Ssh – find logs for SFTP

sftpsshubuntu-10.04

I'm trying to set up sftp-server but the client is getting an error, Connection closed by server with exitcode 1

/var/log/auth.log (below) doesn't help much, how can I find out what the error is?

I'm running Ubuntu 10.04.1 LTS

sshd[27236]: Accepted password for theuser from (my ip) port 13547 ssh2
sshd[27236]: pam_unix(sshd:session): session opened for user theuser by (uid=0)
sshd[27300]: subsystem request for sftp
sshd[27236]: pam_unix(sshd:session): session closed for user theuser

Update: I've been prodding this for a while now, I've got the sftp command on another server giving me a more useful error.

Request for subsystem 'sftp' failed on channel 0
Couldn't read packet: Connection reset by peer

Everything I've found on the net suggests this id a problem with sftp-server but when I remove the chroot from sshd config I can access the system. I assume this means sftp-server is accessible and set up correctly.

Best Answer

The sftp-server is an external binary. It's likely not inside your chroot environment.

If you modify sshd_config to use the internal subsystem (if available) it should start working with chroot.

Related Solutions

Ubuntu SSH Login – Permission Denied, Please Try Again

Are you certain that the user account you're attempting to access is correctly configured? If you log in as root on the system, can you su to the user account?

# su - username

What do you see in your logs after a failed connection attempt? On many systems, sshd will log to something /var/log/secure or /var/log/auth.log. Also, I note that you have PasswordAuthentication enabled but ChallengeResponseAuthentication disabled. Do you see the same behavior if you enable ChallengeResponseAuthentication?

Here are some general diagnostic steps to use when you have ssh problems:

Enable verbose diagnostics in ssh:
```
ssh -v host.example.com
```
This will cause the client to output a variety of diagnostic messages as it negotiates the connection. This will often provide a clue to the problem.
Run the server in debug mode.

On your server, stop sshd, then run it from the command line like this:
```
/usr/sbin/sshd -d
```
This will produce verbose debug logging on stderr that will very often contain useful information.

If neither of these helps you figure out what's going on, would you add the output to your question?

Linux – Suspicious password login in sshd log

Well, that's a legit sftp-via-ssh connection from your IP address. Either you've been keylogged, or (more likely in my opinion) you forgot that you set up password-based sftp for some application like DreamWeaver which is automatically logging in to your virtual host to keep its file repository up to date.

Best Answer

Related Solutions

Ubuntu SSH Login – Permission Denied, Please Try Again

Linux – Suspicious password login in sshd log

Related Topic