sshd event id 0 and fatal errors Operation Not Permitted

8 posts / 0 new
Last post
Anonymous
sshd event id 0 and fatal errors Operation Not Permitted

I have 2 instances of CopSSH (4.4.3) and RSync(5.0.4) installed on Windows 2008(each server replicates to the other).  Both periodically fail with the same symptoms.  Logs on the Source Server (client) for RSYNC or simple ssh connections to the copssh server merely show "Connection closed by [destination server].

On the destination server (copssh and rsync server) I see Event ID 0 ("The description for Event ID 0 from source sshd cannot be found") in the windows eventlog.  In the copssh control panel log I see the connection from the source server ip and then "fatal: seteuid 10000: Operation not permitted"

I have re-installed both copssh and rsync server, and that temporarily fixes the problem.  However, within 1 to 10 days it repeats these failures.

itefix
Offline
Last seen: 14 hours 56 min ago
Joined: 01.05.2008 - 21:33
Any firewall/anti-virus

Any firewall/anti-virus software on your system ? Some Windows updates may also require a reinstall. Try to install the latest version of Copssh (4.5.0) from your customer page.

prattvd
Windows firewall is presently

Windows firewall is presently disabled.  McAffee is the anti-virus.  Are there known issues with McAffee?  I am checking on the possibility of upgrading to copssh 4.5.  Does 4.5 fix a known issue with this type of problem?

itefix
Offline
Last seen: 14 hours 56 min ago
Joined: 01.05.2008 - 21:33
Could be. Please check
Stax_Support
Offline
Last seen: 6 years 10 months ago
Joined: 06.03.2013 - 18:16
I was finally able to upgrade

I was finally able to upgrade to 4.5 several weeks ago.  It ran fine for several weeks, but is now failing again with the same Event ID 0 .... operation not permitted errors.  I can't reinstall Copssh every few weeks, are there any other soluctions?

sven.nosse
Offline
Last seen: 1 week 6 days ago
Joined: 07.11.2013 - 10:52
I have exactly the same issue

I have exactly the same issue here, I have a 2008R2 Machine and a Linux Box trying to do a rsync. When trying to connect to the windows machine via SSH I get

fatal: seteuid 10000: Operation not permitted

Same problem here, this is a production environment, so what to do?

CopSSH v2.2.0 (Basic)

cwRsync v5.1.0

 

any feedback is highly appreciated!

itefix
Offline
Last seen: 14 hours 56 min ago
Joined: 01.05.2008 - 21:33
Try to use SECHAW (Secure

Try to use SECHAW (Secure Channel Wizard) to create an external ssh tunnel instead of relying on the built-in ssh support in rsync.

Stax_Support
Offline
Last seen: 6 years 10 months ago
Joined: 06.03.2013 - 18:16
For the windows error I had,

For the windows error I had, the following worked (from support):
Setup program grants following user rights to the service account:

SeCreateTokenPrivilege
SeAssignPrimaryTokenPrivilege
SeIncreaseQuotaPrivilege
SeServiceLogonRight

In addition, for better security, following user rights for logon denial is activated:

SeDenyBatchLogonRight
SeDenyInteractiveLogonRight
SeDenyNetworkLogonRight

I hope that the service account is not in use for other purposes like being used as a login for ssh connections. If your service account is domain based, you may also double check if the rights above are activated properly. Please check also if there are some group policies limiting operations on your servers.