Re: problem with HostbasedAuthentication

This is what I get=0A=A0=0Amahmood@server:~$ sudo /usr/sbin/sshd -ddd=0Adeb=
ug2: load_server_config: filename /etc/ssh/sshd_config=0Adebug2: load_serve=
r_config: done config len =3D 686=0Adebug2: parse_server_config: config /et=
c/ssh/sshd_config len 686=0Adebug3: /etc/ssh/sshd_config:5 setting Port 22=
=0Adebug3: /etc/ssh/sshd_config:9 setting Protocol 2=0Adebug3: /etc/ssh/ssh=
d_config:11 setting HostKey /etc/ssh/ssh_host_rsa_key=0Adebug3: /etc/ssh/ss=
hd_config:12 setting HostKey /etc/ssh/ssh_host_dsa_key=0Adebug3: /etc/ssh/s=
shd_config:14 setting UsePrivilegeSeparation yes=0Adebug3: /etc/ssh/sshd_co=
nfig:17 setting KeyRegenerationInterval 3600=0Adebug3: /etc/ssh/sshd_config=
:18 setting ServerKeyBits 768=0Adebug3: /etc/ssh/sshd_config:20 setting Use=
Dns no=0Adebug3: /etc/ssh/sshd_config:21 setting VerifyReverseMapping No=0A=
/etc/ssh/sshd_config line 21: Deprecated option VerifyReverseMapping=0Adebu=
g3: /etc/ssh/sshd_config:24 setting SyslogFacility AUTH=0Adebug3: /etc/ssh/=
sshd_config:25 setting LogLevel INFO=0Adebug3: /etc/ssh/sshd_config:28 sett=
ing LoginGraceTime 120=0Adebug3: /etc/ssh/sshd_config:29 setting PermitRoot=
Login yes=0Adebug3: /etc/ssh/sshd_config:30 setting StrictModes yes=0Adebug=
3: /etc/ssh/sshd_config:32 setting RSAAuthentication yes=0Adebug3: /etc/ssh=
/sshd_config:33 setting PubkeyAuthentication yes=0Adebug3: /etc/ssh/sshd_co=
nfig:37 setting IgnoreRhosts no=0Adebug3: /etc/ssh/sshd_config:39 setting R=
hostsRSAAuthentication no=0Adebug3: /etc/ssh/sshd_config:41 setting Hostbas=
edAuthentication yes=0Adebug3: /etc/ssh/sshd_config:49 setting PermitEmptyP=
asswords no=0Adebug3: /etc/ssh/sshd_config:53 setting ChallengeResponseAuth=
entication no=0Adebug3: /etc/ssh/sshd_config:68 setting X11Forwarding yes=
=0Adebug3: /etc/ssh/sshd_config:69 setting X11DisplayOffset 10=0Adebug3: /e=
tc/ssh/sshd_config:70 setting PrintMotd no=0Adebug3: /etc/ssh/sshd_config:7=
1 setting PrintLastLog yes=0Adebug3: /etc/ssh/sshd_config:72 setting TCPKee=
pAlive yes=0Adebug3: /etc/ssh/sshd_config:79 setting AcceptEnv LANG LC_*=0A=
debug3: /etc/ssh/sshd_config:81 setting Subsystem sftp /usr/lib/openssh/sft=
p-server=0Adebug3: /etc/ssh/sshd_config:92 setting UsePAM yes=0Adebug1: ssh=
d version OpenSSH_5.3p1 Debian-3ubuntu4=0Adebug3: Not a RSA1 key file /etc/=
ssh/ssh_host_rsa_key.=0Adebug1: read PEM private key done: type RSA=0Adebug=
1: Checking blacklist file /usr/share/ssh/blacklist.RSA-2048=0Adebug1: Chec=
king blacklist file /etc/ssh/blacklist.RSA-2048=0Adebug1: private host key:=
 #0 type 1 RSA=0Adebug3: Not a RSA1 key file /etc/ssh/ssh_host_dsa_key.=0Ad=
ebug1: read PEM private key done: type DSA=0Adebug1: Checking blacklist fil=
e /usr/share/ssh/blacklist.DSA-1024=0Adebug1: Checking blacklist file /etc/=
ssh/blacklist.DSA-1024=0Adebug1: private host key: #1 type 2 DSA=0Adebug1: =
rexec_argv[0]=3D'/usr/sbin/sshd'=0Adebug1: rexec_argv[1]=3D'-ddd'=0Adebug2:=
 fd 3 setting O_NONBLOCK=0Adebug1: Bind to port 22 on 0.0.0.0.=0ABind to po=
rt 22 on 0.0.0.0 failed: Address already in use.=0Adebug2: fd 3 setting O_N=
ONBLOCK=0Adebug1: Bind to port 22 on ::.=0ABind to port 22 on :: failed: Ad=
dress already in use.=0ACannot bind any address.=0Amahmood@server:~$=0A=0A=
=0A// Naderan *Mahmood;=0A=0A=0A----- Original Message -----=0AFrom: Sharad=
 <[email protected]>=0ATo: Mahmood Naderan <[email protected]>=0ACc: =
[email protected]=0ASent: Friday, April 29, 2011 1:04 PM=0ASubj=
ect: Re: problem with HostbasedAuthentication=0A=0AUse the absolute path of=
 sshd as follows:=0A=0A=0Asudo /etc/ssh/sbin/sshd -ddd =0A=0APlease ensure =
that the path is correct. I don't know if ur sshd exists in /etc/ssh/sbin/s=
shd.=0A=0ARegards,=0Asharad =0A--- On Fri, 29/4/11, Mahmood Naderan <nt_mah=
[email protected]> wrote:=0A=0A> From: Mahmood Naderan <[email protected]>=
=0A> Subject: Re: problem with HostbasedAuthentication=0A> To: "Sharad" <sh=
[email protected]>=0A> Cc: "[email protected]" <secureshell@se=
curityfocus.com>=0A> Date: Friday, 29 April, 2011, 12:34 PM=0A> Sorry what =
do you mean?=0A> =A0=0A> mahmood@server:~$ sudo sshd -d=0A> sshd re-exec re=
quires execution with an absolute path=0A> mahmood@server:~$ sudo sshd -d 3=
=0A> sshd re-exec requires execution with an absolute path=0A> mahmood@serv=
