Re: problem with HostbasedAuthentication

Can you explain exactly which file I should edit? What is FQDN? By 'hostnam=
e', Do you mean server hostname of client hostname. =0AShould I do that on =
both side or server side?...=0A=0A// Naderan *Mahmood;=0A=0A=0A----- Origin=
al Message -----=0AFrom: Sharad <[email protected]>=0ATo: Mahmood Nadera=
n <[email protected]>; Asif Iqbal <[email protected]>=0ACc: "secureshell@=
securityfocus.com" <[email protected]>=0ASent: Thursday, April =
28, 2011 1:16 PM=0ASubject: Re: problem with HostbasedAuthentication=0A=0AS=
ometimes the issue lies with hostname as well. What I mean with that is the=
 known_hosts may have just the host name where as when the connection is es=
tablished, the debug shows the FQDN. I faced this issue so to be sure, I ed=
ited the known_hosts file and inserted the hostname, hostname's FQDN and it=
's IP address (all comma separated).=0A=0AAlso ensure that you both the hos=
ts' known_hosts files have opposite servers names (as prescribed above). =
=0A=0AAll the above checks makes it work for me.=0A=0AHope this solves.=0A=
=0AKind regards,=0ASharad=0A--- On Thu, 28/4/11, Asif Iqbal <[email protected]=
om> wrote:=0A=0A> From: Asif Iqbal <[email protected]>=0A> Subject: Re: prob=
lem with HostbasedAuthentication=0A> To: "Mahmood Naderan" <nt_mahmood@yaho=
o.com>=0A> Cc: "[email protected]" <[email protected]=
om>=0A> Date: Thursday, 28 April, 2011, 12:38 AM=0A> On Wed, Apr 27, 2011 a=
t 1:12 AM,=0A> Mahmood Naderan <[email protected]>=0A> wrote:=0A> >>Chan=
ge the order method. Have hostbased before=0A> password=0A> >=0A> > Sorry w=
here should I do that?=0A> =0A> man ssh_config and look into PreferredAuthe=
ntications=0A> =0A> >=0A> > // Naderan *Mahmood;=0A> >=0A> > From: Asif Iqb=
al <[email protected]>=0A> > To: Mahmood Naderan <[email protected]>=0A> =
> Cc: "[email protected]"=0A> <[email protected]>=
=0A> > Sent: Wednesday, April 27, 2011 9:17 AM=0A> > Subject: Re: problem w=
ith HostbasedAuthentication=0A> >=0A> >=0A> > Change the order method. Have=
 hostbased before=0A> password=0A> > On Apr 26, 2011 11:52 PM, "Mahmood Nad=
eran" <[email protected]>=0A> wrote:=0A> >>=0A> >>=0A> >> Hi,=0A> >> I a=
m trying to setup a hostbased passwrodless ssh=0A> from a client to a serve=
r using this guide http://www.ehow.com/how_7621307_set-up-hostbased-authent=
ication.html.=0A> >>=0A> >> The client looks like:=0A> >>=0A> >> mahmood@cl=
ient:~$ cat /etc/ssh/ssh_config=A0 | grep=0A> "HostbasedAuthentication"=0A>=
 >> =A0=A0 HostbasedAuthentication yes=0A> >> mahmood@client:~$ cat /etc/ss=
h/ssh_config=A0 | grep=0A> "EnableSSHKeysign"=0A> >> =A0=A0 EnableSSHKeysig=
n yes=0A> >>=0A> >>=0A> >> and the server looks like:=0A> >> mahmood@server=
:~$ cat /etc/ssh/sshd_config=A0 |=0A> grep "HostbasedAuthentication"=0A> >>=
 HostbasedAuthentication yes=0A> >> mahmood@server:~$ cat /etc/ssh/sshd_con=
fig=A0 |=0A> grep "IgnoreRhosts"=0A> >> IgnoreRhosts no=0A> >>=0A> >> also =
the server has the key for client:=0A> >>=0A> >> mahmood@server:~$ cat /etc=
/ssh/ssh_known_hosts=0A> >> client ssh-rsa AAAAB3Nz.....=0A> >>=0A> >> the =
~/.shosts file on the server contains:=0A> >> mahmood@server:~$ cat .shosts=
=0A> >> client.domain mahmood=0A> >>=0A> >> Then on both server and client,=
 the ssh service is=0A> restarted:=0A> >> mahmood@client:~$ sudo service ss=
h restart=0A> >> ssh start/running, process 1355=0A> >> mahmood@server:~$ s=
udo service ssh restart=0A> >> ssh start/running, process 28982=0A> >>=0A> =
>> How, when I run "ssh -vvv server" from client (to=0A> show the verbose m=
essages), I still get the password=0A> prompt.=0A> >>=0A> >> mahmood@client=
:~$ ssh -vvv server=0A> >> OpenSSH_5.3p1 Debian-3ubuntu6, OpenSSL 0.9.8k 25=
=0A> Mar 2009=0A> >> debug1: Reading configuration data=0A> /etc/ssh/ssh_co=
nfig=0A> >> debug1: Applying options for *=0A> >> debug2: ssh_connect: need=
