Subject: Re: "Illegal User" logging into sshd
From: "Gerrit P. Haase" <[email-masked]>
To: Prentis Brooks <[email-masked]>
Cc: [email-masked]
Date: Tue, 31 Jul 2001 18:19:04 +0200

> Prentis Brooks schrieb am 2001-07-31 10:43:

> Ok, I finally pinpointed the problem, but I don't like my solution.
> 
> Basically, it appears that sshd is not recognizing any changes to /etc/passwd
> since it started.  To solve this I had to connect to the host and stop all
> instances of sshd then restart clean, not pretty and not viable if I want to
> script changes to the passwd files across a farm.  Is there another way to
> get sshd to review the files, will it accept a kill -HUP and if so, how can
> I send the hup, since I can't get the pid from within an ssh session (or is
> there a way I haven't found yet?)

The problem is, if you're in a session, there are two sshd processes 
running:

Gerrit@ISMENE ~
$ ssh ismene
Enter passphrase for key '/home/Gerrit/.ssh/id_rsa': 
Last login: Mon Jul 30 09:05:44 2001 from ismene.192.168.5.5
Fanfare!!!
You are successfully logged in to this server!!!

Gerrit@ISMENE ~
$ ps -e
      259     221     259        254    3 11002 16:11:39 /usr/bin/ssh
      258       1     116        258    ?   18 16:11:40 /usr/sbin/sshd
      146     279     279        137    ?   18 16:13:48 /usr/sbin/sshd

BUT, you can see at the time row how long each process is running
and so you know what the parent is.

If you do '$ cygrunsrv -E sshd' your session will be stopped and 
you are still logged in at the child sshd.

$ cygrunsrv -E sshd
$ ps -e | grep ssh 
      259     221     259        254    3 11002 16:11:39 /usr/bin/ssh
      258       1     116        258    ?   18 16:11:40 /usr/sbin/sshd

Then you may change whatever is needed and restart the *service*

$ cygrunsrv -S sshd
$ ps -e | grep ssh
      259     221     259        254    3 11002 16:11:39 /usr/bin/ssh
      258       1     116        258    ?   18 16:11:40 /usr/sbin/sshd
      223     115     115        253    ?   18 16:16:16 /usr/sbin/sshd

I hope it works, but i am not in the position to give a guarantee for that:-)

gph

-- 
[email-masked]

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/