er:~$ sudo sshd -ddd=0A> sshd re-exec requires execution with an absolute p=
ath=0A> =0A> My last post was the debug information for=0A> server->client.=
=0A> =0A> // Naderan *Mahmood;=0A> =0A> =0A> ----- Original Message -----=
=0A> From: Sharad <[email protected]>=0A> To: Mahmood Naderan <nt_mahmoo=
[email protected]>=0A> Cc: "[email protected]"=0A> <secureshell@secur=
ityfocus.com>=0A> Sent: Friday, April 29, 2011 11:31 AM=0A> Subject: Re: pr=
oblem with HostbasedAuthentication=0A> =0A> Can you run debug on server as =
well using sshd -d. More=0A> -d's mean more debug information (you can use =
at the max 3=0A> d's) :D=0A> =0A> Regards,=0A> Sharad=0A> --- On Fri, 29/4/=
11, Mahmood Naderan <[email protected]>=0A> wrote:=0A> =0A> > From: Mahm=
ood Naderan <[email protected]>=0A> > Subject: Re: problem with Hostbase=
dAuthentication=0A> > To: "Sharad" <[email protected]>=0A> > Cc: "secure=
[email protected]"=0A> <[email protected]>=0A> > Date: Fr=
iday, 29 April, 2011, 12:23 PM=0A> > The same thing happens with IP=0A> > a=
ddress=0A> > =A0=0A> > =A0=0A> > mahmood@server:~$ ssh -vvv 192.168.1.3=0A>=
 > OpenSSH_5.3p1 Debian-3ubuntu4, OpenSSL 0.9.8k 25 Mar=0A> 2009=0A> > debu=
g1: Reading configuration data=0A> /etc/ssh/ssh_config=0A> > debug1: Applyi=
ng options for *=0A> > debug2: ssh_connect: needpriv 0=0A> > debug1: Connec=
ting to 192.168.1.3 [192.168.1.3] port=0A> 22.=0A> > debug1: Connection est=
ablished.=0A> > debug1: identity file /home/mahmood/.ssh/identity type=0A> =
-1=0A> > debug1: identity file /home/mahmood/.ssh/id_rsa type=0A> -1=0A> > =
debug1: identity file /home/mahmood/.ssh/id_dsa type=0A> -1=0A> > debug1: R=
emote protocol version 2.0, remote software=0A> > version OpenSSH_5.3p1 Deb=
ian-3ubuntu6=0A> > debug1: match: OpenSSH_5.3p1 Debian-3ubuntu6 pat=0A> Ope=
nSSH*=0A> > debug1: Enabling compatibility mode for protocol 2.0=0A> > debu=
g1: Local version string SSH-2.0-OpenSSH_5.3p1=0A> > Debian-3ubuntu4=0A> > =
debug2: fd 3 setting O_NONBLOCK=0A> > debug1: SSH2_MSG_KEXINIT sent=0A> > d=
ebug3: Wrote 792 bytes for a total of 831=0A> > debug1: SSH2_MSG_KEXINIT re=
ceived=0A> > debug2: kex_parse_kexinit:=0A> >=0A> diffie-hellman-group-exch=
ange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,=
diffie-hellman-group1-sha1=0A> > debug2: kex_parse_kexinit: ssh-rsa,ssh-dss=
=0A> > debug2: kex_parse_kexinit:=0A> >=0A> aes128-ctr,aes192-ctr,aes256-ct=
r,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192=
-cbc,aes256-cbc,arcfour,[email protected]=0A> > debug2: kex_parse=
_kexinit:=0A> >=0A> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,=
aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,=
[email protected]=0A> > debug2: kex_parse_kexinit: hmac-md5,hmac-=
sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha=
1-96,hmac-md5-96=0A> > debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-6=
[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-m=
d5-96=0A> > debug2: kex_parse_kexinit: none,[email protected],zlib=0A> > deb=
ug2: kex_parse_kexinit: none,[email protected],zlib=0A> > debug2: kex_parse_=
kexinit:=0A> > debug2: kex_parse_kexinit:=0A> > debug2: kex_parse_kexinit: =
first_kex_follows 0=0A> > debug2: kex_parse_kexinit: reserved 0=0A> > debug=
2: kex_parse_kexinit:=0A> >=0A> diffie-hellman-group-exchange-sha256,diffie=
-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-gro=
up1-sha1=0A> > debug2: kex_parse_kexinit: ssh-rsa,ssh-dss=0A> > debug2: kex=
_parse_kexinit:=0A> >=0A> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfo=
ur128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,ar=
cfour,[email protected]=0A> > debug2: kex_parse_kexinit:=0A> >=0A=
> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cb=
c,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysat=
or.liu.se=0A> > debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@opens=
sh.com,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96=
=0A> > debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hm=
ac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96=0A> > debu=
g2: kex_parse_kexinit: none,[email protected]=0A> > debug2: kex_parse_kexini=
t: none,[email protected]=0A> > debug2: kex_parse_kexinit:=0A> > debug2: kex=
