[rancid] ExtremeXOS clogin problems

Adam Korab

unread,

Sep 7, 2011, 4:26:44 PM9/7/11

to Rancid Mailing List

rancid 2.3.6, XOS 12.5.2.6 on a SummitStack X460-24t

clogin appears to send the username twice. The (dirt simple) .cloginrc bit:

add user {admin}
add password * {foo}
add method ssh telnet
add noenable * 1

Here's the clogin output and the dsniff scrape of the telnet passwords:

[rancid@lachesis ~]$ clogin 10.3.255.1
10.3.255.1
spawn ssh -c 3des -x -l admin 10.3.255.1
ssh: connect to host 10.3.255.1 port 22: Connection refused
spawn telnet 10.3.255.1
Trying 10.3.255.1...
Connected to 10.3.255.1 (10.3.255.1).
Escape character is '^]'.

telnet session telnet1 on /dev/ptyb1

login: admin
password:

Login incorrect

login: foo
password:

Login incorrect

login: foo
password:

Login incorrect
Maximum number of login attempts reached!
Connection closed by foreign host.

Error: Connection closed (telnet): 10.3.255.1

**********************************
dsniff:

-----------------
09/07/11 15:23:31 tcp 10.1.1.99.59654 -> 10.3.255.1.23 (telnet)
admin
admin
foo
admin
foo
admin
_______________________________________________
Rancid-discuss mailing list
Rancid-...@shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

john heasley

unread,

Sep 7, 2011, 4:35:58 PM9/7/11

to Adam Korab, Rancid Mailing List

Wed, Sep 07, 2011 at 03:26:44PM -0500, Adam Korab:

> rancid 2.3.6, XOS 12.5.2.6 on a SummitStack X460-24t
>
> clogin appears to send the username twice. The (dirt simple) .cloginrc bit:
>
> add user {admin}
> add password * {foo}
> add method ssh telnet
> add noenable * 1
>
> Here's the clogin output and the dsniff scrape of the telnet passwords:

looks rather weird.

clogin -d host > op 2&>1

figure out what it actually sending in response to password.

Adam Korab

unread,

Sep 7, 2011, 4:52:46 PM9/7/11

to john heasley, Rancid Mailing List

On Wed, Sep 7, 2011 at 3:35 PM, john heasley <he...@shrubbery.net> wrote:
>
> looks rather weird.
>
> clogin -d host > op 2&>1
>
> figure out what it actually sending in response to password.

Interestingly enough, putting the username in add password and vice
versa actually works and clogin succeeds...after sending the "add
password" string twice, that is.

[rancid@lachesis ~]$ clogin -d 10.3.255.1

10.3.255.1
spawn ssh -c 3des -x -l admin 10.3.255.1

parent: waiting for sync byte
parent: telling child to go ahead
parent: now unsynchronized from child
spawn: returns {17702}

expect: does "" (spawn_id exp6) match regular expression "(Connection
refused|Secure connection [^\n
\r]+ refused)"? no
"(Connection closed by|Connection to [^\n\r]+ closed)"? no

expect: does "" (spawn_id exp6) match glob pattern "unknown host\r"? no

expect: does "" (spawn_id exp6) match glob pattern "Host is unreachable"? no
"No address associated with name"? no
"(Host key not found |The authenticity of host .* be
established).*(yes/no)?"? no
"HOST IDENTIFICATION HAS CHANGED.* (yes/no)?"? no
"Offending key for .* (yes/no)?"? no
"(denied|Sorry)"? no
"Login failed"? no
"% (Bad passwords|Authentication failed)"? no
"Press any key to continue"? no
"Enter Selection: "? no
"Last login:"? no
"@[^\r\n]+ ([Pp]assword|passwd|Enter password for [^ :]+):"? no
"Enter passphrase.*: "? no
"(Username|Login|login|user name|User):"? no
"([Pp]assword|passwd|Enter password for [^ :]+):"? no
"(>|#| $enable$)"? no
"Login invalid"? no

ssh: connect to host 10.3.255.1 port 22: Connection refused

expect: does "ssh: connect to host 10.3.255.1 port 22: Connection
refused\r\r \n" (spawn_id
exp6) match regular expression "(Connection refused|Secure connection
[^\n\r]+ refused )"? yes
expect: set expect_out(0,string) "Connection refused"
expect: set expect_out(1,string) "Connection refused"
expect: set expect_out(spawn_id) "exp6"
expect: set expect_out(buffer) "ssh: connect to host 10.3.255.1 port

