[SOLVED] Cannot perform admin functions due to SSH problem (6.0.3 OSS, RHEL4)

[psarhjinian]

I'm getting the following error attempting to perform certain admin tasks (installing a cert, etc) after upgrading to 6.0.3 from 5.0.11. It's likely---I can't recall---I had this issue before the upgrade, but the certificate broke on upgrade and now it's a more serious issue:

Message: system failure: exception during auth {RemoteManager: host.domain->zimbra@host.domain:22} Error code: service.FAILURE Method: GetCertRequest Details:soap:Receiver

I've stepped through Mail Queue Monitoring - Zimbra :: Wiki and verified my SSH settings. There's no firewall, nor have I changed ports. I'm still getting prompted for a password when I run:

ssh -vi .ssh/zimbra_identity -o strictHostKeyChecking=no zimbra@MAIL.DOMAIN.COM

I'm pretty sure this is an SSH problem and not a Zimbra one, but I can't find out how/why/what it is or how to diagnose it effectively.

[ArcaneMagus]

Have you tried the steps outlined in the Wiki article you linked to regenerate the SSH keys?

[psarhjinian]

Yes, I did.

Ran the fix permissions script, regenerated the keys, checked hosts.allow and sshd_conf and unlocked (repeatedly) and verified the lockout status of the account---all of it.

At this point I think I'm down to a problem with SSH. What information would be helpful in diagnosing why it's not allowing keyfile auth?

[ArcaneMagus]

Any errors in /var/log/security? (or your OS's equivalent)

[phoenix]

You said earlier there's no firewall (are you absolutely sure ), have you also disabled SElinux (you should)?

[psarhjinian]

Figured it out.

SSH was set to use PAM, and when we replaced the firewall I didn't reestablish the ruleset that allowed PAM to backend onto AD. Funny, since the "zimbra" account didn't auth via PAM, and I could log in as a non-PAM-auth'ed user. Fixing the firewall rule worked, but so would have disabling PAM in sshd_config or removing the pam config entries that pointed to the domain.

It didn't make any sense until I ran ssh with maximum verbosity. Even then it wasn't at all clear.