_parse_kexinit:=0A> > debug2: kex_parse_kexinit: first_kex_follows 0=0A> > =
debug2: kex_parse_kexinit: reserved 0=0A> > debug2: mac_setup: found hmac-m=
d5=0A> > debug1: kex: server->client aes128-ctr hmac-md5=0A> none=0A> > deb=
ug2: mac_setup: found hmac-md5=0A> > debug1: kex: client->server aes128-ctr=
 hmac-md5=0A> none=0A> > debug1:=0A> SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<=
8192)=0A> > sent=0A> > debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP=0A> > de=
bug3: Wrote 24 bytes for a total of 855=0A> > debug2: dh_gen_key: priv key =
bits set: 129/256=0A> > debug2: bits set: 505/1024=0A> > debug1: SSH2_MSG_K=
EX_DH_GEX_INIT sent=0A> > debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY=0A> >=
 debug3: Wrote 144 bytes for a total of 999=0A> > debug3: check_host_in_hos=
tfile: filename=0A> > /home/mahmood/.ssh/known_hosts=0A> > debug3: check_ho=
st_in_hostfile: match line 1=0A> > debug1: Host '192.168.1.3' is known and =
matches the=0A> RSA=0A> > host key.=0A> > debug1: Found key in /home/mahmoo=
d/.ssh/known_hosts:1=0A> > debug2: bits set: 517/1024=0A> > debug1: ssh_rsa=
_verify: signature correct=0A> > debug2: kex_derive_keys=0A> > debug2: set_=
newkeys: mode 1=0A> > debug1: SSH2_MSG_NEWKEYS sent=0A> > debug1: expecting=
 SSH2_MSG_NEWKEYS=0A> > debug3: Wrote 16 bytes for a total of 1015=0A> > de=
bug2: set_newkeys: mode 0=0A> > debug1: SSH2_MSG_NEWKEYS received=0A> > deb=
ug1: SSH2_MSG_SERVICE_REQUEST sent=0A> > debug3: Wrote 48 bytes for a total=
 of 1063=0A> > debug2: service_accept: ssh-userauth=0A> > debug1: SSH2_MSG_=
SERVICE_ACCEPT received=0A> > debug2: key: /home/mahmood/.ssh/identity ((ni=
l))=0A> > debug2: key: /home/mahmood/.ssh/id_rsa ((nil))=0A> > debug2: key:=
 /home/mahmood/.ssh/id_dsa ((nil))=0A> > debug3: Wrote 64 bytes for a total=
 of 1127=0A> > debug1: Authentications that can continue:=0A> > publickey,p=
assword,hostbased=0A> > debug3: start over, passed a different list=0A> > p=
ublickey,password,hostbased=0A> > debug3: preferred=0A> >=0A> gssapi-keyex,=
gssapi-with-mic,gssapi,hostbased,publickey,keyboard-interactive,password=0A=
> > debug3: authmethod_lookup hostbased=0A> > debug3: remaining preferred:=
=0A> > publickey,keyboard-interactive,password=0A> > debug3: authmethod_is_=
enabled hostbased=0A> > debug1: Next authentication method: hostbased=0A> >=
 get_socket_address: getnameinfo 8 failed: Name or=0A> service=0A> > not kn=
own=0A> > debug2: userauth_hostbased: chost server.=0A> > debug2: ssh_keysi=
gn called=0A> > debug3: ssh_msg_send: type 2=0A> > debug3: ssh_msg_recv ent=
ering=0A> > debug1: permanently_drop_suid: 1000=0A> > get_socket_address: g=
etnameinfo 8 failed: Name or=0A> service=0A> > not known=0A> > cannot get s=
ockname for fd=0A> > ssh_keysign: no reply=0A> > key_sign failed=0A> > debu=
g2: we did not send a packet, disable method=0A> > debug3: authmethod_looku=
p publickey=0A> > debug3: remaining preferred:=0A> keyboard-interactive,pas=
sword=0A> > debug3: authmethod_is_enabled publickey=0A> > debug1: Next auth=
entication method: publickey=0A> > debug1: Trying private key:=0A> /home/ma=
hmood/.ssh/identity=0A> > debug3: no such identity: /home/mahmood/.ssh/iden=
tity=0A> > debug1: Trying private key: /home/mahmood/.ssh/id_rsa=0A> > debu=
g3: no such identity: /home/mahmood/.ssh/id_rsa=0A> > debug1: Trying privat=
e key: /home/mahmood/.ssh/id_dsa=0A> > debug3: no such identity: /home/mahm=
ood/.ssh/id_dsa=0A> > debug2: we did not send a packet, disable method=0A> =
> debug3: authmethod_lookup password=0A> > debug3: remaining preferred: ,pa=
ssword=0A> > debug3: authmethod_is_enabled password=0A> > debug1: Next auth=
entication method: password=0A> > [email protected]'s password:=0A> > =0A=
> > =0A> > // Naderan *Mahmood;=0A> > =0A> > =0A> > ----- Original Message =
-----=0A> > From: Sharad <[email protected]>=0A> > To: Mahmood Naderan <=
[email protected]>=0A> > Cc: "[email protected]"=0A> > <secu=
[email protected]>=0A> > Sent: Friday, April 29, 2011 11:19 AM=0A> =
> Subject: Re: problem with HostbasedAuthentication=0A> > =0A> > Hi Mahmood=
,=0A> > =0A> > This line looks out of place. Check that host name is=0A> > =
getting resolved:=0A> > =0A> > get_socket_address: getnameinfo 8 failed: Na=
me or=0A> service=0A> > not known=0A> > =0A> > I am sure you would have per=
