SSH error messages - chan_read_failed

Are you tired of getting ssh error messages on system console and /var/adm/messages file? If yes, here is how you can separate those messages from /var/adm/messages file and redirect it to some place which can be dedicated only for such messages and doesn;t normally need to be reviewed.

For redirecting ssh bug messages, I changed the location of logs as follows:

# cat /etc/syslog.conf
#ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */
#
# Copyright (c) 1991-1998 by Sun Microsystems, Inc.
# All rights reserved.
#
# syslog configuration file.
#
# This file is processed by m4 so be careful to quote (`') names
# that match m4 reserved words. Also, within ifdef's, arguments
# containing commas must be quoted.
#
*.err;kern.notice;auth.none /dev/sysmsg
*.err;auth.none;kern.debug;daemon.notice;mail.crit /var/adm/messages
auth.info /var/log/authlog

*.alert;kern.err;daemon.err operator
*.alert root
*.emerg *

local3.debug @syslog-server
local2.debug @syslog-server

# if a non-loghost machine chooses to have authentication messages
# sent to the loghost machine, un-comment out the following line:
#auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost)

mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost)

#
# non-loghost machines will use the following lines to cause "user"
# log messages to be logged locally.
#
ifdef(`LOGHOST', ,
user.err /dev/sysmsg
user.err /var/adm/messages
user.alert `root, operator'
user.emerg *
)
local7.debug /var/adm/sam-log

Please note that in syslog.conf file, it is a must to keep fields TAB separated, else it will not work.

# touch /var/log/authlog

In Solaris 10, the syslog.conf can be re-read by following steps:

# svcs -a grep system-log
online Jan_13 svc:/system/system-log:default

# svcadm refresh /system/system-log

# svcs /system/system-log
STATE STIME FMRI
online 9:34:06 svc:/system/system-log:default

Prior to Solaris 10, the syslog.conf can be re-read by following steps:

# ps -eaf grep syslog
root 441 1 0 Jan 13 ? 0:12 /usr/sbin/syslogd

# kill -HUP 441

Once syslog.conf file is changes and re-read by syslogd daemon, the /var/log/authlog will start getting those bugging messages from ssh.

# tail -100 /var/log/authlog
Jan 17 09:06:48 someserver sshd[11543]: [ID 800047 auth.error] error: channel 0: chan_read_failed for istate 3
Jan 17 09:06:48 someserver last message repeated 2 times
Jan 17 09:11:40 someserver sshd[19750]: [ID 800047 auth.info] Accepted publickey for oracle from 10.60.70.68 port 37317 ssh2
Jan 17 09:11:40 someserver sshd[19750]: [ID 800047 auth.error] error: channel 0: chan_read_failed for istate 3
Jan 17 09:11:40 someserver last message repeated 2 times
Jan 17 09:11:40 someserver sshd[19772]: [ID 800047 auth.info] Accepted publickey for oracle from 10.60.70.68 port 37322 ssh2
Jan 17 09:11:40 someserver sshd[19772]: [ID 800047 auth.error] error: channel 0: chan_read_failed for istate 3
Jan 17 09:11:40 someserver last message repeated 2 times
Jan 17 09:11:41 someserver sshd[19795]: [ID 800047 auth.info] Accepted publickey for oracle from 10.60.70.68 port 37325 ssh2
Jan 17 09:11:41 someserver sshd[19795]: [ID 800047 auth.error] error: channel 0: chan_read_failed for istate 3

How to setup passwordless SSH?

Here is the step by step process (screenlogs) as to how I setup password-less SSH for ABCGRID1 server from ABCNETBACKUP.

login as: unixgeek
unixgeek @ 10.10.10.13 password:

Last login: Mon Oct 29 13:21:05 2007 from abcgrid1.somecompany.com
Sun Microsystems Inc. SunOS 5.10 Generic January 2005
Sun Microsystems Inc. SunOS 5.10 Generic January 2005

Seting the DISPLAY to 047-lkhla5f.somecompany.com:0.0
Welcome to abcnetbackup

$ hostname;pwd
abcnetbackup
/export/home/unixgeek

$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/export/home/unixgeek/.ssh/id_rsa): 
Created directory '/export/home/unixgeek/.ssh'.
Enter same passphrase again: 
Your identification has been saved in /export/home/unixgeek/.ssh/id_rsa.
Your public key has been saved in /export/home/unixgeek/.ssh/id_rsa.pub.
The key fingerprint is:
ef:55:ab:2e:75:12:b1:5e:46:50:d3:db:fd:bf:d1:31 

$ cd .ssh

$ ls
id_rsa id_rsa.pub

$ cat id_rsa.pub >> authorized_keys

$ mkdir ALL_KEYS

$ cp -p id_rsa.pub ALL_KEYS/id_rsa.pub.abcnetbackup

$ scp -p ALL_KEYS/id_rsa.pub.abcnetbackup abcgrid1:/export/home/unixgeek/.ssh/ALL_KEYS/
The authenticity of host 'abcgrid1 (10.10.10.100)' can't be established.
RSA key fingerprint is 31:93:d3:90:19:75:44:f2:b9:27:32:57:3a:88:eb:3f.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'abcgrid1,10.10.10.100' (RSA) to the list of known hosts.
unixgeek @ abcgrid1 password:
id_rsa.pub.abcnetbackup 100% 400 0.4KB/s 00:00

$ cd ALL_KEYS

$ ls
id_rsa.pub.abcgrid1 id_rsa.pub.abcnetbackup

$ cat id_rsa.pub.abcgrid1 >> ../authorized_keys

$ ssh abcgrid1
Last login: Mon Oct 29 13:35:51 2007 from 047-lkhla5f.somecompany.com
Sun Microsystems Inc. SunOS 5.10 Generic January 2005
Sun Microsystems Inc. SunOS 5.10 Generic January 2005
Seting the DISPLAY to abcnetbackup.somecompany.com:0.0
Welcome to abcgrid1
$