5.0rc7 ssh crashes on RB433 - bugreport?

RouterOS General
1

Hi,
I’m experiencing serious ssh crashing. It crashes in a lot of different ways in very different circumstances.

Reproducible: always.

How to reproduce:

  1. /user ssh-keys import user=admin file=id_dsa.pub
  2. use scp to copy a file (I copy 20MB)

Result during scp (from host with id_dsa)

ssh -l admin 172.16.1.6
Connection closed by UNKNOWN
video-srv-03:~# ssh -l admin 172.16.1.6
Connection closed by UNKNOWN
video-srv-03:~# ssh -l admin 172.16.1.6




Result after scp (I'm trying to login with proper password, from different host, password auth possible only):
admin@172.16.1.6's password: 
Permission denied, please try again.
admin@172.16.1.6's password: 
Permission denied, please try again.
admin@172.16.1.6's password: 
Permission denied (password).

Log print shows zero information about failed login attempts, and finaly, after few seconds:

ssh -l admin 172.16.1.6
ssh: connect to host 172.16.1.6 port 22: Connection refused

Still, telneting goes fine, but logs gives nothing about ssh. So, instead, I’ve tried adding another user with admin rights and import ssh-key into this account:

#lets clear all previous ssh stuff:
/user ssh-keys remove numbers=0 ;
/ip service set ssh disabled=yes
/ip service set ssh disabled=no
# new stuff
/user add name=adminuser group=full password=test
/user ssh-keys import file=id_dsa.pub user=adminuser

And now during “scp adminuser@172.16.1.6:/file.out /tmp” I cannot login to admin, two different failures:

video-srv-03:~# ssh -l admin 172.16.1.6
Connection closed by 172.16.1.6
ssh -l admin 172.16.1.6
Connection closed by UNKNOWN

If adminuser has id_dsa key enabled, and there is no scp going in background, he cannot login with password through ssh (his password isn’t checked or there is no information about it in log). Telneting works fine.

Have you got this already reported? I’ve tried 5.0rc1 and hit that bug, so I’ve upgraded to latest rc and it still sits here and kicks in the a..

Any workaround?

2

Please, contact MikroTik support (support@mikrotik.com), we will give you package, where are fixes for SSH available.

3

Sent; shall I attach supout.rif too?

4

Support output file is not required.
We will need support output file from 5.0rc8 version in case of any problems.

5

sergejs,

I have upgraded with the file provided, but still when I add a key to an user, he is unable to login using password (from different machine, for example). Shall we continue via support@ email channel; I can provide you with further info you may ask for.

EDIT: unfortunately, I am able to repeat steps needed for ssh crash. It looks almost the same as previously, but takes more time (or I’m just exhausted and work slower?)

This time, ssh crashes mostly on broken (ctrl+c) scp. It changed a little bit because I’m having in logs:

00:34:58 ssh,info client timeout

(I cannot be sure the exact moment of this entry). I attach supout.rif (changed name to pdf)
supout.pdf (306 KB)

6

it is as intended - if you add ssh-key to user account user will not be able to login using username/password. Use of key is required in this case.

edit: also, what you mean by crashes? i tried your scenario on ppc and mipsbe, but ssh did not crash in either of cases.

7

it is as intended - if you add ssh-key to user account user will not be able to login using username/password. Use of key is required in this case.

Sorry, I didn’t know, but this is fair with me.

edit: also, what you mean by crashes? i tried your scenario on ppc and mipsbe, but ssh did not crash in either of cases.

Please be sure to use scp and saturate the link (I got 3G modem). If its saturated, then try to ssh into the RB, be impatient, try several times. If I try, I always fail to do so with the message as above. And later, when I try to scp, ssh several times it just crashes and I’ve receive connection refused, so ssh -v probably gives nothing.

I’ve get through the support@ request to provide you with ssh -v (or better -vv). I will do so, but unfortunately probably not this week (but next).

8

thank you for details about saturated link. i was trying this on 1GBit network. Where NAND is too slow to saturate it with upload/download

9

thank you for details about saturated link. i was trying this on 1GBit network. Where NAND is too slow to saturate it with upload/download

I suppose one can use wireless link too. If you were to not reproduce the effect (very unlikely), in the middle of the next week I’ll provide you with MT which crashes (I’ll finish my job with it and leave it on public address so you can test).

10

if you get the crash and send supout.rif file created after the crash we can work with that too. but it should be version as new as possible.

11

if you get the crash and send supout.rif file created after the crash we can work with that too. but it should be version as new as possible.

Well, supout.rif is included above. This is from RouterOS 5.0rc8 sent by sergejs to me.

12

Any comments about next posts?
http://forum.mikrotik.com/t/v5rc7-released/43409/79

13

Any comments about next posts?
viewtopic.php?&p=246580&f=1#p246580

Weekend has gone, lets continue:

The user above is right, the same effect exists in rc8. Not only for user= but for all options within the /system ssh context, so they are: port, address, and user.

14

The same for RC9

15

I detect the same error in one of my Mikrotik’s.
I can not transfer files via SFTP.