formed the same steps on=0A> both=0A> > hosts. Try establishing connection =
with IP Address=0A> instead=0A> > of hostname.=0A> > =0A> > Regards,=0A> > =
Sharad=0A> > --- On Thu, 28/4/11, Mahmood Naderan <[email protected]>=0A=
> > wrote:=0A> > =0A> > > From: Mahmood Naderan <[email protected]>=0A> =
> > Subject: Re: problem with=0A> HostbasedAuthentication=0A> > > To: "Shar=
ad" <[email protected]>=0A> > > Cc: "[email protected]"=0A> =
> <[email protected]>=0A> > > Date: Thursday, 28 April, 2011, 1=
1:12 PM=0A> > > Dear Sharad,=0A> > > I am now trying to setup a hostbased s=
sh from=0A> server=0A> > to=0A> > > client (previously client->server worke=
d fine=0A> based=0A> > on=0A> > > your help). I want it to be bidirectional=
.=0A> > > =A0=0A> > > I did the same thing in reverse (now the client=0A> >=
 becomes=0A> > > server and the server becoms client). However=0A> this is=
=0A> > what I=0A> > > get while trying to ssh from server to client:=0A> > =
> =A0=0A> > > =A0=0A> > > debug3: Wrote 48 bytes for a total of 1063=0A> > =
> debug2: service_accept: ssh-userauth=0A> > > debug1: SSH2_MSG_SERVICE_ACC=
EPT received=0A> > > debug2: key: /home/mahmood/.ssh/identity ((nil))=0A> >=
 > debug2: key: /home/mahmood/.ssh/id_rsa ((nil))=0A> > > debug2: key: /hom=
e/mahmood/.ssh/id_dsa ((nil))=0A> > > debug3: Wrote 64 bytes for a total of=
 1127=0A> > > debug1: Authentications that can continue:=0A> > > publickey,=
password,hostbased=0A> > > debug3: start over, passed a different list=0A> =
> > publickey,password,hostbased=0A> > > debug3: preferred=0A> > >=0A> >=0A=
> gssapi-keyex,gssapi-with-mic,gssapi,hostbased,publickey,keyboard-interact=
ive,password=0A> > > debug3: authmethod_lookup hostbased=0A> > > debug3: re=
maining preferred:=0A> > > publickey,keyboard-interactive,password=0A> > > =
debug3: authmethod_is_enabled hostbased=0A> > > debug1: Next authentication=
 method: hostbased=0A> > > get_socket_address: getnameinfo 8 failed: Name=
=0A> or=0A> > service=0A> > > not known=0A> > > debug2: userauth_hostbased:=
 chost server.=0A> > > debug2: ssh_keysign called=0A> > > debug3: ssh_msg_s=
end: type 2=0A> > > debug3: ssh_msg_recv entering=0A> > > debug1: permanent=
ly_drop_suid: 1000=0A> > > get_socket_address: getnameinfo 8 failed: Name=
=0A> or=0A> > service=0A> > > not known=0A> > > cannot get sockname for fd=
=0A> > > ssh_keysign: no reply=0A> > > key_sign failed=0A> > > debug2: we d=
id not send a packet, disable method=0A> > > debug3: authmethod_lookup publ=
ickey=0A> > > debug3: remaining preferred:=0A> > keyboard-interactive,passw=
ord=0A> > > debug3: authmethod_is_enabled publickey=0A> > > debug1: Next au=
thentication method: publickey=0A> > > debug1: Trying private key:=0A> > /h=
ome/mahmood/.ssh/identity=0A> > > debug3: no such identity:=0A> /home/mahmo=
od/.ssh/identity=0A> > > debug1: Trying private key:=0A> /home/mahmood/.ssh=
/id_rsa=0A> > > debug3: no such identity:=0A> /home/mahmood/.ssh/id_rsa=0A>=
 > > debug1: Trying private key:=0A> /home/mahmood/.ssh/id_dsa=0A> > > debu=
g3: no such identity:=0A> /home/mahmood/.ssh/id_dsa=0A> > > debug2: we did =
not send a packet, disable method=0A> > > debug3: authmethod_lookup passwor=
d=0A> > > debug3: remaining preferred: ,password=0A> > > debug3: authmethod=
_is_enabled password=0A> > > debug1: Next authentication method: password=
=0A> > > [email protected]'s password:=0A> > > =0A> > > =A0=0A> > > What =
is your suggestion?=0A> > > =0A> > > // Naderan *Mahmood;=0A> > > =0A> > > =
=0A> > > ----- Original Message -----=0A> > > From: Sharad <sharad2011@yaho=
o.com>=0A> > > To: Mahmood Naderan <[email protected]>=0A> > > Cc: "secu=
[email protected]"=0A> > > <[email protected]>=0A> > > =
Sent: Thursday, April 28, 2011 5:20 PM=0A> > > Subject: Re: problem with=0A=
> HostbasedAuthentication=0A> > > =0A> > > Mahmood, =0A> > > =0A> > > The f=
iles are /home/username/.ssh/known_hosts on=0A> both=0A> > > server and cli=
ent.=0A> > > =0A> > > By FQDN, I meant host's fully qualified domain=0A> na=
me. =0A> > > =0A> > > Following is the example:=0A> > > =0A> > > Assuming b=
oth client and server are linux hosts:=0A> > > =0A> > > Server IP: 192.168.=
1.1=0A> > > Client IP: 192.168.1.101=0A> > > =0A> > > Server Name: lnx_srvr=
_1.domain.com=0A> > > Client Name: lnx_clnt_101.domain.com=0A> > > =0A> > >=