22: Conn ection refused"
spawn telnet 10.3.255.1

parent: waiting for sync byte
parent: telling child to go ahead
parent: now unsynchronized from child
spawn: returns {17705}

expect: does "" (spawn_id exp6) match regular expression "(Connection
refused|Secure connection [^\n
\r]+ refused)"? no
"(Connection closed by|Connection to [^\n\r]+ closed)"? no

expect: does "" (spawn_id exp6) match glob pattern "unknown host\r"? no

expect: does "" (spawn_id exp6) match glob pattern "Host is unreachable"? no
"No address associated with name"? no
"(Host key not found |The authenticity of host .* be
established).*(yes/no)?"? no
"HOST IDENTIFICATION HAS CHANGED.* (yes/no)?"? no
"Offending key for .* (yes/no)?"? no
"(denied|Sorry)"? no
"Login failed"? no
"% (Bad passwords|Authentication failed)"? no
"Press any key to continue"? no
"Enter Selection: "? no
"Last login:"? no
"@[^\r\n]+ ([Pp]assword|passwd|Enter password for [^ :]+):"? no
"Enter passphrase.*: "? no
"(Username|Login|login|user name|User):"? no
"([Pp]assword|passwd|Enter password for [^ :]+):"? no
"(>|#| $enable$)"? no
"Login invalid"? no

Trying 10.3.255.1...
Connected to 10.3.255.1 (10.3.255.1).
Escape character is '^]'.

expect: does "Trying 10.3.255.1...\r\r\nConnected to 10.3.255.1
(10.3.255.1).
\r\r\nEscape character is '^]'.\r\r\n" (spawn_id exp6) match regular
expression "(Connection refused
|Secure connection [^\n\r]+ refused)"? no
"(Connection closed by|Connection to [^\n\r]+ closed)"? no

expect: does "Trying 10.3.255.1...\r\r\nConnected to 10.3.255.1
(10.3.255.1).
\r\r\nEscape character is '^]'.\r\r\n" (spawn_id exp6) match glob
pattern "unknown host\r"? no

expect: does "Trying 10.3.255.1...\r\r\nConnected to 10.3.255.1
(10.3.255.1).
\r\r\nEscape character is '^]'.\r\r\n" (spawn_id exp6) match glob
pattern "Host is unreachable"? no
"No address associated with name"? no
"(Host key not found |The authenticity of host .* be
established).*(yes/no)?"? no
"HOST IDENTIFICATION HAS CHANGED.* (yes/no)?"? no
"Offending key for .* (yes/no)?"? no
"(denied|Sorry)"? no
"Login failed"? no
"% (Bad passwords|Authentication failed)"? no
"Press any key to continue"? no
"Enter Selection: "? no
"Last login:"? no
"@[^\r\n]+ ([Pp]assword|passwd|Enter password for [^ :]+):"? no
"Enter passphrase.*: "? no
"(Username|Login|login|user name|User):"? no
"([Pp]assword|passwd|Enter password for [^ :]+):"? no
"(>|#| $enable$)"? no
"Login invalid"? no

telnet session telnet0 on /dev/ptyb0

login:
expect: does "Trying 10.3.255.1...\r\r\nConnected to 10.3.255.1
(10.3.255.1).
\r\r\nEscape character is '^]'.\r\r\n\r\ntelnet session telnet0 on
/dev/ptyb0\r\n\r\n\r\nlogin: " (s
pawn_id exp6) match regular expression "(Connection
refused|Secure connection [^\n\r]+ refused)"? no
"(Connection closed by|Connection to [^\n\r]+ closed)"? no

