After OpenSSH 4.3, event ID 1006 errors on login

After OpenSSH 4.3, event ID 1006 errors on login (Full Version)

All Forums >> [SFU / Interix / SUA Technology] >> Tools Discussion Forum

Message

breiter -> After OpenSSH 4.3, event ID 1006 errors on login (Apr. 10, '06, 10:53:10 AM)

I am seeing two (2) event ID 1006 errors for every SSH login on a my server that I just upgraded to OpenSSH 4.3. The server is configured as stand-alone in a datacenter and is *not* a member of a domain. It is Win2k3 SP1 (not R2) fully patched with Interix 3.5 installed.

quote:

Event Type: Error
Event Source: Interix
Event Category: None
Event ID: 1006
Date: 4/10/2006
Time: 10:46:15 AM
User: N/A
Computer: RA
Description:
A user or group id with a value too large to make into a uid_t has been encountered, and converted into a reserved UID value. See Knowledge Base article Q306552 for more information. The internal UID is 0x091ab8d3f.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Here's the (dated looking) KB article referenced: http://support.microsoft.com/kb/306552.

Here's what happens when I run psxopffset. It's none too helpful.

% psxoffset -uid 091ab8d3f
Get Any failed with NStatus 1717
Get Any failed with NStatus 1717
Could not get Policy Handle; exiting
% psxoffset -uid 0x091ab8d3f
Get Any failed with NStatus 1717
Get Any failed with NStatus 1717
Could not get Policy Handle; exiting

breiter -> RE: After OpenSSH 4.3, event ID 1006 errors on login (Apr. 10, '06, 10:58:05 AM)
One more bit of info is that I'm using rsa keys to log in.

breiter -> RE: After OpenSSH 4.3, event ID 1006 errors on login (Apr. 10, '06, 11:06:42 AM)
Removing the /var/adm/SystemWarning file does not help. It gets regenerated with every logon via ssh. Interestingly, the /var/adm/SystemWarning file does not get regenerated if I start shell locally (via terminal services: Start \| All Programs Windows Services for UNIX \| C Shell).

Rodney -> RE: After OpenSSH 4.3, event ID 1006 errors on login (Apr. 10, '06, 1:40:40 PM)
Are you successfully logging in with this event error being generated? When you write that you are using "rsa keys", I'll assume you are doing a passwordless login, yes?

breiter -> RE: After OpenSSH 4.3, event ID 1006 errors on login (Apr. 10, '06, 1:48:39 PM)
Yes. Passwordless login. I am actually able to log in. Everything seems fine except for the big fat warning message: ============================================================= WARNING: One or more events have been logged in the Event Log that the system administrator should investigate. ============================================================= The weird thing is that this is only affecting one of two servers similarly configured that I have tried it on. The only obvious difference between the two boxes is that the one with a problem is a dual XEON box with 4 GB of RAM and the one without a problem is a Pentium II-generation with a small RAM footprint. I don't see this issue on my SUA case, either. I'm stumped.

woehlkmp -> RE: After OpenSSH 4.3, event ID 1006 errors on login (Apr. 10, '06, 4:41:56 PM)
Hi, Breiter, Off-topic: is your SUA box also dual Xeon? If so, have you ever had this happen? I've tried 2003 Enterprise (x86) on two different boxes, as well as 2003 R2 Enterprise x64 (on one box), and in all three instances, I found it to be completely unreliable. I finally got so fed up that I dropped 2000 Pro SP4 on a box with SFU 3.5, and so far that's run just fine.

breiter -> RE: After OpenSSH 4.3, event ID 1006 errors on login (Apr. 10, '06, 4:47:47 PM)
No. My SUA situation issues are all just self-inflicted on my own day-to-day machine. I'm not ready to put SUA into production until I see some hotfixes for at least the outstanding issue in this thread. Your thread gives me a little pause, though.

woehlkmp -> RE: After OpenSSH 4.3, event ID 1006 errors on login (Apr. 10, '06, 4:56:54 PM)
> Your thread gives me a little pause, though. I would hope! My own experience, unfortunately, is that SUA is completely unreliable on Xeon SMP systems (as I've said, I've tried two boxes that are wildly different except for both being dual Xeons; albiet completely different generations of Xeon). Even a failure rate of one time in a million is completely unacceptable when what's failing is "any arbitrary system call". I would advise some cautious testing with a well planned back-out strategy before you move anything multi-CPU onto SUA for production use! [;)] If you should happen to run into this and/or talk about it at all with Microsoft, I would very much appreciate hearing about it. TIA, Matthew

breiter -> RE: After OpenSSH 4.3, event ID 1006 errors on login (Apr. 17, '06, 5:55:32 AM)
I have no idea what was causing the issue described above, but it never actually stopped anything from working. It went away after deleting /var/adm/SystemWarning, applying the April security updates and rebooting. I suspect that removing /var/adm/SystemWarning and rebooting were the key operations because none of the security updates applied to Interix.

breiter -> RE: After OpenSSH 4.3, event ID 1006 errors on login (Sep. 20, '06, 12:00:35 PM)
FYI. The SystemWarning came back when I updated OpenSSH again. I hope it goes away with the next reboot. We'll see.

Page: [1]

0.031