 User name on each host is mahmood.=0A> > > =0A> > > Following would be the=
 entries in .shosts on=0A> > lnx_srvr_1=0A> > > =0A> > > =0A> > > lnx_srvr_=
1:/home/mahmood $ cat .shosts=0A> > > =0A> > > lnx_clnt_101.domain.com mahm=
ood=0A> > > 192.168.1.101 mahmood=0A> > > lnx_clnt_101 mahmood=0A> > > =0A>=
 > > Following should exist in=0A> > /home/mahmood/.ssh/known_hosts=0A> > >=
 file on the server side:=0A> > >=0A> 192.168.1.101,lnx_clnt_101,lnx_clnt_1=
01.domain.com=A0=0A> > > ssh-rsa AAAAB3Nz...=0A> > > =0A> > > Following sho=
uld also exist in=0A> > > /home/mahmood/.ssh/known_hosts file on the=0A> cl=
ient=0A> > side:=0A> > > 192.168.1.1,lnx_srvr_1,lnx_srvr_1.domain.com=A0=0A=
> > ssh-rsa=0A> > > AAAAB3Nz...=0A> > > =0A> > > Ensure that .ssh directory=
 on both client and=0A> server=0A> > are=0A> > > rwx for owner only and gro=
up/rest of world is=0A> 000.=0A> > > =0A> > > Hope this helps! Good Luck! :=
)=0A> > > =0A> > > Regards,=0A> > > Sharad=A0 =0A> > > --- On Thu, 28/4/11,=
 Mahmood Naderan <[email protected]>=0A> > > wrote:=0A> > > =0A> > > > F=
rom: Mahmood Naderan <[email protected]>=0A> > > > Subject: Re: problem =
with=0A> > HostbasedAuthentication=0A> > > > To: "Sharad" <sharad2011@yahoo=
.com>=0A> > > > Cc: "[email protected]"=0A> > > <secureshell@se=
curityfocus.com>=0A> > > > Date: Thursday, 28 April, 2011, 3:54 PM=0A> > > =
> Can you explain exactly which file I=0A> > > > should edit? What is FQDN?=
 By 'hostname', Do=0A> you=0A> > mean=0A> > > server=0A> > > > hostname of =
client hostname. =0A> > > > Should I do that on both side or server=0A> sid=
e?...=0A> > > > =0A> > > > // Naderan *Mahmood;=0A> > > > =0A> > > > =0A> >=
 > > ----- Original Message -----=0A> > > > From: Sharad <sharad2011@yahoo.=
com>=0A> > > > To: Mahmood Naderan <[email protected]>;=0A> > > > Asif I=
qbal <[email protected]>=0A> > > > Cc: "[email protected]"=0A> >=
 > > <[email protected]>=0A> > > > Sent: Thursday, April 28, 20=
11 1:16 PM=0A> > > > Subject: Re: problem with=0A> > HostbasedAuthenticatio=
n=0A> > > > =0A> > > > Sometimes the issue lies with hostname as=0A> well.=
=0A> > What I=0A> > > mean=0A> > > > with that is the known_hosts may have =
just=0A> the=0A> > host=0A> > > name=0A> > > > where as when the connection=
 is established,=0A> the=0A> > debug=0A> > > shows=0A> > > > the FQDN. I fa=
ced this issue so to be sure,=0A> I=0A> > edited=0A> > > the=0A> > > > know=
n_hosts file and inserted the hostname,=0A> > hostname's=0A> > > FQDN=0A> >=
 > > and it's IP address (all comma separated).=0A> > > > =0A> > > > Also e=
nsure that you both the hosts'=0A> known_hosts=0A> > files=0A> > > have=0A>=
 > > > opposite servers names (as prescribed=0A> above). =0A> > > > =0A> > =
> > All the above checks makes it work for me.=0A> > > > =0A> > > > Hope th=
is solves.=0A> > > > =0A> > > > Kind regards,=0A> > > > Sharad=0A> > > > --=
- On Thu, 28/4/11, Asif Iqbal <[email protected]>=0A> > > > wrote:=0A> > > >=
 =0A> > > > > From: Asif Iqbal <[email protected]>=0A> > > > > Subject: Re: =
problem with=0A> > > HostbasedAuthentication=0A> > > > > To: "Mahmood Nader=
an" <[email protected]>=0A> > > > > Cc: "[email protected]"=
=0A> > > > <[email protected]>=0A> > > > > Date: Thursday, 28 A=
pril, 2011, 12:38=0A> AM=0A> > > > > On Wed, Apr 27, 2011 at 1:12 AM,=0A> >=
 > > > Mahmood Naderan <[email protected]>=0A> > > > > wrote:=0A> > > > =
> >>Change the order method. Have=0A> > hostbased=0A> > > > before=0A> > > =
> > password=0A> > > > > >=0A> > > > > > Sorry where should I do that?=0A> =
> > > > =0A> > > > > man ssh_config and look into=0A> > > PreferredAuthenti=
cations=0A> > > > > =0A> > > > > >=0A> > > > > > // Naderan *Mahmood;=0A> >=
 > > > >=0A> > > > > > From: Asif Iqbal <[email protected]>=0A> > > > > > To=
: Mahmood Naderan <[email protected]>=0A> > > > > > Cc: "secureshell@sec=
urityfocus.com"=0A> > > > > <[email protected]>=0A> > > > > > S=
ent: Wednesday, April 27, 2011=0A> 9:17=0A> > AM=0A> > > > > > Subject: Re:=
 problem with=0A> > > > HostbasedAuthentication=0A> > > > > >=0A> > > > > >=
=0A> > > > > > Change the order method. Have=0A> > hostbased=0A> > > before=
=0A> > > > > password=0A> > > > > > On Apr 26, 2011 11:52 PM,=0A> "Mahmood=
