Search This Blog

12 December 2006

Jail SSH fails

This message can be seen when running /etc/rc in the shell (or looking at /var/log/messages)
May 12 20:26:53 serveris sshd[753]: error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
May 12 20:26:53 serveris sshd[753]: error: @ WARNING: UNPROTECTED PRIVATE KEY FILE! @
May 12 20:26:53 serveris sshd[753]: error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
May 12 20:26:53 serveris sshd[753]: error: Permissions 0755 for '/etc/ssh/ssh_host_dsa_key' are too open.
May 12 20:26:53 serveris sshd[753]: error: It is recommended that your private key files are NOTaccessible by others.
May 12 20:26:53 serveris sshd[753]: error: This private key will be ignored.
May 12 20:26:53 serveris sshd[753]: error: bad permissions: ignore key: /etc/ssh/ssh_host_dsa_key
May 12 20:26:53 serveris sshd[753]: error: Could not load host key: /etc/ssh/ssh_host_dsa_key
May 12 20:27:03 serveris sshd[755]: error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
May 12 20:27:03 serveris sshd[755]: error: @ WARNING: UNPROTECTED PRIVATE KEY FILE! @
May 12 20:27:03 serveris sshd[755]: error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
May 12 20:27:03 serveris sshd[755]: error: Permissions 0755 for '/etc/ssh/ssh_host_dsa_key' are too open.
May 12 20:27:03 serveris sshd[755]: error: It is recommended that your private key files are NOT accessible by others.
May 12 20:27:03 serveris sshd[755]: error: This private key will be ignored.
May 12 20:27:03 serveris sshd[755]: error: bad permissions: ignore key: /etc/ssh/ssh_host_dsa_key
May 12 20:27:03 serveris sshd[755]: error: Could not load host key: /etc/ssh/ssh_host_dsa_key

This is caused by the jail trying to use the hosts' SSH keys that were unionfs'd in.
jail> rm /etc/ssh/ssh_host*
jail> rm /etc/ssh/moduli
jail> sh /etc/rc


This will create new ssh keys. We run /etc/rc explicitely because entropy will ask that you type for 30 seconds.

No comments:

Post a Comment