For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

cxcal_18687's avatar
cxcal_18687
Icon for Nimbostratus rankNimbostratus
Feb 08, 2011

FTP over SSH Issue

I've seen a few post regarding some of the roadblocks with getting FTP over SSH to work. But I have reviewed my config and having issues.

 

 

Configured VIP on port 22 with SNAT automap, and the servers are listening on port 5022. Also using L4 profile and source_addr.

 

 

 

When I attempt to login I get the "fingerprint ssh-rsa" but after that I get "authentication failed".

 

 

Is there some other parameter I'm missing thats preventing this from working??

 

 

 

Thanks for the help!

 

 

 

config
design

15 Replies

Show More
  • cxcal_18687's avatar
    cxcal_18687
    Icon for Nimbostratus rankNimbostratus
    Feb 08, 2011
    I see the traffic coming from the SNAT Pool (as recommended)

     

     

    But continue to get resets:

     

     

    13:17:06.024453 IP 10.6.172.231.ssh > 10.6.172.226.50469: P 1989:2073(84) ack 1404 win 80

     

    13:17:06.024472 IP 10.6.172.243.ssh > 172.30.202.61.50469: P 1989:2073(84) ack 1404 win 80

     

    13:17:06.083026 IP 172.30.202.61.50469 > 10.6.172.243.ssh: R 1404:1404(0) ack 2073 win 0

     

    13:17:06.083032 IP 10.6.172.226.50469 > 10.6.172.231.ssh: R 1404:1404(0) ack 2073 win 0

     

  • cxcal_18687's avatar
    cxcal_18687
    Icon for Nimbostratus rankNimbostratus
    Feb 08, 2011
    I noticed with SmartFTP client that when I attempted to connect thru the VIP it complains about:

     

     

    [15:43:21] Client to Server Encryption: aes128-ctr

     

    [15:43:21] Server to Client Encryption: aes128-ctr

     

    [15:43:21] Session MAC: hmac-sha1

     

    [15:43:21] Client to Server Compression: zlib@openssh.com

     

    [15:43:21] Server to Client Compression: zlib@openssh.com

     

    [15:43:21] Requesting service "ssh-userauth".

     

    [15:43:21] RTT: 197.205 ms

     

    [15:43:21] Authentication request. Method: none

     

    [15:43:21] Server supported authentications: publickey,gssapi-with-mic,password

     

    [15:43:21] Authentication request. Method: password

     

    [15:43:24] Authentication request. Method: gssapi-with-mic

     

    [15:43:24] User authentication failed

     

     

     

    When I connect directly to the server on port 5022, I get connected with no issues:

     

     

     

    [15:40:37] Client to Server Encryption: aes128-cbc

     

    [15:40:37] Server to Client Encryption: aes128-cbc

     

    [15:40:37] Session MAC: hmac-sha1

     

    [15:40:37] Client to Server Compression: none

     

    [15:40:37] Server to Client Compression: none

     

    [15:40:37] Requesting service "ssh-userauth".

     

    [15:40:37] RTT: 53.458 ms

     

    [15:40:37] Authentication request. Method: none

     

    [15:40:37] Server supported authentications: keyboard-interactive,publickey,password

     

    [15:40:37] Authentication request. Method: password

     

    [15:40:37] User authentication successful.

     

    [15:40:37] SSH session established

     

     

     

    The difference I noticed was with the 1st two lines (aes128-cbc) compared to (aes128-ctr) on the failed login from the VIP.

     

     

    Is this something that can be changed on the LTM?

     

     

     

     

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Feb 08, 2011
    Can you enable debug on the client and SSH server to see what is failing? If connections direct to the SSH server work, but fail through the virtual server, I'd guess the issue is with the source IP address. You might need to add the LTM SNAT address to the allowed client list on the SSH server config.

     

     

    You can enable debug on the client using ssh -vvv. For sshd, you can change the LogLevel from Notice to Default.

     

     

    Aaron
  • cxcal_18687's avatar
    cxcal_18687
    Icon for Nimbostratus rankNimbostratus
    Feb 08, 2011
    I will see if I can get the server team to mod the server configs as a test.
  • cxcal_18687's avatar
    cxcal_18687
    Icon for Nimbostratus rankNimbostratus
    Feb 08, 2011
    Fixed!!

     

     

     

    Root Cause:

     

     

    When I created the pool they were set to listen on "Any" (don't ask me why).

     

     

    Recreated the pool with the correct port and case closed!

     

     

    Thanks for your time.