[Techtalk] SSHD Authenticates on Only One Interface

[Kai MacTane]

I've got a really odd problem going on with sshd on one of my machines, and 
it's driving me nuts. This machine is a gateway between my internal network 
and the net-at-large, so it has two interfaces - public (eth1) is 
66.92.49.123, and the private net (eth0) is on 192.168.1.0/24, which should 
be no great shock.

When I connect on the public interface, I can log in just fine. When I 
connect from the private net, however, I am prompted for a password (which 
shows that sshd *is* listening to that interface), but then I'm always told 
that the password was wrong. Even when I've double-checked it very 
carefully. (Yes, the Caps Lock key is off. <g>)

If I telnet to port 22 on the private interface, I even see a 
"SSH-1.99-OpenSSH_3.7.1p1" banner. It's not a ListenAddress problem.

This affects all user accounts on the machine. Any user can log in and 
authenticate through the public interface, and nobody can authenticate 
through the private net. If I'm on the private net and I want to access 
this machine, I have to ssh transparently through it to an outside machine, 
then ssh from there back in on the public interface. (Which is the 
workaround I've been using for months.)

My /etc/ssh/sshd_config file is only 30 lines long, so I've included it 
below. The system is Mandrake Linux 7.1, with the 2.2.15-4mdksecure kernel. 
My thanks in advance for any assistance anyone can provide.


#   $OpenBSD: sshd_config,v 1.42 2001/09/20 20:57:51 mouring Exp $

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin

# This is the sshd server system-wide configuration file.  See sshd(8)
# for more information.

#Port 22
#Protocol 2,1
#0.0.0.0
#ListenAddress ::

# HostKey for protocol version 1
HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key

# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# Uncomment to disable s/key passwords
#ChallengeResponseAuthentication no

# Uncomment to enable PAM keyboard-interactive authentication
# Warning: enabling this may bypass the setting of 'PasswordAuthentication'
#PAMAuthenticationViaKbdInt yes

Subsystem   sftp    /usr/local/libexec/sftp-server



                                                 --Kai MacTane
----------------------------------------------------------------------
"Death and money make their point once more,
  In the shape of philosophical assassins..."
                                                 --Shriekback,
                                                  "Gunning for the
                                                   Buddha"