This package is on-board, either as default or unintentionally added by me.
Which commands shall I run to diagnose this issue?
Start with this:
Here is the result:
config dropbear
option PasswordAuth 'on'
option Port '22'
option Interface 'lan'
That looks normal.
How about the output of:
cat /etc/os-release
# cat /etc/os-release
NAME="OpenWrt"
VERSION="18.06.1"
ID="openwrt"
ID_LIKE="lede openwrt"
PRETTY_NAME="OpenWrt 18.06.1"
VERSION_ID="18.06.1"
HOME_URL="http://openwrt.org/"
BUG_URL="http://bugs.openwrt.org/"
SUPPORT_URL="http://forum.lede-project.org/"
BUILD_ID="r7258-5eb055306f"
LEDE_BOARD="ar71xx/generic"
LEDE_ARCH="mips_24kc"
LEDE_TAINTS=""
LEDE_DEVICE_MANUFACTURER="OpenWrt"
LEDE_DEVICE_MANUFACTURER_URL="http://openwrt.org/"
LEDE_DEVICE_PRODUCT="Generic" LEDE_DEVICE_REVISION="v0"
LEDE_RELEASE="OpenWrt 18.06.1 r7258-5eb055306f"
Ok... that tells us that you are on the latest (18.06.1) and presumably a normal build and image.
I'm out of ideas at the moment, but check that you have available space (if you've run out of space, maybe dropbear can't execute properly, just a guess)
df -h
Also check that there is a hashed password for root (should be a longish string of characters, recommended not to post this unless it is the same as the other entires in that file)
cat /etc/shadow
Just to bring up the reset option again...
It does seem that you are hesitant to reset the device to defaults. I don't know that it has been asked or answered in this thread, so I'll put it out there:
Other than standard router functions, do you rely on the device for any special services (say VPN or a telephone PBX, for example), or do you have other things installed (that you actually use) and/or configurations that would be hard to reproduce if you do perform a full reset? I ask this question because it will likely be faster and more successful if you just simply try the complete reset option.
Ideally, you would perform the reset and immediately test to see if the problem is resolved (the system will initially come up with no password, so both LuCI and ssh should allow login directly as root with no password). Then change the password and test that the password works for both LuCI and ssh. If either of these don't work, you may have problem with the base install and it would be recommended to re-flash OpenWRT again.
Once the ssh login is working with a fresh password, you should try to restore your backup and test again. If everything works properly, you can re-install any additional packages you need and continue to test (maybe there is a package that messed things up?). Or if everything worked up to this point, but now ssh logins fail again, either the additional packages or some configuration file(s) are responsible for the problem.
Your basic config files will be backed up via the standard backup command (via web/LuCI: System > Backup / Flash Firmware), and you can even add other files/paths to the backup in the configuration section of that feature. You can generate the list of installed applications (opkg list-installed), if desired, to make it easier to know which packages you want to reinstall later.
# df -h
Filesystem Size Used Available Use% Mounted on
/dev/root 2.5M 2.5M 0 100% /rom
tmpfs 61.2M 1.3M 59.9M 2% /tmp
/dev/mtdblock4 10.8M 3.1M 7.7M 29% /overlay
overlayfs:/overlay 10.8M 3.1M 7.7M 29% /
tmpfs 512.0K 0 512.0K 0% /dev
**# cat /etc/shadow**
root:$1$.twrdEuT$bpjcS88KCZk5e/fFXmnme0:17871:0:99999:7:::
daemon:*:0:0:99999:7:::
ftp:*:0:0:99999:7:::
network:*:0:0:99999:7:::
nobody:*:0:0:99999:7:::
dnsmasq:x:0:0:99999:7:::
sshd:x:0:0:99999:7:::
Yes, I'm hesitant to reset the device so soon. I configured static DNS, which can be restored later. I also tried to setup VPN, but it was not successful, because SSH is needed to achieve that properly.
