i cannot login via root, i enabled both options in the ssh_config PasswordAuthentication yes PermitRootLogin yes but it still gives me PAM: Authentication error for root from what did i do wrong?

Did you restart sshd?

yes, i also rebooted the system

i cannot login via root, i enabled both options in the ssh_config PasswordAuthentication yes PermitRootLogin yes but it still gives me PAM: Authentication error for root from what did i do wrong?

you restarted sshd?

set root a password? or added your sshkey to authorized_keys, better, plus PermitRootLogin prohibit-password

password is set. sshkeys was the next step i wanted to do

muh2000, the OpenSSH client & server both have debug options.

ssh -vvv

sshd -D -ddd

If the server is remote, try testing on an alternate port.

running it in a vm

Your hypervisor give you console access?

yes virtualbox

Then 'service sshd stop'

Then run /usr/sbin/sshd -D -ddd

Then try your login attept and see what gets printed.

when i enter the passwd no error shows up

muh2000, That's totally strange! CrtxReavr's suggestion is how I debug these things too. There are no information messages logged to /var/log/auth.log about why the login is being denied when run normally? The -ddd should send all of these to the terminal as seterr for easy debugging.

muh2000: Is your vbox vim network adapter using NAT?

s/vim/vm

heston76, Good question! However if the NAT was blocking then there would be no password prompt. Since there is a password prompt there must be a connection through.

heston76, However your question makes me think the connection is actually to a completely different system.

Which would be supported by the fact that the password file says nothing out from sshd -ddd output.

s/password file/password fail/ says nothing

Great question! You might want to look into /var/log/authlog

s/authlog/auth.log/ ls -ld /var/log/auth.log

You're absolutely correct! (Sorry)

I was in openbsd headspace

It's hard to juggle all of the headspaces! :-)

It really is

how do I ensure rc.conf assigns a lladdr for an interface

I can hop global addresses over lladdr

I dont needto do what I do with IPv4 and hop packets over lots of IPv4 local addresses

but I cant figure out how to get freebsd to assign the lladdr without specifying an address

actually I could just assign the local link addr myself

that would be easier wouldn it xD

I am having issues with IPv6 jail networking now

wait theres two things, firstly how do I have multiple IPv6 addresses in rc.conf, you cant specify many interface_ipv6 lines, the last one will be the one which matches, and if I add multiple inet6 in the same line I get an invalid format error

ifconfig doesnt like it

but my other issue is I cant seem to get packet forwarding working

net.inet6.ip6.forwarding: 1

and yet, if I ping6 the host (main interface, not epair) or say google.com, the ICMPv6 packet passes through the epair, but is dropped host epair side

no log in pflog

for some reason its not forwarded

doesnt get seen on the host interface (re0)

host physical interface

and I have no clue why

like you can ping 2001:8b0:57a:2391::1:4 if you dont to test it yourself, the jail can be reached externally, but the jail cant ping anything itself

I dont know why...

thats the ifconfig on the host

if I ping 2001:8b0:57a:2391:: (the host) there is no forwarding

the packet *should* be forwarded

im just so clueless

polarian: have you forwarding enabled? look at sysctl net.inet6.ip6.forwarding

satanist: already said so

but wait I just remembered something

I might have made a really dumb mistake

sorry missed that

Dumb mistakes aren't so bad. It's the smart ones that will hit you hard.

nope

it wasnt that

I thought missing ipv6_gateway_enable="YES" would have been the problem

but I fixed that, and then service routing restart

same issue

after restarting the jail too

unless...

nope same issue

Shot in the dark without reading all the convo: you're not firewalling icmp, are you?

vkarlsen: its passed quick

icmpv6 that is

because if you dont pass neighbor solicit and adv always IPv6 breaks

so easier to just pass quick icmpv6

how does the routing table in the jail looks like?

satanist: bpa.st/4MVA

it goes:

epair (jail) --> epair (host) then dropped

it should go

epair (jail) --> epair (host) --> re0 --> router --> internet

if I ping say google

it never gets forwarded to re0

it should within the routing table

the default route is the lladdr of the router

the more you explain, the more it sounds like a problem in the firewall setting

satanist: theres no firewall issues

if there was pflog would log it

theres no firewall within the jail either

I have a default block all after the pass quick proto icmpv6

and the default block all is logged

every blocked packet goes to pflog

"block log all"

oh for fuck sake

I found what it is

Can you self ping?

this is fucking embarrassing

satanist: you were right...

I rechecked the firewall, and I noticed I had an antispoof rule in it

I know this expands out into a block

sure enough I comment it out

I can pin

ping*

I wonder why antispoof is causing issues

errrrrrrr

antispoof didnt do anything, just reloading the firewall did, I re-enabled antispoof

did something flush pf I wonder...

welp it was fixed by simply doing pfctl -f /etc/pf.conf when the pf.conf hasn't been modified

it works... and I don't know why...