=0A> > Naderan"=0A> > > > <[email protected]>=0A> > > > > wrote:=0A> > >=
 > > >>=0A> > > > > >>=0A> > > > > >> Hi,=0A> > > > > >> I am trying to set=
up a=0A> hostbased=0A> > > passwrodless=0A> > > > ssh=0A> > > > > from a cl=
ient to a server using this=0A> guide=0A> > http://www.ehow.com/how_7621307=
_set-up-hostbased-authentication.html.=0A> > > > > >>=0A> > > > > >> The cl=
ient looks like:=0A> > > > > >>=0A> > > > > >> mahmood@client:~$ cat=0A> > =
> /etc/ssh/ssh_config=A0 |=0A> > > > grep=0A> > > > > "HostbasedAuthenticat=
ion"=0A> > > > > >> =A0=A0 HostbasedAuthentication=0A> yes=0A> > > > > >> m=
ahmood@client:~$ cat=0A> > > /etc/ssh/ssh_config=A0 |=0A> > > > grep=0A> > =
> > > "EnableSSHKeysign"=0A> > > > > >> =A0=A0 EnableSSHKeysign yes=0A> > >=
 > > >>=0A> > > > > >>=0A> > > > > >> and the server looks like:=0A> > > > =
> >> mahmood@server:~$ cat=0A> > > /etc/ssh/sshd_config=A0=0A> > > > |=0A> =
> > > > grep "HostbasedAuthentication"=0A> > > > > >> HostbasedAuthenticati=
on yes=0A> > > > > >> mahmood@server:~$ cat=0A> > > /etc/ssh/sshd_config=A0=
=0A> > > > |=0A> > > > > grep "IgnoreRhosts"=0A> > > > > >> IgnoreRhosts no=
=0A> > > > > >>=0A> > > > > >> also the server has the key=0A> for=0A> > cl=
ient:=0A> > > > > >>=0A> > > > > >> mahmood@server:~$ cat=0A> > > > /etc/ss=
h/ssh_known_hosts=0A> > > > > >> client ssh-rsa AAAAB3Nz.....=0A> > > > > >=
>=0A> > > > > >> the ~/.shosts file on the=0A> server=0A> > > contains:=0A>=
 > > > > >> mahmood@server:~$ cat .shosts=0A> > > > > >> client.domain mahm=
ood=0A> > > > > >>=0A> > > > > >> Then on both server and=0A> client, the=
=0A> > ssh=0A> > > > service is=0A> > > > > restarted:=0A> > > > > >> mahmo=
od@client:~$ sudo service=0A> ssh=0A> > > restart=0A> > > > > >> ssh start/=
running, process=0A> 1355=0A> > > > > >> mahmood@server:~$ sudo service=0A>=
 ssh=0A> > > restart=0A> > > > > >> ssh start/running, process=0A> 28982=0A=
> > > > > >>=0A> > > > > >> How, when I run "ssh -vvv=0A> server"=0A> > fro=
m=0A> > > client=0A> > > > (to=0A> > > > > show the verbose messages), I st=
ill get=0A> the=0A> > > password=0A> > > > > prompt.=0A> > > > > >>=0A> > >=
 > > >> mahmood@client:~$ ssh -vvv=0A> server=0A> > > > > >> OpenSSH_5.3p1=
=0A> Debian-3ubuntu6,=0A> > OpenSSL=0A> > > 0.9.8k=0A> > > > 25=0A> > > > >=
 Mar 2009=0A> > > > > >> debug1: Reading configuration=0A> data=0A> > > > >=
 /etc/ssh/ssh_config=0A> > > > > >> debug1: Applying options for=0A> *=0A> =
> > > > >> debug2: ssh_connect: needpriv=0A> 0=0A> > > > > >> debug1: Conne=
cting to server=0A> > > [192.168.1.1]=0A> > > > port=0A> > > > > 22.=0A> > =
> > > >> debug1: Connection=0A> established.=0A> > > > > >> debug1: identit=
y file=0A> > > > /home/mahmood/.ssh/identity=0A> > > > > type -1=0A> > > > =
> >> debug1: identity file=0A> > > > /home/mahmood/.ssh/id_rsa=0A> > > > > =
type -1=0A> > > > > >> debug1: identity file=0A> > > > /home/mahmood/.ssh/i=
d_dsa=0A> > > > > type -1=0A> > > > > >> debug1: Remote protocol=0A> versio=
n=0A> > 2.0,=0A> > > remote=0A> > > > > software version OpenSSH_5.3p1=0A> =
> Debian-3ubuntu4=0A> > > > > >> debug1: match: OpenSSH_5.3p1=0A> > > Debia=
n-3ubuntu4=0A> > > > pat=0A> > > > > OpenSSH*=0A> > > > > >> debug1: Enabli=
ng compatibility=0A> mode=0A> > for=0A> > > > protocol=0A> > > > > 2.0=0A> =
> > > > >> debug1: Local version string=0A> > > > SSH-2.0-OpenSSH_5.3p1=0A>=
 > > > > Debian-3ubuntu6=0A> > > > > >> debug2: fd 3 setting=0A> O_NONBLOCK=
=0A> > > > > >> debug1: SSH2_MSG_KEXINIT sent=0A> > > > > >> debug3: Wrote =
792 bytes for a=0A> total=0A> > of=0A> > > 831=0A> > > > > >> debug1: SSH2_=
MSG_KEXINIT=0A> received=0A> > > > > >> debug2: kex_parse_kexinit:=0A> > > =
> >=0A> > > >=0A> > >=0A> >=0A> diffie-hellman-group-exchange-sha256,diffie=
-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-=0A=
> > > > > >> group1-sha1=0A> > > > > >> debug2: kex_parse_kexinit:=0A> > > =
ssh-rsa,ssh-dss=0A> > > > > >> debug2: kex_parse_kexinit:=0A> > > > >=0A> >=
 > >=0A> > >=0A> >=0A> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour1=
28,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-=0A> > > > > >> cbc,=
aes256-cbc,arcfour,[email protected]=0A> > > > > >> debug2: kex_p=
arse_kexinit:=0A> > > > >=0A> > > >=0A> > >=0A> >=0A> aes128-ctr,aes192-ctr=
,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-=