priv 0=0A> >> debug1: Connecting to server [192.168.1.1] port=0A> 22.=0A> >=
> debug1: Connection established.=0A> >> debug1: identity file /home/mahmoo=
d/.ssh/identity=0A> type -1=0A> >> debug1: identity file /home/mahmood/.ssh=
/id_rsa=0A> type -1=0A> >> debug1: identity file /home/mahmood/.ssh/id_dsa=
=0A> type -1=0A> >> debug1: Remote protocol version 2.0, remote=0A> softwar=
e version OpenSSH_5.3p1 Debian-3ubuntu4=0A> >> debug1: match: OpenSSH_5.3p1=
 Debian-3ubuntu4 pat=0A> OpenSSH*=0A> >> debug1: Enabling compatibility mod=
e for protocol=0A> 2.0=0A> >> debug1: Local version string SSH-2.0-OpenSSH_=
5.3p1=0A> Debian-3ubuntu6=0A> >> debug2: fd 3 setting O_NONBLOCK=0A> >> deb=
ug1: SSH2_MSG_KEXINIT sent=0A> >> debug3: Wrote 792 bytes for a total of 83=
1=0A> >> debug1: SSH2_MSG_KEXINIT received=0A> >> debug2: kex_parse_kexinit=
:=0A> diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sh=
a1,diffie-hellman-group14-sha1,diffie-hellman-=0A> >> group1-sha1=0A> >> de=
bug2: kex_parse_kexinit: ssh-rsa,ssh-dss=0A> >> debug2: kex_parse_kexinit:=
=0A> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des=
-cbc,blowfish-cbc,cast128-cbc,aes192-=0A> >> cbc,aes256-cbc,arcfour,rijndae=
[email protected]=0A> >> debug2: kex_parse_kexinit:=0A> aes128-ctr,aes19=
2-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cas=
t128-cbc,aes192-=0A> >> cbc,aes256-cbc,arcfour,[email protected]=
=0A> >> debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],h=
mac-ripemd160,[email protected],hmac-sha1-96,hmac-=0A> >> md5-96=
=0A> >> debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],h=
mac-ripemd160,[email protected],hmac-sha1-96,hmac-=0A> >> md5-96=
=0A> >> debug2: kex_parse_kexinit: none,[email protected],zlib=0A> >> debug2=
: kex_parse_kexinit: none,[email protected],zlib=0A> >> debug2: kex_parse_ke=
xinit:=0A> >> debug2: kex_parse_kexinit:=0A> >> debug2: kex_parse_kexinit: =
first_kex_follows 0=0A> >> debug2: kex_parse_kexinit: reserved 0=0A> >> deb=
ug2: kex_parse_kexinit:=0A> diffie-hellman-group-exchange-sha256,diffie-hel=
lman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-=0A> >>=
 group1-sha1=0A> >> debug2: kex_parse_kexinit: ssh-rsa,ssh-dss=0A> >> debug=
2: kex_parse_kexinit:=0A> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfo=
ur128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-=0A> >> cbc,aes25=
6-cbc,arcfour,[email protected]=0A> >> debug2: kex_parse_kexinit:=
=0A> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des=
-cbc,blowfish-cbc,cast128-cbc,aes192-=0A> >> cbc,aes256-cbc,arcfour,rijndae=
[email protected]=0A> >> debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,u=
[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,h=
mac-=0A> >> md5-96=0A> >> debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,uma=
[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hma=
c-=0A> >> md5-96=0A> >> debug2: kex_parse_kexinit: none,[email protected]=0A=
> >> debug2: kex_parse_kexinit: none,[email protected]=0A> >> debug2: kex_pa=
rse_kexinit:=0A> >> debug2: kex_parse_kexinit:=0A> >> debug2: kex_parse_kex=
init: first_kex_follows 0=0A> >> debug2: kex_parse_kexinit: reserved 0=0A> =
>> debug2: mac_setup: found hmac-md5=0A> >> debug1: kex: server->client aes=
128-ctr hmac-md5=0A> none=0A> >> debug2: mac_setup: found hmac-md5=0A> >> d=
ebug1: kex: client->server aes128-ctr hmac-md5=0A> none=0A> >> debug1:=0A> =
SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent=0A> >> debug1: expecting S=
SH2_MSG_KEX_DH_GEX_GROUP=0A> >> debug3: Wrote 24 bytes for a total of 855=
=0A> >> debug2: dh_gen_key: priv key bits set: 124/256=0A> >> debug2: bits =
set: 507/1024=0A> >> debug1: SSH2_MSG_KEX_DH_GEX_INIT sent=0A> >> debug1: e=
xpecting SSH2_MSG_KEX_DH_GEX_REPLY=0A> >> debug3: Wrote 144 bytes for a tot=
