SSH Problem with TCPIP V5.4?

Peter 'EPLAN' LANGSTOEGER · *nix forums Guru Joined: 21 Jul 2005 Posts: 517

In article <1107896814.873330.6670@o13g2000cwo.googlegroups.com>, mcbill20@yahoo.com writes:

VAXman-@SendSpamHere.ORG · *nix forums Guru Wannabe Joined: 22 Jul 2005 Posts: 251

In article <newscache$skkpbi$sc6$1@news.sil.at>, peter@langstoeger.at (Peter 'EPLAN' LANGSTOEGER) writes:

mcbill20@yahoo.com · *nix forums beginner Joined: 24 Mar 2005 Posts: 36

I recently upgraded TCPIP 5.4 (no ECO) from 5.3. After upgrading, I
enabled SSH. I then downloaded PUTTY in order to do a quick test. I was
able to successfully login using PUTTY, although I noticed occasional
console messages about problems deleting TCPIP$SSH_RUN.LOG.

At the time, it wasn't a high priority so I didn't worry too much about
it. Unfortunately, my console is an LA120 and when I came in to the
computer room today I found that a half box of paper had been printed
with messages from SSH. Apparently machines in France, Poland and
Australia (according to NSLOOKUP) had been trying to get in using SSH.
As for the breakin part, I am not too concerned as my machine is very
well locked down and only local access is enabled for any privileged
accounts.

However, I was hoping to be able to leave SSH accessible from the
outside for when I need to login and look up something or do simple
admin. The intrusion problem is frustrating enough, but I would really
like to know what the problem is with SSH. This machine is running VMS
7.3-1 (all latest patches) and TCPIP 5.4 (no ECO's).

Each time the remote machine would try to log in I would get a security
message but it would then be followed by multiple file access conflict
messages regarding the deletion of TCPIP$SSH_RUN.LOG (multiple
versions).

I looked through this group but didn't find anything on this. DOes
anyone know if this is a known problem?

I wanted to include samples, but apparently (maybe for security
reasons) most of the output that goes to the console does not go into
the operator log. All I see in the operator log is:

%%%%%%%%%%% OPCOM 8-FEB-2005 08:56:42.44 %%%%%%%%%%%
Message from user INTERnet on SHAGGY
INTERnet ACP SSH Accept Request from Host: 80.53.255.44 Port: 3065

%%%%%%%%%%% OPCOM 8-FEB-2005 08:56:48.24 %%%%%%%%%%%
Message from user INTERnet on SHAGGY
INTERnet ACP SSH Accept Request from Host: 80.53.255.44 Port: 3166

%%%%%%%%%%% OPCOM 8-FEB-2005 08:56:54.15 %%%%%%%%%%%
Message from user INTERnet on SHAGGY
INTERnet ACP SSH Accept Request from Host: 80.53.255.44 Port: 3277

%%%%%%%%%%% OPCOM 8-FEB-2005 08:57:00.10 %%%%%%%%%%%
Message from user INTERnet on SHAGGY
INTERnet ACP SSH Accept Request from Host: 80.53.255.44 Port: 3391

The messages on the console are like this: (I am typing them in
manually so there may be a few typos):

%%% OPCOM 8-FEB-2005 00:05:24.13 %%%
Message from user AUDIT$SERVER on SHAGGY
Security alarm (SECURITY) and security audit (SECURITY) on SHAGGY,
system id: 10380
Auditable event: Network breakin detection
Event time: 08-FEB-2005 00:05:24.13
PID: 2020059F
Process name: TCPIP$SS_BG2671
Username: TCPIP$SSH
Remote node fullname: SSH_PASSWORD:IS.TAKESAKOGUMI.CO.JP
Remote username: SSH_3DC218BA
Status: %LOGIN-F-NOTVALID, user authorization failure

This is expected of course and I will have to figure out how to keep
these from filling up logs and emptying printers, etc. However, I would
like to know why each of those messages is followed buy multiple of
these:

%%% OPCOM 8-FEB-2005 00:05:24.04 %%%
Message from user AUDIT$SERVER on SHAGGY
Auditable event: Object deletion
Event information: File deletion request (IO$_DELETE)
Event time: 08-FEB-2005 00:05:24.04
PID: 202005A0
Process name: TCPIP$SSH_BG2675
Username: TCPIP$SSH
Process owner: [TCPIP$AUX,TCPIP$SSH]
Image name: DSA0:[SYS0.SYSCOMMON][SYSEXE]DELETE.EXE
Object class name: File
Object owner: [TCPIP$AUX,TCPIP$SSH]
Object protection: SYSTEM:RWED, OWNER:RWED, GROUP:RE, WORLD:
File name: _DSA0:[TCPIP$SSH]TCPIP$SSH_RUN.LOG;132
Access requested: Delete
Sequence key: 0062AAB5
Status: %SYSTEM-W-ACCONFLICT, file access conflict

Each breakin message is followed by multiple of the ACCONFLICT
messages, but differing in file version numbers. For example, the
messages following this one are for versions 131, 130, 129...

Any ideas?

Thanks.
Bill McLaughlin

Google