cbc,aes192-=0A> > > > > >> cbc,aes256-cbc,arcfour,[email protected].=
se=0A> > > > > >> debug2: kex_parse_kexinit:=0A> > > > hmac-md5,hmac-sha1,u=
[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,h=
mac-=0A> > > > > >> md5-96=0A> > > > > >> debug2: kex_parse_kexinit:=0A> > =
> > hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,hmac-ripemd160@op=
enssh.com,hmac-sha1-96,hmac-=0A> > > > > >> md5-96=0A> > > > > >> debug2: k=
ex_parse_kexinit:=0A> none,[email protected],zlib=0A> > > > > >> debug2: kex=
_parse_kexinit:=0A> none,[email protected],zlib=0A> > > > > >> debug2: kex_p=
arse_kexinit:=0A> > > > > >> debug2: kex_parse_kexinit:=0A> > > > > >> debu=
g2: kex_parse_kexinit:=0A> > > first_kex_follows=0A> > > > 0=0A> > > > > >>=
 debug2: kex_parse_kexinit:=0A> reserved=0A> > 0=0A> > > > > >> debug2: kex=
_parse_kexinit:=0A> > > > >=0A> > > >=0A> > >=0A> >=0A> diffie-hellman-grou=
p-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14=
-sha1,diffie-hellman-=0A> > > > > >> group1-sha1=0A> > > > > >> debug2: kex=
_parse_kexinit:=0A> > > ssh-rsa,ssh-dss=0A> > > > > >> debug2: kex_parse_ke=
xinit:=0A> > > > >=0A> > > >=0A> > >=0A> >=0A> aes128-ctr,aes192-ctr,aes256=
-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes=
192-=0A> > > > > >> cbc,aes256-cbc,arcfour,[email protected]=0A> =
> > > > >> debug2: kex_parse_kexinit:=0A> > > > >=0A> > > >=0A> > >=0A> >=
=0A> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des=
-cbc,blowfish-cbc,cast128-cbc,aes192-=0A> > > > > >> cbc,aes256-cbc,arcfour=
,[email protected]=0A> > > > > >> debug2: kex_parse_kexinit:=0A> =
> > > hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,hmac-ripemd160@=
openssh.com,hmac-sha1-96,hmac-=0A> > > > > >> md5-96=0A> > > > > >> debug2:=
 kex_parse_kexinit:=0A> > > > hmac-md5,hmac-sha1,[email protected],hmac-r=
ipemd160,[email protected],hmac-sha1-96,hmac-=0A> > > > > >> md5-9=
6=0A> > > > > >> debug2: kex_parse_kexinit:=0A> none,[email protected]=0A> >=
 > > > >> debug2: kex_parse_kexinit:=0A> none,[email protected]=0A> > > > > =
>> debug2: kex_parse_kexinit:=0A> > > > > >> debug2: kex_parse_kexinit:=0A>=
 > > > > >> debug2: kex_parse_kexinit:=0A> > > first_kex_follows=0A> > > > =
0=0A> > > > > >> debug2: kex_parse_kexinit:=0A> reserved=0A> > 0=0A> > > > =
> >> debug2: mac_setup: found=0A> hmac-md5=0A> > > > > >> debug1: kex:=0A> =
server->client=0A> > > aes128-ctr=0A> > > > hmac-md5=0A> > > > > none=0A> >=
 > > > >> debug2: mac_setup: found=0A> hmac-md5=0A> > > > > >> debug1: kex:=
=0A> client->server=0A> > > aes128-ctr=0A> > > > hmac-md5=0A> > > > > none=
=0A> > > > > >> debug1:=0A> > > > >=0A> > >=0A> SSH2_MSG_KEX_DH_GEX_REQUEST=
(1024<1024<8192)=0A> > > > sent=0A> > > > > >> debug1: expecting=0A> > > SS=
H2_MSG_KEX_DH_GEX_GROUP=0A> > > > > >> debug3: Wrote 24 bytes for a=0A> tot=
al=0A> > of=0A> > > 855=0A> > > > > >> debug2: dh_gen_key: priv key=0A> bit=
s=0A> > set:=0A> > > > 124/256=0A> > > > > >> debug2: bits set: 507/1024=0A=
> > > > > >> debug1:=0A> SSH2_MSG_KEX_DH_GEX_INIT=0A> > sent=0A> > > > > >>=
 debug1: expecting=0A> > > SSH2_MSG_KEX_DH_GEX_REPLY=0A> > > > > >> debug3:=
 Wrote 144 bytes for a=0A> total=0A> > of=0A> > > 999=0A> > > > > >> debug3=
:=0A> check_host_in_hostfile:=0A> > > filename=0A> > > > > /home/mahmood/.s=
sh/known_hosts=0A> > > > > >> debug3:=0A> check_host_in_hostfile:=0A> > mat=
ch=0A> > > line 1=0A> > > > > >> debug3:=0A> check_host_in_hostfile:=0A> > =
> filename=0A> > > > > /home/mahmood/.ssh/known_hosts=0A> > > > > >> debug3=
:=0A> check_host_in_hostfile:=0A> > match=0A> > > line 2=0A> > > > > >> deb=
ug1: Host 'server' is known=0A> and=0A> > > matches=0A> > > > the RSA=0A> >=
 > > > host key.=0A> > > > > >> debug1: Found key in=0A> > > > > /home/mahm=
ood/.ssh/known_hosts:1=0A> > > > > >> debug2: bits set: 503/1024=0A> > > > =
> >> debug1: ssh_rsa_verify:=0A> signature=0A> > > correct=0A> > > > > >> d=
ebug2: kex_derive_keys=0A> > > > > >> debug2: set_newkeys: mode 1=0A> > > >=
 > >> debug1: SSH2_MSG_NEWKEYS sent=0A> > > > > >> debug1: expecting=0A> SS=
H2_MSG_NEWKEYS=0A> > > > > >> debug3: Wrote 16 bytes for a=0A> total=0A> > =
of=0A> > > 1015=0A> > > > > >> debug2: set_newkeys: mode 0=0A> > > > > >> d=
ebug1: SSH2_MSG_NEWKEYS=0A> received=0A> > > > > >> debug1:=0A> SSH2_MSG_SE=