expect: does "Trying 10.3.255.1...\r\r\nConnected to 10.3.255.1
(10.3.255.1).
\r\r\nEscape character is '^]'.\r\r\n\r\ntelnet session telnet0 on
/dev/ptyb0\r\n\r\n\r\nlogin: " (s
pawn_id exp6) match glob pattern "unknown host\r"? no

expect: does "Trying 10.3.255.1...\r\r\nConnected to 10.3.255.1
(10.3.255.1).
\r\r\nEscape character is '^]'.\r\r\n\r\ntelnet session telnet0 on
/dev/ptyb0\r\n\r\n\r\nlogin: " (s
pawn_id exp6) match glob pattern "Host is unreachable"? no
"No address associated with name"? no
"(Host key not found |The authenticity of host .* be
established).*(yes/no)?"? no
"HOST IDENTIFICATION HAS CHANGED.* (yes/no)?"? no
"Offending key for .* (yes/no)?"? no
"(denied|Sorry)"? no
"Login failed"? no
"% (Bad passwords|Authentication failed)"? no
"Press any key to continue"? no
"Enter Selection: "? no
"Last login:"? no
"@[^\r\n]+ ([Pp]assword|passwd|Enter password for [^ :]+):"? no
"Enter passphrase.*: "? no
"(Username|Login|login|user name|User):"? yes
expect: set expect_out(0,string) "login:"
expect: set expect_out(1,string) "login"
expect: set expect_out(spawn_id) "exp6"
expect: set expect_out(buffer) "Trying 10.3.255.1...\r\r\nConnected to
ch-cr-core1.ci.grand-island.n
e.us (10.3.255.1).\r\r\nEscape character is '^]'.\r\r\n\r\ntelnet
session telnet0 on /dev/ptyb0\r\n\
r\n\r\nlogin:"
send: sending "admin\r" to { exp6 }
expect: continuing expect

expect: does " " (spawn_id exp6) match regular expression "(Connection
refused|Secure connection [^\
n\r]+ refused)"? no
"(Connection closed by|Connection to [^\n\r]+ closed)"? no

expect: does " " (spawn_id exp6) match glob pattern "unknown host\r"? no

expect: does " " (spawn_id exp6) match glob pattern "Host is unreachable"? no
"No address associated with name"? no
"(Host key not found |The authenticity of host .* be
established).*(yes/no)?"? no
"HOST IDENTIFICATION HAS CHANGED.* (yes/no)?"? no
"Offending key for .* (yes/no)?"? no
"(denied|Sorry)"? no
"Login failed"? no
"% (Bad passwords|Authentication failed)"? no
"Press any key to continue"? no
"Enter Selection: "? no
"Last login:"? no
"@[^\r\n]+ ([Pp]assword|passwd|Enter password for [^ :]+):"? no
"Enter passphrase.*: "? no
"(Username|Login|login|user name|User):"? no
"([Pp]assword|passwd|Enter password for [^ :]+):"? no
"(>|#| $enable$)"? no
"Login invalid"? no
login: admin
password:
expect: does " \r\u001b[Klogin: admin\r\n\rpassword: " (spawn_id exp6)
match regular expression "(Co
nnection refused|Secure connection [^\n\r]+ refused)"? no
"(Connection closed by|Connection to [^\n\r]+ closed)"? no

expect: does " \r\u001b[Klogin: admin\r\n\rpassword: " (spawn_id exp6)
match glob pattern "unknown h
ost\r"? no

expect: does " \r\u001b[Klogin: admin\r\n\rpassword: " (spawn_id exp6)
match glob pattern "Host is u
nreachable"? no
"No address associated with name"? no
"(Host key not found |The authenticity of host .* be
established).*(yes/no)?"? no
"HOST IDENTIFICATION HAS CHANGED.* (yes/no)?"? no
"Offending key for .* (yes/no)?"? no
"(denied|Sorry)"? no
"Login failed"? no
"% (Bad passwords|Authentication failed)"? no
"Press any key to continue"? no
"Enter Selection: "? no
"Last login:"? no
"@[^\r\n]+ ([Pp]assword|passwd|Enter password for [^ :]+):"? no
"Enter passphrase.*: "? no
"(Username|Login|login|user name|User):"? yes
expect: set expect_out(0,string) "login:"
expect: set expect_out(1,string) "login"
expect: set expect_out(spawn_id) "exp6"
expect: set expect_out(buffer) " \r\u001b[Klogin:"
send: sending "admin\r" to { exp6 }
expect: continuing expect

