Ssh HostbasedAuthentication - Revision history

Hutch: /* Allowing HostbasedAuthentication on the client system */

Hutch — Mon, 26 Jan 2009 22:32:29 GMT

Allowing HostbasedAuthentication on the client system

←Older revision		Revision as of 22:32, 26 January 2009
Line 65:		Line 65:
	== Allowing HostbasedAuthentication on the client system ==		== Allowing HostbasedAuthentication on the client system ==

-	~~Make sure that HostbasedAuthentication is allowed on the client system.~~ Even if it is properly enabled on the server, it may be denied ~~either explicitly or implicitly (i.e.,~~ the ~~default is "no") in '''/etc/ssh/ssh_config''' or '''~/.ssh/config'''~~.	+	Even if HostbasedAuthentication is properly enabled on the server, it may denied as a form of authentication on the client system.

	For example, on RHEL 5, HostbasedAuthentication is implicitly denied on clients, as the default is "no".		For example, on RHEL 5, HostbasedAuthentication is implicitly denied on clients, as the default is "no".

Hutch at 22:31, 26 January 2009

Hutch — Mon, 26 Jan 2009 22:31:10 GMT

←Older revision		Revision as of 22:31, 26 January 2009
Line 62:		Line 62:

	The system-wide '''/etc/rhosts.equiv''' or '''/etc/ssh/shosts.equiv''' files will not work with HostbasedAuthentication of the root user.		The system-wide '''/etc/rhosts.equiv''' or '''/etc/ssh/shosts.equiv''' files will not work with HostbasedAuthentication of the root user.
		+
		+	== Allowing HostbasedAuthentication on the client system ==
		+
		+	Make sure that HostbasedAuthentication is allowed on the client system. Even if it is properly enabled on the server, it may be denied either explicitly or implicitly (i.e., the default is "no") in '''/etc/ssh/ssh_config''' or '''~/.ssh/config'''.
		+
		+	For example, on RHEL 5, HostbasedAuthentication is implicitly denied on clients, as the default is "no".
		+
		+	To enable, modify the site-wide or user-specific ssh configuration file as appropriate.

	== Reverse DNS ==		== Reverse DNS ==

Hutch at 16:24, 14 July 2008

Hutch — Mon, 14 Jul 2008 16:24:53 GMT

←Older revision		Revision as of 16:24, 14 July 2008
Line 62:		Line 62:

	The system-wide '''/etc/rhosts.equiv''' or '''/etc/ssh/shosts.equiv''' files will not work with HostbasedAuthentication of the root user.		The system-wide '''/etc/rhosts.equiv''' or '''/etc/ssh/shosts.equiv''' files will not work with HostbasedAuthentication of the root user.
		+
		+	== Reverse DNS ==
		+
		+	By default (see ''HostbasedUsesNameFromPacketOnly'' above), OpenSSH will not trust the client's self-identifying hostname in the hostbased authentication request, and will perform a reverse DNS lookup of the IP address.
		+
		+	e.g., ''/var/log/auth.log''
		+	Jul 14 16:44:24 ''ssh_server'' sshd[10794]: userauth_hostbased mismatch: client sends host.example.com, but we resolve 192.216.212.193 to 192.216.212.193
		+
		+	In this case, I needed to add 193.212.216.192.in-addr.arpa to DNS.
		+
		+	* [http://www.snailbook.com/faq/trusted-host-howto.auto.html How do I get trusted-host (SSH-2 "hostbased", SSH-1 "RhostsRSA") authentication working?]

	== Miscellaneous notes ==		== Miscellaneous notes ==

Hutch: /* HostbasedAuthentication with the root user */

Hutch — Wed, 26 Mar 2008 15:05:36 GMT

HostbasedAuthentication with the root user

←Older revision		Revision as of 15:05, 26 March 2008
Line 58:		Line 58:

	If you want to use HostbasedAuthentication with the root user, you must:		If you want to use HostbasedAuthentication with the root user, you must:
-	* Place the fully-qualified domain name of the trusted system in '''~root/.shosts''' or '''~root/.rhosts'''	+	* Place the fully-qualified domain name of the trusted system in '''~root/.shosts''' or '''~root/.rhosts''' on the remote system.
	* Set '''IgnoreRhosts no''' in '''sshd_config''' on the remote system.		* Set '''IgnoreRhosts no''' in '''sshd_config''' on the remote system.

Hutch: /* HostbasedAuthentication with the root user */

Hutch — Wed, 26 Mar 2008 15:05:02 GMT

HostbasedAuthentication with the root user

←Older revision		Revision as of 15:05, 26 March 2008
Line 57:		Line 57:
	== HostbasedAuthentication with the root user ==		== HostbasedAuthentication with the root user ==

-	If you want to use HostbasedAuthentication with the root user, you ~~'''~~must''' ~~use the~~ .shosts or .rhosts ~~files~~. The system-wide /etc/rhosts.equiv or /etc/ssh/shosts.equiv will not work.	+	If you want to use HostbasedAuthentication with the root user, you must:
		+	* Place the fully-qualified domain name of the trusted system in '''~root/.shosts''' or '''~root/.rhosts'''
		+	* Set '''IgnoreRhosts no''' in '''sshd_config''' on the remote system.
		+
		+	The system-wide '''/etc/rhosts.equiv''' or '''/etc/ssh/shosts.equiv''' files will not work with HostbasedAuthentication of the root user.

