1

A colleage is attempting to sftp into a RHEL7 server from Windows using an SFTP client and SSH passwordless login. The user account is chrooted at the server.

openssh version 6.6.1 is installed on the RHEL7 server.

After a failed SFTP connection attempt I checked /var/log/secure on the server and discovered the following:

Sep 12 17:00:22 serverbox sshd[32652]: Accepted publickey for specialuser from 1.1.1.77 port 58776 ssh2: RSA FINGERPRINT
Sep 12 17:00:22 serverbox sshd[32652]: pam_unix(sshd:session): session opened for user specialuser by (uid=0)
Sep 12 17:00:22 serverbox sshd[32652]: sshd_selinux_copy_context: getcon failed with No such file or directory [postauth]
Sep 12 17:01:18 serverbox sshd[32652]: Received disconnect from 1.1.1.77: 11: disconnected by user [postauth]
Sep 12 17:01:18 serverbox sshd[32652]: pam_unix(sshd:session): session closed for user specialuser

The same error appears when trying connection from Putty SFTP or Filezilla (both configured to use the local private key).

Here's the getcon line for easier reading:

sshd_selinux_copy_context: getcon failed with No such file or directory [postauth]

So the public key is accepted, then Putty (and Filezilla SFTP) drops after it can't find something it is looking for.

Permissions:

drwxr-xr-x. root root /home/specialuser
drwx------. specialuser sftponly   /home/specialuser/.ssh
drw-------. specialuser sftponly   /home/specialuser/.ssh/authorized_keys

Valid public key on server:

[user@server]# ssh-keygen -l -f authorized_keys
2048 sha1:fi:ng:er:pr:in:tt  rsa-key-20160913 (RSA)

For the rest of the chrooted setup, please check this answer I posted on another question.

SFTP with chrooted account works fine from Linux clients:

I created the same user account (specialuser) on my local Linux system (Ubuntu), copied the local account's id_rsa.pub to the server's /home/specialuser/.ssh/authorized_keys, and was able to sftp right in no problem.

SELinux ruled out

To assist in troubleshooting, I temporarily disabled SELinux but continue seeing the same error 'getcon failed...' with attempts from Windows/Putty.

Same problem with PasswordAuthentication enabled

I also temporarily enabled PasswordAuthentication for specialuser, and this still results in Putty exiting and the above 'getcon failed' error appearing in the server's /var/log/secure file.

Log data from that attempt (verbose):

Sep 14 10:34:32 serverbox sshd[41228]: Accepted password for specialuser from 1.1.1.77 port 61135 ssh2
Sep 14 10:34:32 serverbox sshd[41228]: pam_unix(sshd:session): session opened for user specialuser by (uid=0)
Sep 14 10:34:32 serverbox sshd[41228]: User child is on pid 41283
Sep 14 10:34:32 serverbox sshd[41228]: Changed root directory to "/home/specialuser" [postauth]
Sep 14 10:34:32 serverbox sshd[41228]: sshd_selinux_copy_context: getcon failed with No such file or directory [postauth]
Sep 14 10:34:32 serverbox sshd[41228]: Starting session: forced-command (config) 'internal-sftp' for specialuser from 1.1.1.77 port 61135 [postauth]
Sep 14 10:34:32 serverbox sshd[41228]: Connection closed by 1.1.1.77 [postauth]
Sep 14 10:34:32 serverbox sshd[41228]: Transferred: sent 1976, received 1728 bytes [postauth]
Sep 14 10:34:32 serverbox sshd[41228]: Closing connection to 1.1.1.77 port 61135 [postauth]
Sep 14 10:34:32 serverbox sshd[41228]: pam_unix(sshd:session): session closed for user specialuser

EDIT

I created a separate, non-chrooted, user on the server. I'm able to use Putty and Putty SFTP to SSH/SFTP to the server with the public/private key.

The problem is getting to the chrooted home folder.

APPENDIX 1: log data with LogLevel DEBUG3

https://justpaste.it/ycdi (output exceeds max allowed characters for this question)

sshd_config

Subsystem sftp internal-sftp #added
Match group sftponly
        PasswordAuthentication yes
        ChrootDirectory %h
        AllowTcpForwarding no
        ForceCommand internal-sftp
  • How do you do the Chroot? – Jakuje Sep 14 '16 at 15:22
  • Exactly like this: serverfault.com/questions/581323/… – a coder Sep 14 '16 at 16:09
  • What openssh version are you using? That is not error, but just a message not causing the disconnect. Can you retry with LogLoevel DEBUG3 in sshd_config to see what is going on there and when the disconnect appears? – Jakuje Sep 14 '16 at 16:15
  • openssh 6.6.1. Will set DEBUG3 and comment back when output is added to the question. – a coder Sep 14 '16 at 16:44
  • Here is DEBUG3: justpaste.it/ycdi – a coder Sep 14 '16 at 16:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.