Re:ssh setup

Hello,


  I haven't read any of the docco you're looking at.

  I did, however, have all of this automated in tyd, but I don't remember 
how I did it.   Skimming through the code;

  [key negotiation info]

  1.  from the local node, take /etc/ssh/ssh_host_dsa_key.pub
        and /etc/ssh/ssh_host_rsa_key.pub and give them to
        any node who asks

  2.  take any-other-node's Public key files, and append them to;
        /etc/ssh/authorized_keys, as;
        "
        # chaos-<ip>
        from="<ip>",no-port-forwarding,no-X11-forwarding,no-agent-forwarding <rsa key>
        from="<ip>",no-port-forwarding,no-X11-forwarding,no-agent-forwarding <dsa key>
        "
        /root/.ssh/known_hosts, as;
        "
        # chaos-<ip>
        <ip> <rsa key>
        <ip> <dsa key>
        "

  If every node in your cluster did this, then root could move from any 
node to any node without security prompts.

 Then, skimming through the file system;


  [sshd configuration]

  Here are the most important bits from /etc/ssh/sshd_config;

  1. Only use Protocol 2 - anything less can be intercepted and
      decrypted with publically available tools;

       # Listener config
       Port 22
       Protocol 2
       ListenAddress 0.0.0.0


  2.  Make sure you know where your key files are;

       # HostKeys for protocol version 2
       HostKey /etc/ssh/ssh_host_rsa_key
       HostKey /etc/ssh/ssh_host_dsa_key


  3.  You'll need to let Root in for some of the services you
       wish to automate (which isn't good security) and you
       want strictmodes on to ensure that you don't make things
       worse by being sloppy;

       # Client entry options
       LoginGraceTime 20
       PermitRootLogin yes
       StrictModes yes


  4.  Allow the needed Key authentication and password
       authentication, but drop the rest;

       # Key auth options
       RSAAuthentication yes
       PubkeyAuthentication yes
       AuthorizedKeysFile      /etc/ssh/authorized_keys

       # Rhosts options
       RhostsRSAAuthentication no
       HostbasedAuthentication no
       IgnoreUserKnownHosts yes
       IgnoreRhosts yes

       # Password options
       PasswordAuthentication yes

       # S/key options
       ChallengeResponseAuthentication no

       # Kerberos options
       # KerberosAuthentication no

       # GSSAPI options
       # GSSAPIAuthentication no

       # PAM options
       # UsePAM no


  5.  Some of the cute features I used were (note that Priv
       Separation will require the ssh account configured);

       # Client options
       TCPKeepAlive yes
       UseLogin no
       UsePrivilegeSeparation yes
       PermitUserEnvironment yes

       # Useful features
       Compression yes


  6.  All of CHAOS' authentication was done by IP address, as there
       was no guarantee that hostnames would be public.  Disabling DNS
       should also improve performance for nodes without DNS access
       - as well as actually letting hosts in that don't have matching forward
       and reverse addresses, etc;

       # Daemon options
       UseDNS no
       ClientAliveInterval 0
       ClientAliveCountMax 3
       MaxStartups 10:30:60



  Getting all of this right (including the server config, they keys and the
population of trust builders such as the global authorized_keys file and 
root's known_hosts file) will give you a trusted root SSH mesh.





----- Original Message -----
>From: "Andres De Carlo" <[email protected]>
>To: <openmosix-general-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org>
>Subject:  [openMosix-general] ssh setup
>Date: Fri, 03 Mar 2006 14:58:43 -0800
>
> Thanks in advance. I have been trying to set up a cluster and I have been
> having problems setting up the ssh and I have followed all the documentation
> in openmosixview+ssh page  and the short way still doesn't work and the long
> way either. I have followed perfectly the instructions and nothing still was
> getting prompt for the password and not the passphrase. I have modify the
> files like it said in the documentation and nothing, I have installed fedora
> core 1 and the version of rsh that comes with it. I have also read the ssh
> config page from http://www-128.ibm.com/developerworks/library/l-keyc.html
> Daniel Robins and I wasn't able to make it work either, like the way he
> explains in the site, any ideas if could be my version of ssh that I have
> installed or other trick that I might be missing. 
> 
>  
> 
> Thanks a lot.
> 
>  
> 
> 


--
Ian Latter
Late night coder ..
http://midnightcode.org/



-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642