	== Miscellaneous notes ==		== Miscellaneous notes ==

Hutch at 15:02, 26 March 2008

Hutch — Wed, 26 Mar 2008 15:02:14 GMT

←Older revision		Revision as of 15:02, 26 March 2008
Line 54:		Line 54:
	together with successful RSA host authentication is allowed. The		together with successful RSA host authentication is allowed. The
	default is “no”. This option applies to protocol version 1 only.		default is “no”. This option applies to protocol version 1 only.
		+
		+	== HostbasedAuthentication with the root user ==
		+
		+	If you want to use HostbasedAuthentication with the root user, you '''must''' use the .shosts or .rhosts files. The system-wide /etc/rhosts.equiv or /etc/ssh/shosts.equiv will not work.

	== Miscellaneous notes ==		== Miscellaneous notes ==

Hutch: /* Relevant ''sshd_config'' directives */

Hutch — Mon, 10 Mar 2008 21:10:52 GMT

Relevant ''sshd_config'' directives

←Older revision		Revision as of 21:10, 10 March 2008
Line 54:		Line 54:
	together with successful RSA host authentication is allowed. The		together with successful RSA host authentication is allowed. The
	default is “no”. This option applies to protocol version 1 only.		default is “no”. This option applies to protocol version 1 only.
-
-	* If you are only using '''Protocol 2''' (which you should be), the '''RhostsRSAAuthentication''' is not relevant, but it should be set to its default of "no" for "defense in depth" (in case

	== Miscellaneous notes ==		== Miscellaneous notes ==

Hutch at 21:10, 10 March 2008

Hutch — Mon, 10 Mar 2008 21:10:16 GMT

←Older revision		Revision as of 21:10, 10 March 2008
Line 64:		Line 64:
	debug1: Remote: Ignoring wild host/user names in ''$HOME''/.shosts.		debug1: Remote: Ignoring wild host/user names in ''$HOME''/.shosts.
	debug1: Remote: Ignoring wild host/user names in ''$HOME''/.rhosts.		debug1: Remote: Ignoring wild host/user names in ''$HOME''/.rhosts.
-
-	* The fully-qualified domain name of the trusted host '''must''' exist in the four files used in ''HostbasedAuthentication''.

Hutch: /* HostbasedAuthentication high-level overview */

Hutch — Mon, 10 Mar 2008 20:57:26 GMT

HostbasedAuthentication high-level overview

←Older revision		Revision as of 20:57, 10 March 2008
Line 57:		Line 57:
	* If you are only using '''Protocol 2''' (which you should be), the '''RhostsRSAAuthentication''' is not relevant, but it should be set to its default of "no" for "defense in depth" (in case		* If you are only using '''Protocol 2''' (which you should be), the '''RhostsRSAAuthentication''' is not relevant, but it should be set to its default of "no" for "defense in depth" (in case

-	== ~~HostbasedAuthentication high-level overview~~ ==	+	== Miscellaneous notes ==

	* If any of the four files used in ''HostbasedAuthentication'' contain a '''+''' in either the hostname(s) or user name(s), the line is ignored.		* If any of the four files used in ''HostbasedAuthentication'' contain a '''+''' in either the hostname(s) or user name(s), the line is ignored.
Line 64:		Line 64:
	debug1: Remote: Ignoring wild host/user names in ''$HOME''/.shosts.		debug1: Remote: Ignoring wild host/user names in ''$HOME''/.shosts.
	debug1: Remote: Ignoring wild host/user names in ''$HOME''/.rhosts.		debug1: Remote: Ignoring wild host/user names in ''$HOME''/.rhosts.
		+
		+	* The fully-qualified domain name of the trusted host '''must''' exist in the four files used in ''HostbasedAuthentication''.

Hutch: /* HostbasedAuthentication high-level overview */

Hutch — Mon, 10 Mar 2008 20:50:45 GMT

HostbasedAuthentication high-level overview

←Older revision		Revision as of 20:50, 10 March 2008
Line 59:		Line 59:
	== HostbasedAuthentication high-level overview ==		== HostbasedAuthentication high-level overview ==

-	* If any of the four files used in HostbasedAuthentication contain a + in either the hostname(s) or user name(s), the line is ignored.	+	* If any of the four files used in ''HostbasedAuthentication'' contain a '''+''' in either the hostname(s) or user name(s), the line is ignored.
	debug1: Remote: Ignoring wild host/user names in /etc/hosts.equiv.		debug1: Remote: Ignoring wild host/user names in /etc/hosts.equiv.
	debug1: Remote: Ignoring wild host/user names in /etc/ssh/shosts.equiv.		debug1: Remote: Ignoring wild host/user names in /etc/ssh/shosts.equiv.
	debug1: Remote: Ignoring wild host/user names in ''$HOME''/.shosts.		debug1: Remote: Ignoring wild host/user names in ''$HOME''/.shosts.
	debug1: Remote: Ignoring wild host/user names in ''$HOME''/.rhosts.		debug1: Remote: Ignoring wild host/user names in ''$HOME''/.rhosts.