12:19:51 <muh2000> i cannot login via root, i enabled both options in the ssh_config PasswordAuthentication yes  PermitRootLogin yes  but it still gives me  PAM: Authentication error for root from     what did i do wrong?
12:21:59 <TommyC> Did you restart sshd?
12:22:46 <muh2000> yes, i also rebooted the system
13:51:06 <muh2000> i cannot login via root, i enabled both options in the ssh_config PasswordAuthentication yes  PermitRootLogin yes  but it still gives me  PAM: Authentication error for root from     what did i do wrong?
13:54:16 <MelanieUrsidino> you restarted sshd?
13:54:54 <MelanieUrsidino> set root a password? or added your sshkey to authorized_keys, better, plus PermitRootLogin prohibit-password
13:55:48 <muh2000> password is set. sshkeys was the next step i wanted to do
14:03:51 <CrtxReavr> muh2000, the OpenSSH client & server both have debug options.
14:03:57 <CrtxReavr> ssh -vvv
14:04:09 <CrtxReavr> sshd -D -ddd
14:04:42 <CrtxReavr> If the server is remote, try testing on an alternate port.
14:06:18 <muh2000> running it in a vm
14:06:53 <CrtxReavr> Your hypervisor give you console access?
14:07:21 <muh2000> yes  virtualbox
14:07:33 <CrtxReavr> Then 'service sshd stop'
14:07:43 <CrtxReavr> Then run /usr/sbin/sshd -D -ddd
14:07:55 <CrtxReavr> Then try your login attept and see what gets printed.
14:08:04 <muh2000> when i enter the passwd no error shows up
16:46:14 <rwp> muh2000, That's totally strange!  CrtxReavr's suggestion is how I debug these things too.  There are no information messages logged to /var/log/auth.log about why the login is being denied when run normally?  The -ddd should send all of these to the terminal as seterr for easy debugging.
17:04:52 <heston76> muh2000: Is your vbox vim network adapter using NAT?
17:05:29 <heston76> s/vim/vm
17:32:09 <rwp> heston76, Good question!  However if the NAT was blocking then there would be no password prompt.  Since there is a password prompt there must be a connection through.
17:32:35 <rwp> heston76, However your question makes me think the connection is actually to a completely different system.
17:33:11 <rwp> Which would be supported by the fact that the password file says nothing out from sshd -ddd output.
17:33:31 <rwp> s/password file/password fail/ says nothing
17:36:56 <lts> Great question! You might want to look into /var/log/authlog
17:37:53 <rwp> s/authlog/auth.log/ ls -ld /var/log/auth.log
17:38:22 <lts> You're absolutely correct! (Sorry)
17:38:37 <lts> I was in openbsd headspace
17:40:49 <rwp> It's hard to juggle all of the headspaces!  :-)
17:41:24 <lts> It really is
21:26:36 <polarian> how do I ensure rc.conf assigns a lladdr for an interface
21:27:26 <polarian> I can hop global addresses over lladdr
21:27:41 <polarian> I dont needto do what I do with IPv4 and hop packets over lots of IPv4 local addresses
21:28:07 <polarian> but I cant figure out how to get freebsd to assign the lladdr without specifying an address
21:28:16 <polarian> actually I could just assign the local link addr myself
21:28:19 <polarian> that would be easier wouldn it xD
22:00:30 <polarian> I am having issues with IPv6 jail networking now
22:01:29 <polarian> wait theres two things, firstly how do I have multiple IPv6 addresses in rc.conf, you cant specify many interface_ipv6 lines, the last one will be the one which matches, and if I add multiple inet6 in the same line I get an invalid format error
22:01:34 <polarian> ifconfig doesnt like it
22:01:54 <polarian> but my other issue is I cant seem to get packet forwarding working
22:02:20 <polarian> net.inet6.ip6.forwarding: 1
22:03:01 <polarian> and yet, if I ping6 the host (main interface, not epair) or say google.com, the ICMPv6 packet passes through the epair, but is dropped host epair side
22:03:17 <polarian> no log in pflog
22:03:25 <polarian> for some reason its not forwarded
22:03:32 <polarian> doesnt get seen on the host interface (re0)
22:03:37 <polarian> host physical interface
22:03:41 <polarian> and I have no clue why
22:04:18 <polarian> like you can ping 2001:8b0:57a:2391::1:4 if you dont to test it yourself, the jail can be reached externally, but the jail cant ping anything itself
22:04:22 <polarian> I dont know why...
