SSH - weird ssh problem under OS X 10.3.6

Author

weird ssh problem under OS X 10.3.6

Mike Zulauf

2004-11-26, 5:51 pm

Hi all,

I've recently experienced an unusual problem with ssh (openssh) on both
of my OS X machines (G4 iMac and G4 PowerBook). I recently applied an
Apple Security Update and also an upgrade to openssh by way of fink.
The problem occurs whether I use the fink version or the Apple supplied
version, so my best guess is that Apple may have changed some config
files (used by both) that may affect my particular setup.

Anyway, what happens is that when I try to initiate an ssh connection
between my machines, or even from one machine to itself, I get the
following message (for example):

% ssh localhost
ssh_exchange_identification: Connection closed by remote host

If I examine /var/log/system.log, I see the following entries:

Nov 26 11:45:34 iMac xinetd[305]: START: ssh pid=24267 from=::1
Nov 26 11:45:34 iMac sshd[24267]: fatal: Missing privilege separation
directory:
/var/empty

OK, that looks suggestive. So, I issue this command:

% sudo mkdir /var/empty

After this, I can use ssh, but I don't know if this is the best
solution, or if the correct permissions are set for /var/empty. In
addition, now I get the following sorts of messages in the system.log
when I log out:

Nov 26 11:51:05 iMac sshd[28308]: error: BSM audit: solaris_audit_record
failed
to write "sshd logout " record: Operation not supported

So, any thoughts why this happened (to both of my Macs), whether this is
the best solution, if there are any additional problems, anything else I
should do, etc?

Thanks,
Mike

--
Mike Zulauf
mazulauf@met.utah.edu

Daniel E. Macks

2004-11-29, 5:56 pm

Mike Zulauf <mazulauf@met.utah.edu> said:
>
> I've recently experienced an unusual problem with ssh (openssh) on both
> of my OS X machines (G4 iMac and G4 PowerBook). I recently applied an
> Apple Security Update and also an upgrade to openssh by way of fink.
> The problem occurs whether I use the fink version or the Apple supplied
> version, so my best guess is that Apple may have changed some config
> files (used by both) that may affect my particular setup.
>
> Anyway, what happens is that when I try to initiate an ssh connection
> between my machines, or even from one machine to itself, I get the
> following message (for example):
>
> % ssh localhost
> ssh_exchange_identification: Connection closed by remote host
>
> If I examine /var/log/system.log, I see the following entries:
>
> Nov 26 11:45:34 iMac xinetd[305]: START: ssh pid=24267 from=::1
> Nov 26 11:45:34 iMac sshd[24267]: fatal: Missing privilege separation
> directory:
> /var/empty

What version of the fink openssh pkg are you using? In the past week
or so, 3.9p1-1 was added, and then updated to -2. And the -1->-2
update appears to change (fink's) PRIVSEP_PATH.

dan

--
Daniel Macks
dmacks@netspace.org
http://www.netspace.org/~dmacks

Mike Zulauf

2004-11-29, 5:56 pm

In article <slrncqmkpd.1o1b.dmacks@earl-grey.cloud9.net>,
"Daniel E. Macks" <dmacks@netspace.org> wrote:

> Mike Zulauf <mazulauf@met.utah.edu> said:
>
> What version of the fink openssh pkg are you using? In the past week
> or so, 3.9p1-1 was added, and then updated to -2. And the -1->-2
> update appears to change (fink's) PRIVSEP_PATH.

My fink version is:
OpenSSH_3.9p1, OpenSSL 0.9.7d 17 Mar 2004

The odd thing is that I got the same error when I attempted to use
Apple's ssh as well, and that version is:
OpenSSH_3.6.1p1+CAN-2004-0175, SSH protocols 1.5/2.0, OpenSSL 0x0090702f

In general, I don't use Apple's version. In any case, I think I've got
/var/empty set up correctly now. I'm mainly curious how this happened -
whether my config files changed somehow, or it was the Apple update, or
something else.

Thanks,
Mike

--
Mike Zulauf
mazulauf@met.utah.edu

Tom Harrington

2004-11-29, 5:56 pm

In article <mazulauf-B54169.09084129112004@nntp0.pdx.net>,
Mike Zulauf <mazulauf@met.utah.edu> wrote:

> In general, I don't use Apple's version. In any case, I think I've got
> /var/empty set up correctly now. I'm mainly curious how this happened -
> whether my config files changed somehow, or it was the Apple update, or
> something else.

If /var/empty was missing, I think you're into the "something else"
category. This directory is part of the 10.3 "base system" package, and
should have been there.

--
Tom "Tom" Harrington
Macaroni, Automated System Maintenance for Mac OS X.
Version 2.0: Delocalize, Repair Permissions, lots more.
See http://www.atomicbird.com/

Mike Zulauf

2004-11-29, 8:47 pm

In article <tph-87A919.10303029112004@localhost>,
Tom Harrington <tph@pcisys.no.spam.dammit.net> wrote:

> In article <mazulauf-B54169.09084129112004@nntp0.pdx.net>,
> Mike Zulauf <mazulauf@met.utah.edu> wrote:
>
>
> If /var/empty was missing, I think you're into the "something else"
> category. This directory is part of the 10.3 "base system" package, and
> should have been there.

Very weird. I'm guessing something went "wrong" with either my fink
update or the Apple one (both of which updated ssh). On both machines.
And I haven't heard of anything similar happening to anybody else.
Nothing else I can think of makes any sense.

Oh well, just an unsolved mystery, I guess. . .

Mike

--
Mike Zulauf
mazulauf@met.utah.edu