al of 999=0A> >> debug3: check_host_in_hostfile: filename=0A> /home/mahmood=
/.ssh/known_hosts=0A> >> debug3: check_host_in_hostfile: match line 1=0A> >=
> debug3: check_host_in_hostfile: filename=0A> /home/mahmood/.ssh/known_hos=
ts=0A> >> debug3: check_host_in_hostfile: match line 2=0A> >> debug1: Host =
'server' is known and matches the RSA=0A> host key.=0A> >> debug1: Found ke=
y in=0A> /home/mahmood/.ssh/known_hosts:1=0A> >> debug2: bits set: 503/1024=
=0A> >> debug1: ssh_rsa_verify: signature correct=0A> >> debug2: kex_derive=
_keys=0A> >> debug2: set_newkeys: mode 1=0A> >> debug1: SSH2_MSG_NEWKEYS se=
nt=0A> >> debug1: expecting SSH2_MSG_NEWKEYS=0A> >> debug3: Wrote 16 bytes =
for a total of 1015=0A> >> debug2: set_newkeys: mode 0=0A> >> debug1: SSH2_=
MSG_NEWKEYS received=0A> >> debug1: SSH2_MSG_SERVICE_REQUEST sent=0A> >> de=
bug3: Wrote 48 bytes for a total of 1063=0A> >> debug2: service_accept: ssh=
-userauth=0A> >> debug1: SSH2_MSG_SERVICE_ACCEPT received=0A> >> debug2: ke=
y: /home/mahmood/.ssh/identity ((nil))=0A> >> debug2: key: /home/mahmood/.s=
sh/id_rsa ((nil))=0A> >> debug2: key: /home/mahmood/.ssh/id_dsa ((nil))=0A>=
 >> debug3: Wrote 64 bytes for a total of 1127=0A> >> debug1: Authenticatio=
ns that can continue:=0A> publickey,password,hostbased=0A> >> debug3: start=
 over, passed a different list=0A> publickey,password,hostbased=0A> >> debu=
g3: preferred=0A> gssapi-keyex,gssapi-with-mic,gssapi,hostbased,publickey,k=
eyboard-interactive,password=0A> >> debug3: authmethod_lookup hostbased=0A>=
 >> debug3: remaining preferred:=0A> publickey,keyboard-interactive,passwor=
d=0A> >> debug3: authmethod_is_enabled hostbased=0A> >> debug1: Next authen=
tication method: hostbased=0A> >> debug2: userauth_hostbased: chost client.=
=0A> >> debug2: ssh_keysign called=0A> >> debug3: ssh_msg_send: type 2=0A> =
>> debug3: ssh_msg_recv entering=0A> >> debug1: permanently_drop_suid: 1000=
=0A> >> debug2: we sent a hostbased packet, wait for=0A> reply=0A> >> debug=
3: Wrote 608 bytes for a total of 1735=0A> >> debug1: Authentications that =
can continue:=0A> publickey,password,hostbased=0A> >> debug2: userauth_host=
based: chost client.=0A> >> debug2: ssh_keysign called=0A> >> debug3: ssh_m=
sg_send: type 2=0A> >> debug3: ssh_msg_recv entering=0A> >> debug1: permane=
ntly_drop_suid: 1000=0A> >> debug2: we sent a hostbased packet, wait for=0A=
> reply=0A> >> debug3: Wrote 672 bytes for a total of 2407=0A> >> debug1: A=
uthentications that can continue:=0A> publickey,password,hostbased=0A> >> d=
ebug1: No more client hostkeys for hostbased=0A> authentication.=0A> >> deb=
ug2: we did not send a packet, disable method=0A> >> debug3: authmethod_loo=
kup publickey=0A> >> debug3: remaining preferred:=0A> keyboard-interactive,=
password=0A> >> debug3: authmethod_is_enabled publickey=0A> >> debug1: Next=
 authentication method: publickey=0A> >> debug1: Trying private key:=0A> /h=
ome/mahmood/.ssh/identity=0A> >> debug3: no such identity:=0A> /home/mahmoo=
d/.ssh/identity=0A> >> debug1: Trying private key:=0A> /home/mahmood/.ssh/i=
d_rsa=0A> >> debug3: no such identity:=0A> /home/mahmood/.ssh/id_rsa=0A> >>=
 debug1: Trying private key:=0A> /home/mahmood/.ssh/id_dsa=0A> >> debug3: n=
o such identity:=0A> /home/mahmood/.ssh/id_dsa=0A> >> debug2: we did not se=
nd a packet, disable method=0A> >> debug3: authmethod_lookup password=0A> >=
> debug3: remaining preferred: ,password=0A> >> debug3: authmethod_is_enabl=
ed password=0A> >> debug1: Next authentication method: password=0A> >> mahm=
ood@server's password:=0A> >>=0A> >>=0A> >> Any idea about that?=0A> >>=0A>=
 >> // Naderan *Mahmood;=0A> >>=0A> >=0A> =0A> =0A> =0A> -- =0A> Asif Iqbal=
=0A> PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu=0A> A: Because it messes up=
 the order in which people normally=0A> read text.=0A> Q: Why is top-postin=
g such a bad thing?=0A>