Here is the list of installed packages:
adblock 3.5.5-3 ahcpd 0.53-2 ath10k-firmware-qca988x 2018-04-19-71e50312-1 base-files 192-r7258-5eb055306f busybox 1.28.3-4 dnsmasq 2.80test3-1 dropbear 2017.75-5 etherwake 1.09-4 firewall 2018-07-26-aa8846bb-1 fstools 2018-04-16-e2436836-1 fwtool 1 hd-idle 1.05-1 hostapd-common 2018-04-09-fa617ee6-5 ip-full 4.16.0-8 ip6tables 1.6.2-1 ipset 6.34-1 iptables 1.6.2-1 iptables-mod-conntrack-extra 1.6.2-1 iptables-mod-ipopt 1.6.2-1 iw 4.14-1 iwinfo 2018-07-24-94b1366d-1 jshn 2018-07-25-c83a84af-1 jsonfilter 2018-02-04-c7e938d6-1 kernel 4.9.120-1-adfb989aae1..8a3 kmod-ath 4.9.120+2017-11-01-9 kmod-ath10k 4.9.120+2017-11-01-9 kmod-ath9k 4.9.120+2017-11-01-9 kmod-ath9k-common 4.9.120+2017-11-01-9 kmod-cfg80211 4.9.120+2017-11-01-9 kmod-gpio-button-hotplug 4.9.120-2 kmod-ifb 4.9.120-1 kmod-ip6tables 4.9.120-1 kmod-ipt-conntrack 4.9.120-1 kmod-ipt-conntrack-extra 4.9.120-1 kmod-ipt-core 4.9.120-1 kmod-ipt-ipopt 4.9.120-1 kmod-ipt-ipset 4.9.120-1 kmod-ipt-nat 4.9.120-1 kmod-lib-crc-ccitt 4.9.120-1 kmod-mac80211 4.9.120+2017-11-01-9 kmod-nf-conntrack 4.9.120-1 kmod-nf-conntrack6 4.9.120-1 kmod-nf-ipt 4.9.120-1 kmod-nf-ipt6 4.9.120-1 kmod-nf-nat 4.9.120-1 kmod-nf-reject 4.9.120-1 kmod-nf-reject6 4.9.120-1 kmod-nfnetlink 4.9.120-1 kmod-ppp 4.9.120-1 kmod-pppoe 4.9.120-1 kmod-pppox 4.9.120-1 kmod-sched-connmark 4.9.120-1 kmod-sched-core 4.9.120-1 kmod-slhc 4.9.120-1 kmod-tun 4.9.120-1 libblobmsg-json 2018-07-25-c83a84af-1 libc 1.1.19-1 libgcc 7.3.0-1 libip4tc 1.6.2-1 libip6tc 1.6.2-1 libipset 6.34-1 libiwinfo 2018-07-24-94b1366d-1 libiwinfo-lua 2018-07-24-94b1366d-1 libjson-c 0.12.1-1 libjson-script 2018-07-25-c83a84af-1 liblua 5.1.5-1 liblucihttp 2018-05-18-cb119ded-1 liblucihttp-lua 2018-05-18-cb119ded-1 liblzo 2.10-1 libmnl 1.0.4-1 libncurses 6.1-1 libnl-tiny 0.1-5 libopenssl 1.0.2p-1 libpthread 1.1.19-1 librt 1.1.19-1 libubox 2018-07-25-c83a84af-1 libubus 2018-07-26-40e0931e-1 libubus-lua 2018-07-26-40e0931e-1 libuci 2018-08-11-4c8b4d6e-1 libuclient 2018-08-03-ae1c656f-1 libuuid 2.32-2 libxtables 1.6.2-1 logd 2018-02-14-128bc35f-2 lua 5.1.5-1 luci git-18.228.31946-f64b152-1 luci-app-ahcp git-18.329.26825-5e87083-1 luci-app-commands git-18.329.26825-5e87083-1 luci-app-diag-core git-18.329.26825-5e87083-1 luci-app-firewall git-18.228.31946-f64b152-1 luci-app-hd-idle git-18.329.26825-5e87083-1 luci-app-openvpn git-18.329.26825-5e87083-1 luci-app-qos git-18.329.26825-5e87083-1 luci-app-transmission git-18.329.26825-5e87083-1 luci-app-upnp git-18.329.26825-5e87083-1 luci-app-vpnbypass git-18.329.26825-5e87083-4 luci-app-wol git-18.329.26825-5e87083-1 luci-base git-18.228.31946-f64b152-1 luci-i18n-ahcp-tr git-18.329.26825-5e87083-1 luci-i18n-base-tr git-18.329.26825-5e87083-1 luci-i18n-commands-tr git-18.329.26825-5e87083-1 luci-i18n-diag-core-tr git-18.329.26825-5e87083-1 luci-i18n-firewall-tr git-18.329.26825-5e87083-1 luci-i18n-hd-idle-tr git-18.329.26825-5e87083-1 luci-i18n-openvpn-en git-18.329.26825-5e87083-1 luci-i18n-openvpn-tr git-18.329.26825-5e87083-1 luci-i18n-qos-tr git-18.329.26825-5e87083-1 luci-i18n-transmission-tr git-18.329.26825-5e87083-1 luci-i18n-upnp-tr git-18.329.26825-5e87083-1 luci-i18n-wol-tr git-18.329.26825-5e87083-1 luci-lib-ip git-18.228.31946-f64b152-1 luci-lib-jsonc