Doing [cmd]K and locating the server through browsing or by IP address.
It talks to the server it just doesn’t authenticate – you get a “Unknown user, incorrect password, or not authorized to login” message.

Right now I’m sorting through the PAM docs trying to figure that out. It seems to me that 10.2 is either supplying credentials in the wrong format or 10.4 is misinterpreting what is sent – maybe in PAM rules (?).

I deleted mcx_cache on the client machines that had it but that doesn’t seem to make a difference. On the 10.2 machine console you see the afp kexts load but it makes no difference. I’ve been upgrading the 102 machines as I find them but I’d rather solve the issue.

=Tod

I tried turning off AFP and didn’t work, tried restarting after turning it off and that didn’t work. I did TCPDUMPs and sent them to you via messaging off-line.

Basically they look the same except after about 12 back and forth communications the 10.2 client starts an SSH attempt and sends 7 messages on-one to the server and then stops where the successful negotiation transfers two “S” messages and then starts a session.

Why would the 10.2 client be falling into an SSH attempt? The “connect SSH” choice in the options dialogue is off. (Actually I’ve tried it both ways.) I have seen the “ssh timed out” message I mentioned earlier and I’ve tried connection with the firewall off but that didn’t help either. (I have SSH firewalled off but not SACLed.)

Thanks for all your help,

=Tod

Partial resolution: If you turn firewall AND ssh service off 10.2 clients can authenticate against server. Clients are trying to create an ssh tunnel before authenticating and during their waited for ssh to fail their auth window times out on the server. By getting them an abject failure response quickly (no ssh running, no firewall interfering) they can proceed quickly enough.

Apple claims only clients that previously were required to ssh exhibit this behavior, but I’ve seen it in all my 10.2 attempts. Besides is a fresh 10.2 install in anyone’s interest at this point???

I’m going to try SACLing off clients and opening the ssh port on the firewall to the few 10.2 machines I have – hopefully this will allow 10.2 clients to get the rejection they so desire and allow me to run ssh on that box at the same time.

I’ll post back with results.

=Tod