<br><font size=2 face="sans-serif">Hi</font>
<br>
<br><tt><font size=2>Eli Morris <emorris@pmc.ucsc.edu> wrote on 19/08/2009
06:14:44:<br>
<br>
> Thanks for helping me out guys. I narrowed down the problem. I created
<br>
> a key pair with ssh-keygen on my client. I put the public key in two
<br>
> places. One under the /var/lib/freenx/home/.ssh directory (the nx
user <br>
> home directory), one under a regular user directory/.ssh. I was able
<br>
> to log in without a password if I logged in to the regular user from
<br>
> my client. I could not log in without a password to the nx user. I
<br>
> have no idea why. Maybe because of the freenx 'shell' that runs when
<br>
> one logs in under the nx user, i.e. /usr/libexec/nx/nxserver. I don't
</font></tt>
<br>
<br><tt><font size=2>The FreeNX shell IS a shell !!</font></tt>
<br>
<br><tt><font size=2>This is what happens when I connect "manualy"
. . </font></tt>
<br>
<br><tt><font size=2>me@there:~> ssh -l nx -i ~/.ssh/nx_dsa -p 22 192.168.1.1</font></tt>
<br><tt><font size=2>HELLO NXSERVER - Version 2.1.0-71 OS (GPL)</font></tt>
<br><tt><font size=2>NX> 105</font></tt>
<br>
<br>
<br><tt><font size=2>Did you try ssh -v -l nx -i ~/.ssh/nx_dsa
-p 22 192.168.1.1</font></tt>
<br>
<br>
<br><tt><font size=2><br>
> know. Any idea? I'm baffled. Oh, also, permissions look ok on .ssh
and <br>
> authorized_keys, authorized_keys2.<br>
> <br>
> Chis, here are the answers to the questions you had.<br>
> <br>
> 1) It was a yum update to the server, which is running Fedora 11.<br>
</font></tt>
<br>
<br><tt><font size=2>I was wondering which packages had updated. Updates
sometimes don't restart things properly.</font></tt>
<br>
<br>
<br><tt><font size=2>> 2) The client was not updated.<br>
> <br>
> I tried removing and reinstalling the freenx package. That did not
<br>
> help. I'm thinking there has got to be something about my system <br>
> configuration that is not allowing the nx user to log in passwordless.
<br>
> Since the regular user can do it, it must be specific to the nx user
<br>
> somehow. Any ideas?<br>
> </font></tt>
<br>
<br>
<br>
<br><tt><font size=2>If ssh -d doesnt tell you what is going on . . </font></tt>
<br>
<br>
<br>
<br><tt><font size=2>Check that the nx user name actually has /var/lib/freenx/home
as its home directory.</font></tt>
<br>
<br><tt><font size=2>Running as root . . . su to user nx with a login shell</font></tt>
<br>
<br><tt><font size=2>type su -l nx ( running
id will show you if it su ed to user nx.</font></tt>
<br><tt><font size=2>
This will also tell you if the nx account is
working or disabled or broken in some way )</font></tt>
<br>
<br><tt><font size=2>type cd
( to move to the ( hopefully ) nx home directory )</font></tt>
<br>
<br><tt><font size=2>type pwd
( which obviously should output /var/lib/freenx/home in your
case )</font></tt>
<br>
<br>
<br><tt><font size=2>The next step would be to ensure that nx can connect
to sshd on port 22 using Public/Private keys.</font></tt>
<br>
<br>
<br>
<br>
<br><tt><font size=2>Did you set up sshd in the first Place ??</font></tt>
<br>
<br><tt><font size=2>Did you or A.N.Other set up a second instance of sshd,
listening on a different port for the initial connection ??</font></tt>
<br>
<br><tt><font size=2>( you might do this for additional security, ie. to
have an sshd which doesn't allow password connections, only Pub/Pri Keys
listening on an external ( internet ) IP address, and then set the normal
sshd on port 22 to allow password authentication, but only to listen on
internal and loopback addresses. If you did there will be two seperate
sshd_config files somewhere !! )</font></tt>
<br>
<br>
<br>
<br>
<br><tt><font size=2>In /etc/ssh/sshd_config check for . . .</font></tt>
<br>
<br><tt><font size=2>1/ An uncommented line beginning </font></tt>
<br>
<br><tt><font size=2>AllowUsers</font></tt>
<br>
<br><tt><font size=2>( the parameter format is a space seperated list restricting
permitted login names eg. AllowUsers User*
admin1 admin1 nx )</font></tt>
<br>
<br><tt><font size=2>This entry may well not exist, or may be commented
out, but if it does exist uncommented then it will restrict connections
to usernames listed.</font></tt>
<br>
<br>
<br>
<br>
<br><tt><font size=2>The following may not apply to you, if you did successfully
connected as another user using a Pub/Pri key, but make sure it wasn't
using rhosts etc</font></tt>
<br>
<br>
<br><tt><font size=2>Also check for </font></tt>
<br>
<br><tt><font size=2>2/ lines beginning with</font></tt>
<br>
<br><tt><font size=2>#RSAAuthentication yes</font></tt>
<br><tt><font size=2>#PubkeyAuthentication yes</font></tt>
<br><tt><font size=2>#AuthorizedKeysFile .ssh/authorized_keys</font></tt>
<br>
<br><tt><font size=2>The examples above are commented out ( the default
) so they take the default values ( as shown )</font></tt>
<br>
<br><tt><font size=2>If yours are not commented out and are ALSO set to
no then you will have disabled Pub/Pri keys . . .</font></tt>
<br>
<br>
<br><tt><font size=2>ssh -v on the client side is often enough but if not
you can stop sshd and run it with the -d -D switches set it will tell you
what it is doing.</font></tt>
<br>
<br><tt><font size=2>The quick way is to edit the /etc/init.d file and
add the switches so you don't disrupt anything else, than start another
root shell, restart the service from the new root shell and try connecting
as nx and your other user.</font></tt>
<br>
<br><tt><font size=2>Good luck again . . .</font></tt>
<br>
<br><tt><font size=2>Chris</font></tt>
<br>
<br><tt><font size=2><br>
> Thanks,<br>
> <br>
> Eli<br>
> ________________________________________________________________<br>
> Were you helped on this list with your FreeNX
problem?<br>
> Then please write up the solution in the FreeNX Wiki/FAQ:<br>
> <br>
> </font></tt><a href="http://openfacts2.berlios.de/wikien/index.php/BerliosProject:FreeNX_-_FAQ"><tt><font size=2>http://openfacts2.berlios.de/wikien/index.php/BerliosProject:FreeNX_-_FAQ</font></tt></a><tt><font size=2><br>
> <br>
> Don't forget to check the NX Knowledge
Base:<br>
> </font></tt><a href=http://www.nomachine.com/kb/><tt><font size=2>http://www.nomachine.com/kb/</font></tt></a><tt><font size=2>
<br>
> <br>
> ________________________________________________________________<br>
> FreeNX-kNX mailing list --- FreeNX-kNX@kde.org<br>
> </font></tt><a href="https://mail.kde.org/mailman/listinfo/freenx-knx"><tt><font size=2>https://mail.kde.org/mailman/listinfo/freenx-knx</font></tt></a><tt><font size=2><br>
> ________________________________________________________________<br>
</font></tt>