Re: Net::OpenSSH connection failing with 'muxserver_listen bind(): Not owner'

[Only1KW]

An update: I got frustrated with getting this working in AIX, and so instead moved to a Linux box (which is a less-optimal environment for me to work in for reasons I won't get into here) and reinstalled a newer version of Perl there. However, Net::OpenSSH ended up failing with almost an identical error! "muxserver_listen bind(): Operation not permitted".

Since this is a more common error, a Google search turned up more information. It turns out that, as salva guessed earlier, the unix socket could not be created under ~/.libnet-openssh-perl. However, the problem wasn't a permission one but, since my home directory is in AFS, AFS doesn't permit the creation of sockets.

So I'm now trying the following:

my $ssh = Net::OpenSSH->new('username@hostname', strict_mode => 0, ctl_dir => "/tmp/.libnet-openssh-perl");

...and this works! Of course, I'm running without strict mode, which is supposedly insecure (which I don't understand since if .libnet-openssh-perl prohibits others from writing to the directory, what good forcing all ancestors to also prohibit writing to their directory gains, but I'm not a security expert). But it's either that or not run Net::OpenSSH at all since the AFS directories exist (at least in part) so I don't need to be given write access to anywhere local on the box (besides /tmp, which gives write access to everyone).

[salva]

my home directory is in AFS, AFS doesn't permit the creation of sockets

That well deserves an entry on the troubleshooting guide, thank you for posting it back!

which I don't understand since if .libnet-openssh-perl prohibits others from writing to the directory, what good forcing all ancestors to also prohibit writing to their directory gains

For instance, it allows the owner of the upper directory to get Net::OpenSSH placing the mux socket in a file system under its control (for instance a NFS share from other machine where he is root and can change permisions at will), or a specially crafted FUSE-based file system.

Also, he could replace the mux socket by one under his control. That would allow him to see everything you send to the remote machine.

Anyway, I prefer to play on the safe side even if that means being a little paranoid!