expect: does " admin\r\n\rpassword: " (spawn_id exp6) match regular
expression "(Connection refused|
Secure connection [^\n\r]+ refused)"? no
"(Connection closed by|Connection to [^\n\r]+ closed)"? no

expect: does " admin\r\n\rpassword: " (spawn_id exp6) match glob
pattern "unknown host\r"? no

expect: does " admin\r\n\rpassword: " (spawn_id exp6) match glob
pattern "Host is unreachable"? no
"No address associated with name"? no
"(Host key not found |The authenticity of host .* be
established).*(yes/no)?"? no
"HOST IDENTIFICATION HAS CHANGED.* (yes/no)?"? no
"Offending key for .* (yes/no)?"? no
"(denied|Sorry)"? no
"Login failed"? no
"% (Bad passwords|Authentication failed)"? no
"Press any key to continue"? no
"Enter Selection: "? no
"Last login:"? no
"@[^\r\n]+ ([Pp]assword|passwd|Enter password for [^ :]+):"? no
"Enter passphrase.*: "? no
"(Username|Login|login|user name|User):"? no
"([Pp]assword|passwd|Enter password for [^ :]+):"? yes
expect: set expect_out(0,string) "password:"
expect: set expect_out(1,string) "password"
expect: set expect_out(spawn_id) "exp6"
expect: set expect_out(buffer) " admin\r\n\rpassword:"
send: sending "foo\r" to { exp6 }
expect: continuing expect

expect: does " " (spawn_id exp6) match regular expression "(Connection
refused|Secure connection [^\
n\r]+ refused)"? no
"(Connection closed by|Connection to [^\n\r]+ closed)"? no

expect: does " " (spawn_id exp6) match glob pattern "unknown host\r"? no

expect: does " " (spawn_id exp6) match glob pattern "Host is unreachable"? no
"No address associated with name"? no
"(Host key not found |The authenticity of host .* be
established).*(yes/no)?"? no
"HOST IDENTIFICATION HAS CHANGED.* (yes/no)?"? no
"Offending key for .* (yes/no)?"? no
"(denied|Sorry)"? no
"Login failed"? no
"% (Bad passwords|Authentication failed)"? no
"Press any key to continue"? no
"Enter Selection: "? no
"Last login:"? no
"@[^\r\n]+ ([Pp]assword|passwd|Enter password for [^ :]+):"? no
"Enter passphrase.*: "? no
"(Username|Login|login|user name|User):"? no
"([Pp]assword|passwd|Enter password for [^ :]+):"? no
"(>|#| $enable$)"? no
"Login invalid"? no

Login incorrect

login:
expect: does " \r\n\r\r\n\rLogin incorrect\r\n\r\nlogin: " (spawn_id
exp6) match regular expression
"(Connection refused|Secure connection [^\n\r]+ refused)"? no
"(Connection closed by|Connection to [^\n\r]+ closed)"? no

expect: does " \r\n\r\r\n\rLogin incorrect\r\n\r\nlogin: " (spawn_id
exp6) match glob pattern "unkno
wn host\r"? no

expect: does " \r\n\r\r\n\rLogin incorrect\r\n\r\nlogin: " (spawn_id
exp6) match glob pattern "Host
is unreachable"? no
"No address associated with name"? no
"(Host key not found |The authenticity of host .* be
established).*(yes/no)?"? no
"HOST IDENTIFICATION HAS CHANGED.* (yes/no)?"? no
"Offending key for .* (yes/no)?"? no
"(denied|Sorry)"? no
"Login failed"? no
"% (Bad passwords|Authentication failed)"? no
"Press any key to continue"? no
"Enter Selection: "? no
"Last login:"? no
"@[^\r\n]+ ([Pp]assword|passwd|Enter password for [^ :]+):"? no
"Enter passphrase.*: "? no
"(Username|Login|login|user name|User):"? yes
expect: set expect_out(0,string) "login:"
expect: set expect_out(1,string) "login"
expect: set expect_out(spawn_id) "exp6"
expect: set expect_out(buffer) " \r\n\r\r\n\rLogin incorrect\r\n\r\nlogin:"
send: sending "admin\r" to { exp6 }
expect: continuing expect