RVICE_REQUEST=0A> > sent=0A> > > > > >> debug3: Wrote 48 bytes for a=0A> to=
tal=0A> > of=0A> > > 1063=0A> > > > > >> debug2: service_accept:=0A> > ssh-=
userauth=0A> > > > > >> debug1:=0A> SSH2_MSG_SERVICE_ACCEPT=0A> > > receive=
d=0A> > > > > >> debug2: key:=0A> > > /home/mahmood/.ssh/identity=0A> > > >=
 ((nil))=0A> > > > > >> debug2: key:=0A> > /home/mahmood/.ssh/id_rsa=0A> > =
> > ((nil))=0A> > > > > >> debug2: key:=0A> > /home/mahmood/.ssh/id_dsa=0A>=
 > > > ((nil))=0A> > > > > >> debug3: Wrote 64 bytes for a=0A> total=0A> > =
of=0A> > > 1127=0A> > > > > >> debug1: Authentications that=0A> can=0A> > >=
 continue:=0A> > > > > publickey,password,hostbased=0A> > > > > >> debug3: =
start over, passed a=0A> > different=0A> > > list=0A> > > > > publickey,pas=
sword,hostbased=0A> > > > > >> debug3: preferred=0A> > > > >=0A> > > >=0A> =
> >=0A> >=0A> gssapi-keyex,gssapi-with-mic,gssapi,hostbased,publickey,keybo=
ard-interactive,password=0A> > > > > >> debug3: authmethod_lookup=0A> > hos=
tbased=0A> > > > > >> debug3: remaining preferred:=0A> > > > >=0A> publicke=
y,keyboard-interactive,password=0A> > > > > >> debug3: authmethod_is_enable=
d=0A> > hostbased=0A> > > > > >> debug1: Next authentication=0A> > method:=
=0A> > > > hostbased=0A> > > > > >> debug2: userauth_hostbased:=0A> chost=
=0A> > > client.=0A> > > > > >> debug2: ssh_keysign called=0A> > > > > >> d=
ebug3: ssh_msg_send: type 2=0A> > > > > >> debug3: ssh_msg_recv entering=0A=
> > > > > >> debug1:=0A> permanently_drop_suid:=0A> > 1000=0A> > > > > >> d=
ebug2: we sent a hostbased=0A> packet,=0A> > wait=0A> > > for=0A> > > > > r=
eply=0A> > > > > >> debug3: Wrote 608 bytes for a=0A> total=0A> > of=0A> > =
> 1735=0A> > > > > >> debug1: Authentications that=0A> can=0A> > > continue=
:=0A> > > > > publickey,password,hostbased=0A> > > > > >> debug2: userauth_=
hostbased:=0A> chost=0A> > > client.=0A> > > > > >> debug2: ssh_keysign cal=
led=0A> > > > > >> debug3: ssh_msg_send: type 2=0A> > > > > >> debug3: ssh_=
msg_recv entering=0A> > > > > >> debug1:=0A> permanently_drop_suid:=0A> > 1=
000=0A> > > > > >> debug2: we sent a hostbased=0A> packet,=0A> > wait=0A> >=
 > for=0A> > > > > reply=0A> > > > > >> debug3: Wrote 672 bytes for a=0A> t=
otal=0A> > of=0A> > > 2407=0A> > > > > >> debug1: Authentications that=0A> =
can=0A> > > continue:=0A> > > > > publickey,password,hostbased=0A> > > > > =
>> debug1: No more client=0A> hostkeys=0A> > for=0A> > > > hostbased=0A> > =
> > > authentication.=0A> > > > > >> debug2: we did not send a=0A> packet,=
=0A> > > disable=0A> > > > method=0A> > > > > >> debug3: authmethod_lookup=
=0A> > publickey=0A> > > > > >> debug3: remaining preferred:=0A> > > > > ke=
yboard-interactive,password=0A> > > > > >> debug3: authmethod_is_enabled=0A=
> > publickey=0A> > > > > >> debug1: Next authentication=0A> > method:=0A> =
> > > publickey=0A> > > > > >> debug1: Trying private key:=0A> > > > > /hom=
e/mahmood/.ssh/identity=0A> > > > > >> debug3: no such identity:=0A> > > > =
> /home/mahmood/.ssh/identity=0A> > > > > >> debug1: Trying private key:=0A=
> > > > > /home/mahmood/.ssh/id_rsa=0A> > > > > >> debug3: no such identity=
:=0A> > > > > /home/mahmood/.ssh/id_rsa=0A> > > > > >> debug1: Trying priva=
te key:=0A> > > > > /home/mahmood/.ssh/id_dsa=0A> > > > > >> debug3: no suc=
h identity:=0A> > > > > /home/mahmood/.ssh/id_dsa=0A> > > > > >> debug2: we=
 did not send a=0A> packet,=0A> > > disable=0A> > > > method=0A> > > > > >>=
 debug3: authmethod_lookup=0A> password=0A> > > > > >> debug3: remaining pr=
eferred:=0A> > ,password=0A> > > > > >> debug3: authmethod_is_enabled=0A> >=
 password=0A> > > > > >> debug1: Next authentication=0A> > method:=0A> > > =
password=0A> > > > > >> mahmood@server's password:=0A> > > > > >>=0A> > > >=
 > >>=0A> > > > > >> Any idea about that?=0A> > > > > >>=0A> > > > > >> // =
Naderan *Mahmood;=0A> > > > > >>=0A> > > > > >=0A> > > > > =0A> > > > > =0A=
> > > > > =0A> > > > > -- =0A> > > > > Asif Iqbal=0A> > > > > PGP Key: 0xE6=
2693C5 KeyServer:=0A> pgp.mit.edu=0A> > > > > A: Because it messes up the o=
rder in=0A> which=0A> > > people=0A> > > > normally=0A> > > > > read text.=
=0A> > > > > Q: Why is top-posting such a bad=0A> thing?=0A> > > > >=0A> > =
> >=0A> > > =0A> > >=0A> > =0A> >=0A> =0A>=0A