: private host key: #0 type 2 DSA
debug1: Bind to port 1022 on ::.
Server listening on :: port 1022.
debug1: Bind to port 1022 on 0.0.0.0.
Server listening on 0.0.0.0 port 1022.
debug1: Server will not fork when running in debugging mode.
debug1: res_init()
Connection from 205.161.40.110 port 4697
debug1: Client protocol version 2.0; client software version JSCH-0.1.20
debug1: no match: JSCH-0.1.20
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.8.1p1 FreeBSD-20040419
debug2: Network child is on pid 18911
debug3: preauth child monitor started
debug3: mm_request_receive entering
debug3: privsep user:group 22:22
debug1: permanently_set_uid: 22/22
debug1: list_hostkey_types: ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-***@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndael-***@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-***@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-***@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit: none,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: 3des-cbc,blowfish-cbc
debug2: kex_parse_kexinit: 3des-cbc,blowfish-cbc
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_init: found hmac-md5
debug1: kex: client->server 3des-cbc hmac-md5 none
debug2: mac_init: found hmac-md5
debug1: kex: server->client 3des-cbc hmac-md5 none
debug2: dh_gen_key: priv key bits set: 190/384
debug2: bits set: 497/1024
debug1: expecting SSH2_MSG_KEXDH_INIT
debug2: bits set: 497/1024
debug3: mm_key_sign entering
debug3: mm_request_send entering: type 4
debug3: monitor_read: checking request 4
debug3: mm_answer_sign
debug3: mm_key_sign: waiting for MONITOR_ANS_SIGN
debug3: mm_request_receive_expect entering: type 5
debug3: mm_request_receive entering
debug3: mm_answer_sign: signature 0x8077340(55)
debug3: mm_request_send entering: type 5
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: monitor_read: 4 used once, disabling now
debug3: mm_request_receive entering
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
debug1: userauth-request for user elr service ssh-connection method none
debug1: attempt 0 failures 0
debug3: mm_getpwnamallow entering
debug3: mm_request_send entering: type 6
debug3: monitor_read: checking request 6
debug3: mm_answer_pwnamallow
debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
debug3: mm_request_send entering: type 7
debug2: monitor_read: 6 used once, disabling now
debug3: mm_request_receive entering
debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM
debug3: mm_request_receive_expect entering: type 7
debug3: mm_request_receive entering
debug2: input_userauth_request: setting up authctxt for elr
debug3: mm_start_pam entering
debug3: mm_request_send entering: type 45
debug3: monitor_read: checking request 45
debug1: PAM: initializing for "elr"
debug1: PAM: setting PAM_RHOST to "205.161.40.110"
debug2: monitor_read: 45 used once, disabling now
debug3: mm_request_receive entering
debug3: mm_inform_authserv entering
debug3: mm_request_send entering: type 3
debug3: monitor_read: checking request 3
debug3: mm_answer_authserv: service=ssh-connection, style=
debug2: monitor_read: 3 used once, disabling now
debug3: mm_request_receive entering
debug2: input_userauth_request: try method none
Failed none for elr from 205.161.40.110 port 4697 ssh2
Received disconnect from 205.161.40.110: 3: com.jcraft.jsch.JSchException: Auth fail
debug1: do_cleanup
debug1: PAM: cleanup
debug3: PAM: sshpam_thread_cleanup entering
debug1: do_cleanup
debug1: PAM: cleanup
debug3: PAM: sshpam_thread_cleanup entering


Any help would be much appreciated.

[Dan Mingus]

I think i had a problem with this too a while ago, so I'm guessing a
little, but it could be in the sshd_config file the setting:

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no

try making it yes.

[Waseem Wahid]

That seems to fix it. Thanks!! But I wonder why clients such as psftp would
work without having to change this setting... Also, wouldn't permitting
clear text passwords (even though tunneled) be a security risk?


----- Original Message -----
From: "Dan Mingus" <***@do.usbr.gov>
To: "Waseem Wahid" <***@itiweb.com>; <jsch-***@lists.sourceforge.net>
Sent: Tuesday, April 12, 2005 1:57 PM
Subject: Re: [JSch-users] com.jcraft.jsch.JSchException: Auth fail

Post by Dan Mingus
I think i had a problem with this too a while ago, so I'm guessing a
# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no
try making it yes.
--
Dan Mingus
voice: 303-445-3351

[Christian Naß]

Waseem Wahid schrieb:

Hi,

Post by Waseem Wahid
com.jcraft.jsch.JSchException: Auth fail

One solution might be to activate the option "PasswordAuthentication"
in your sshd.conf
This solved my problem concerning "Auth fail" errors.

If this does not help: Sorry...

Bye,
Christian

[Atsuhiko Yamanaka]

Hi,

+-From: "Waseem Wahid" <***@itiweb.com> --
|_Date: Tue, 12 Apr 2005 13:33:02 -0700 _____
|
|I'm a new jsch user. We are using jsch standalone (as well as from
|within ant -- sshexec and scp tasks). The problem is that it
|seems to work fine when connecting to servers (running linux and
|freebsd) inside =ur network (behind a firewall), but for
|connection to servers outside the network, we can't get it to
|work. I tried the Sftp.java example, as well the above mentioned
|ant tasks. The result is the same: It fails with the exception
|com.jcraft.jsch.JSchException: Auth fail
|I should mention that ssh/sftp works using clients such as putty
|or psftp.
|Following is the debug trace for sshd:

Thank you for your feedback.
According to debug lines from sshd, it seems there are problems
in getting response sforathe uthentication method 'none'.
# By using method 'none', we can know what kinds of auth-methods are
# supported on the remote sshd.

If your sshd is on DMZ and is accessible from the Internet,
may I ask you to allow me to get access to your sshd for debugging?
The login access is not required in this case.
If it is acceptable, please write me IP-address of that sshd
to ***@jcraft.com.


Thanks,
--
ymnk

[Atsuhiko Yamanaka]

Hi,

+-From: "Waseem Wahid" <***@itiweb.com> --
|_Date: Tue, 12 Apr 2005 13:33:02 -0700 _____
|
| The problem is that it seems to
|work fine when connecting to servers (running linux and freebsd) inside
|our network (behind a firewall), but for connection to servers outside
|the network, we can't get it to work. I tried the Sftp.java example, as
|well the above mentioned ant tasks. The result is the same: It fails
|with the exception
|com.jcraft.jsch.JSchException: Auth fail

|Following is the debug trace for sshd:
|BSDELR01:/root # sshd -ddd -p 1022
|debug2: read_server_config: filename /etc/ssh/sshd_config
|debug1: sshd version OpenSSH_3.8.1p1 FreeBSD-20040419
|debug3: Not a RSA1 key file /etc/ssh/ssh_host_dsa_key.

Thank you for your help. I tried your sshd.
At a glance to your sshd log, I had worried that there may be a problem
in handing 'none' user auth method, but after accessing to your sshd and
checking its configuration, I guess there is not problem in jsch.
The reason is that your sshd only supports public-key and
keyboard-interactive authentication.
Try 'examples/UserAuthKI.java'.


Thanks,
--
ymnk