22:05:50 <polarian> https://bpa.st/HMIA
22:05:54 <polarian> thats the ifconfig on the host
22:07:09 <polarian> if I ping 2001:8b0:57a:2391:: (the host) there is no forwarding
22:07:12 <polarian> the packet *should* be forwarded
22:09:34 <polarian> https://bpa.st/6STA
22:09:43 <polarian> im just so clueless
22:15:37 <satanist> polarian: have you forwarding enabled? look at sysctl net.inet6.ip6.forwarding
22:15:45 <polarian> satanist: already said so
22:15:49 <polarian> but wait I just remembered something
22:15:53 <polarian> I might have made a really dumb mistake
22:16:23 <satanist> sorry missed that
22:17:02 <vkarlsen> Dumb mistakes aren't so bad. It's the smart ones that will hit you hard.
22:17:32 <polarian> nope
22:17:36 <polarian> it wasnt that
22:17:46 <polarian> I thought missing ipv6_gateway_enable="YES" would have been the problem
22:17:55 <polarian> but I fixed that, and then service routing restart
22:17:57 <polarian> same issue
22:18:00 <polarian> after restarting the jail too
22:18:08 <polarian> unless...
22:19:10 <polarian> nope same issue
22:19:22 <vkarlsen> Shot in the dark without reading all the convo: you're not firewalling icmp, are you?
22:20:58 <polarian> vkarlsen: its passed quick
22:21:00 <polarian> icmpv6 that is
22:21:21 <polarian> because if you dont pass neighbor solicit and adv always IPv6 breaks
22:21:26 <polarian> so easier to just pass quick icmpv6
22:21:59 <satanist> how does the routing table in the jail looks like?
22:23:34 <polarian> satanist: https://bpa.st/4MVA
22:24:40 <polarian> it goes:
22:24:46 <polarian> epair (jail) --> epair (host) then dropped
22:24:55 <polarian> it should go
22:25:10 <polarian> epair (jail) --> epair (host) --> re0 --> router --> internet
22:25:14 <polarian> if I ping say google
22:25:19 <polarian> it never gets forwarded to re0
22:25:29 <polarian> it should within the routing table
22:25:33 <polarian> the default route is the lladdr of the router
22:28:01 <satanist> the more you explain, the more it sounds like a problem in the firewall setting
22:31:13 <polarian> satanist: theres no firewall issues
22:31:18 <polarian> if there was pflog would log it
22:31:22 <polarian> theres no firewall within the jail either
22:32:25 <polarian> I have a default block all after the pass quick proto icmpv6
22:32:31 <polarian> and the default block all is logged
22:32:38 <polarian> every blocked packet goes to pflog
22:32:46 <polarian> "block log all"
22:33:19 <polarian> oh for fuck sake
22:33:32 <polarian> I found what it is
22:33:32 <heston76> Can you self ping?
22:33:39 <polarian> this is fucking embarrassing
22:33:49 <polarian> satanist: you were right...
22:34:04 <polarian> I rechecked the firewall, and I noticed I had an antispoof rule in it
22:34:13 <polarian> I know this expands out into a block
22:34:17 <polarian> sure enough I comment it out
22:34:19 <polarian> I can pin
22:34:23 <polarian> ping*
22:34:32 <polarian> I wonder why antispoof is causing issues
22:35:17 <polarian> errrrrrrr
22:36:04 <polarian> antispoof didnt do anything, just reloading the firewall did, I re-enabled antispoof
22:36:12 <polarian> did something flush pf I wonder...
22:36:37 * polarian shrugs
22:36:50 <polarian> welp it was fixed by simply doing pfctl -f /etc/pf.conf when the pf.conf hasn't been modified
22:37:06 <polarian> it works... and I don't know why...