SSH login using default user “admin”

wgstarks

After a little more testing, it seems that every time i reboot my system I can no longer connect via ssh. The password will work for webgui login but not for ssh login. I have to edit the admin user and restore the current password to be able to login via ssh. Not sure how to trouble shoot this?

jahonix

Which version do you use on what kind of platform?
Might it be a read-only mounted file system? It should commit changes but…

Gertjan

Strange.

I'm using a Putty session, with "admin" as the auto-login user name.
But I'm NOT using the password related to the "pfSense's admin user ;)
I generated and use key for authentication - have to type in the passphrase of the key :

Using username "admin".
Authenticating with public key "rsa-key-20150201"
Passphrase for key "rsa-key-20150201":
pfSense - Netgate Device ID: 20bbccdf95385caaa087

*** Welcome to pfSense 2.4.2-RELEASE (amd64) on pfsense ***
...

Works great.

wgstarks

@jahonix:

Which version do you use on what kind of platform?
Might it be a read-only mounted file system? It should commit changes but…

It’s vs 2.4.2 on a minisys n10e. The SSD is formatted ZFS but also had the same issue with UFS.

As far as I can tell only the password is effected by rebooting and only for ssh. The same user/password is used for webgui login without any issues. Don’t see any other settings/configurations that are getting lost on reboot.

Gertjan

I'm with you here, and with @johnpoz : It's really time that we all (you inclusive !!) see some logs now.

wgstarks

@Gertjan:

I'm with you here, and with @johnpoz : It's really time that we all (you inclusive !!) see some logs now.

I'd be glad to post them, but as far as I can tell nothing is being logged on the failed attempts. The only log entries I can find are for successful logins after editing the admin user. Do I need to check something other than system logs?

jimp

Did you move ssh to a different port? Or maybe you have a port forward or other NAT setup which might be redirecting that port to something else?

wgstarks

I changed ssh to port 2222 so to login I’m using ssh root@ <ip>-p 2222. I’ll get a prompt for a password. Sometimes the password works and sometimes I get “connection terminated” and nothing is logged on the firewall.</ip>

hda

@wgstarks:

… Sometimes the password works and sometimes I get “connection terminated”...

sshd_config. -> LoginGraceTime 30s

Gertjan

I just moved the "22" port to "2222" (why 2222 ? a port scan on your LAN will find it in less then 1 second).

In reverse order :

Dec 2 09:46:51 sshd 8263 Accepted keyboard-interactive/pam for admin from 192.168.1.6 port 50087 ssh2
Dec 2 09:46:48 sshd 8263 error: PAM: authentication error for admin from 192.168.1.6
Dec 2 09:46:45 sshd 8263 error: PAM: authentication error for admin from 192.168.1.6
Dec 2 09:46:22 sshd 59619 Server listening on 0.0.0.0 port 2222.
Dec 2 09:46:22 sshd 59619 Server listening on :: port 2222.
Dec 2 09:46:21 check_reload_status starting sshd
Dec 2 09:46:21 php-fpm 75193 /system_advanced_admin.php: secure shell configuration has changed. Restarting sshd.
Dec 2 09:46:21 php-fpm 75193 /system_advanced_admin.php: secure shell configuration has changed. Stopping sshd.

Logs work fine for me …. something's up with your system.

wgstarks

@Gertjan:

something's up with your system.

I think you are probably correct. Not sure, but I suspect that an incorrect password wouldn’t result in a terminated connection but rather an error about invalid password and a prompt for another one. I also can’t receive Growl notifications on the same system even though pfSense shows that they are being sent successfully.

I’ve installed a public key on the system and we’ll see how that works. So far no problems.