expect: does " " (spawn_id exp6) match regular expression "(Connection
refused|Secure connection [^\
n\r]+ refused)"? no
"(Connection closed by|Connection to [^\n\r]+ closed)"? no

expect: does " " (spawn_id exp6) match glob pattern "unknown host\r"? no

expect: does " " (spawn_id exp6) match glob pattern "Host is unreachable"? no
"No address associated with name"? no
"(Host key not found |The authenticity of host .* be
established).*(yes/no)?"? no
"HOST IDENTIFICATION HAS CHANGED.* (yes/no)?"? no
"Offending key for .* (yes/no)?"? no
"(denied|Sorry)"? no
"Login failed"? no
"% (Bad passwords|Authentication failed)"? no
"Press any key to continue"? no
"Enter Selection: "? no
"Last login:"? no
"@[^\r\n]+ ([Pp]assword|passwd|Enter password for [^ :]+):"? no
"Enter passphrase.*: "? no
"(Username|Login|login|user name|User):"? no
"([Pp]assword|passwd|Enter password for [^ :]+):"? no
"(>|#| $enable$)"? no
"Login invalid"? no
foo

expect: does " foo\r\n\r" (spawn_id exp6) match regular expression
"(Connection refused|Secure c
onnection [^\n\r]+ refused)"? no
"(Connection closed by|Connection to [^\n\r]+ closed)"? no

expect: does " foo\r\n\r" (spawn_id exp6) match glob pattern "unknown
host\r"? no

expect: does " foo\r\n\r" (spawn_id exp6) match glob pattern "Host is
unreachable"? no
"No address associated with name"? no
"(Host key not found |The authenticity of host .* be
established).*(yes/no)?"? no
"HOST IDENTIFICATION HAS CHANGED.* (yes/no)?"? no
"Offending key for .* (yes/no)?"? no
"(denied|Sorry)"? no
"Login failed"? no
"% (Bad passwords|Authentication failed)"? no
"Press any key to continue"? no
"Enter Selection: "? no
"Last login:"? no
"@[^\r\n]+ ([Pp]assword|passwd|Enter password for [^ :]+):"? no
"Enter passphrase.*: "? no
"(Username|Login|login|user name|User):"? no
"([Pp]assword|passwd|Enter password for [^ :]+):"? no
"(>|#| $enable$)"? no
"Login invalid"? no
password:
expect: does " foo\r\n\rpassword: " (spawn_id exp6) match regular
expression "(Connection refuse
d|Secure connection [^\n\r]+ refused)"? no
"(Connection closed by|Connection to [^\n\r]+ closed)"? no

expect: does " foo\r\n\rpassword: " (spawn_id exp6) match glob pattern
"unknown host\r"? no

expect: does " foo\r\n\rpassword: " (spawn_id exp6) match glob pattern
"Host is unreachable"? no
"No address associated with name"? no
"(Host key not found |The authenticity of host .* be
established).*(yes/no)?"? no
"HOST IDENTIFICATION HAS CHANGED.* (yes/no)?"? no
"Offending key for .* (yes/no)?"? no
"(denied|Sorry)"? no
"Login failed"? no
"% (Bad passwords|Authentication failed)"? no
"Press any key to continue"? no
"Enter Selection: "? no
"Last login:"? no
"@[^\r\n]+ ([Pp]assword|passwd|Enter password for [^ :]+):"? no
"Enter passphrase.*: "? no
"(Username|Login|login|user name|User):"? no
"([Pp]assword|passwd|Enter password for [^ :]+):"? yes
expect: set expect_out(0,string) "password:"
expect: set expect_out(1,string) "password"
expect: set expect_out(spawn_id) "exp6"
expect: set expect_out(buffer) " foo\r\n\rpassword:"
send: sending "foo\r" to { exp6 }
expect: continuing expect