Shut down firewall rule not working

Have you tried passing on the key file as a parameter of your ssh command?

> ssh -i /path/to/id_rsa openhab@192.168.1.254

Doesnt work either im afraid :frowning:

18:35:59.574 [INFO ] [lipse.smarthome.model.script.exectest] - results- Warning: Identity file /home/server/.ssh/openhab.pub not accessible: Permission denied.
Permission denied, please try again.
Permission denied, please try again.
Received disconnect from 192.168.1.254 port 22:2: Too many authentication failures
Disconnected from 192.168.1.254 port 22

looks like a file access problem. Have you verified the file permissions?

The file is owned by the user im logging in as…

but openhab runs as openhab user right? Does that account have access?

As a test can you can check the following?:

cat /etc/passwd | grep openhab

If the output is something like:

openhab:x:111:115::/home/openhab:/usr/sbin/nologin

modify it to:

openhab:x:111:115::/home/openhab:/bin/bash

This will allow you to switch user to openhab (su openhab)

Then you can try the ssh command again.

Can you share the output of “ls -al /home/server/.ssh/openhab.pub” ?

1 Like

Sure Pascal


openhab:x:111:113:openhab2 runtime user,,,:/var/lib/openhab2:/bin/false

-rw-r--r-- 1 server server 96 Dec 28 18:18 /home/server/.ssh/openhab.pub

/bin/false?? odd. Different to your example

/bin/false?? >>> different OS i guess :slight_smile:
You can modify it to /bin/bash for troubeshooting.

try the following:

usermod -a G server openhab

And try the ssh -i /home/server/.ssh/openhab.pub openhab@192.168.1.254 again (as openhab)

server@ihp:/etc/openhab2/rules$ ssh -i /home/server/.ssh/openhab.pub openhab@192.168.1.254
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for ‘/home/server/.ssh/openhab.pub’ are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key “/home/server/.ssh/openhab.pub”: bad permissions
Password for openhab@pfSense.server.ddns.net:

Asks for a password for the openhab user, but naturally it doesnt have one.

try ssh -i /home/server/.ssh/openhab openhab@192.168.1.254
(the private key is needed here, not the public one)

Yes, that worked. Straight in.

But if i run that in the rule

results- Warning: Identity file /home/server/.ssh/openhab not accessible: Permission denied.
Permission denied, please try again.
Permission denied, please try again.
Received disconnect from 192.168.1.254 port 22:2: Too many authentication failures
Disconnected from 192.168.1.254 port 22

try this as root (sudo -s):

cd /home
mkdir openhab
chown openhab:openhab openhab
cd openhab
cp /home/server/.ssh/openhab /home/openhab/openhab_privkey
chown openhab:openhab openhab_privkey
chmod 600 openhab_privkey

then in the openhab rule:

ssh -i /home/openhab/openhab_privkey openhab@192.168.1.254

1 Like

I find it interesting an IT security professional does not know how to securely set up ssh.

What a stupid thing to say Bruce.

1 Like

Thanks Pascal that’s fixed it ! You’re a legend. I’ll try and convert this to a new post so others can benefit. Nice work.

1 Like

In my experience working for International companies and smaller ones, ssh was and is the standard for securely logging into remote systems. Perhaps it is different in your environment.

Bruce, just stop talking please. Go find another topic to be the smartest and greatest.

1 Like

Please not … What is the benefit? Lower Security without Firewall and sudo rights for Openhab User?

Shutdown a Firewall has nothing to do with Home Automation …

The only stupid thing is your personal insult. Because I don’t think it makes sense to give the openhab user sudo rights and shut down a firewall from home automation, am I an idiot? I think you have to work on your critical faculties.

By the way: Anyone who has access to your myobenhab.org account can shut down your firewall and has all the options in your network, because luckily he has sudo rights with the openhab User … A small bug is enough and you are completely open ,

I don’t use myopenhab.org so I’m not concerned.