git-18.228.31946-f64b152-1 luci-lib-nixio git-18.228.31946-f64b152-1 luci-mod-admin-full git-18.228.31946-f64b152-1 luci-proto-ipv6 git-18.228.31946-f64b152-1 luci-proto-ppp git-18.228.31946-f64b152-1 luci-theme-bootstrap git-18.228.31946-f64b152-1 miniupnpd 2.1-1 mtd 23 nano 3.2-1 netifd 2018-07-30-a0a1e52e-1 odhcp6c 2018-07-14-67ae6a71-14 odhcpd-ipv6only 1.10-1 openssh-keygen 7.7p1-1 openssh-server 7.7p1-1 openvpn-openssl 2.4.5-4 openwrt-keyring 2018-05-18-103a32e9-1 opkg 2017-12-07-3b417b9f-2 ppp 2.4.7-12 ppp-mod-pppoe 2.4.7-12 procd 2018-03-28-dfb68f85-1 qos-scripts 1.3.1-1 rpcd 2018-08-16-41333abe-1 rpcd-mod-rrdns 20170710 swconfig 11 tc 4.16.0-8 terminfo 6.1-1 uboot-envtools 2018.03-1 ubox 2018-02-14-128bc35f-2 ubus 2018-07-26-40e0931e-1 ubusd 2018-07-26-40e0931e-1 uci 2018-08-11-4c8b4d6e-1 uclient-fetch 2018-08-03-ae1c656f-1 uhttpd 2018-06-26-796d42bc-1 usign 2015-07-04-ef641914-1 vpnbypass 1.3.1-1 wireless-regdb 2017-10-20-4343d359 wpad-mini 2018-04-09-fa617ee6-5 zlib 1.2.11-2
As you can see, some packages are part of an trial-and-error and might be reduntant.
Additionally, here are my firewall configurations:
As a last resort, I would reset the device anyway.
Thank you...
hmmm...
I wonder if the issue is the last entry (sshd) in your /etc/shadow file.
Ideally you would want to remove that line, but I'm not exactly sure the best way to do that from the LuCI-app-commands environment (it would be trivial if you could ssh into the system, of course).
From what you showed, it doesn't look like there is much currently running that is not relatively close to the standard default system. Especially if you ran into a dead end trying to setup the VPN, you're best off starting again fresh (it is just easier to start from a known state and work from there).
Any basic config stuff (including hostnames, static dhcp, and dns settings and such) should be maintained in the backup that you can make from the LuCI ui (but be aware that restoring that config would likely also cause the problem to recur because of that shadow file, assuming my theory is correct).
Ok... so I've got an idea how you can remove the last line of the shadow file... this could bork things, though, so be prepared.
Do this in LuCI-app-commands (each line should be done separately):
cp /etc/shadow ~/shadow
sed '$ d' ~/shadow > /etc/shadow
Then check the shadow file again:
cat /etc/shadow
The output should be the same as what you listed before except that the last line (sshd) should be gone.
If that worked, try logging in via ssh.
Are you using dropbear or openssh as the ssh server??
Both seem to be installed.
Good point. I installed openssh as part of an trial-and-error. So, there could be a mistake...
The Startup status would give you the exact picture:
Would try your fix as soon as possible...
you should probably use the LuCI > System > Software > Installed packages page to REMOVE openssh if you aren't using it.
Again, this is more reason to start over again... you may have odd things going on in the background that you don't realize will cause other headaches.
Would that also fix that shadow error?
I added up above what is starting at boot.
Don't know.... but it will be interesting to find out.
Shall both of these packages be removed?
openssh-keygen
openssh-server