Re: problem with HostbasedAuthentication
Sharad <[email protected]> Fri, 29 Apr 2011 12:19:49 +0530 (IST)
| Newsgroups | gmane.network.openssh.general |
|---|---|
| Message-ID | <[email protected]> |
Hi Mahmood,=0A=0AThis line looks out of place. Check that host name is gett= ing resolved:=0A=0Aget_socket_address: getnameinfo 8 failed: Name or servic= e not known=0A=0AI am sure you would have performed the same steps on both = hosts. Try establishing connection with IP Address instead of hostname.=0A= =0ARegards,=0ASharad=0A--- On Thu, 28/4/11, Mahmood Naderan <nt_mahmood@yah= oo.com> wrote:=0A=0A> From: Mahmood Naderan <[email protected]>=0A> Subj= ect: Re: problem with HostbasedAuthentication=0A> To: "Sharad" <sharad2011@= yahoo.com>=0A> Cc: "[email protected]" <secureshell@securityfoc= us.com>=0A> Date: Thursday, 28 April, 2011, 11:12 PM=0A> Dear Sharad,=0A> I= am now trying to setup a hostbased ssh from server to=0A> client (previous= ly client->server worked fine based on=0A> your help). I want it to be bidi= rectional.=0A> =A0=0A> I did the same thing in reverse (now the client beco= mes=0A> server and the server becoms client). However this is what I=0A> ge= t while trying to ssh from server to client:=0A> =A0=0A> =A0=0A> debug3: Wr= ote 48 bytes for a total of 1063=0A> debug2: service_accept: ssh-userauth= =0A> debug1: SSH2_MSG_SERVICE_ACCEPT received=0A> debug2: key: /home/mahmoo= d/.ssh/identity ((nil))=0A> debug2: key: /home/mahmood/.ssh/id_rsa ((nil))= =0A> debug2: key: /home/mahmood/.ssh/id_dsa ((nil))=0A> debug3: Wrote 64 by= tes for a total of 1127=0A> debug1: Authentications that can continue:=0A> = publickey,password,hostbased=0A> debug3: start over, passed a different lis= t=0A> publickey,password,hostbased=0A> debug3: preferred=0A> gssapi-keyex,g= ssapi-with-mic,gssapi,hostbased,publickey,keyboard-interactive,password=0A>= debug3: authmethod_lookup hostbased=0A> debug3: remaining preferred:=0A> p= ublickey,keyboard-interactive,password=0A> debug3: authmethod_is_enabled ho= stbased=0A> debug1: Next authentication method: hostbased=0A> get_socket_ad= dress: getnameinfo 8 failed: Name or service=0A> not known=0A> debug2: user= auth_hostbased: chost server.=0A> debug2: ssh_keysign called=0A> debug3: ss= h_msg_send: type 2=0A> debug3: ssh_msg_recv entering=0A> debug1: permanentl= y_drop_suid: 1000=0A> get_socket_address: getnameinfo 8 failed: Name or ser= vice=0A> not known=0A> cannot get sockname for fd=0A> ssh_keysign: no reply= =0A> key_sign failed=0A> debug2: we did not send a packet, disable method= =0A> debug3: authmethod_lookup publickey=0A> debug3: remaining preferred: k= eyboard-interactive,password=0A> debug3: authmethod_is_enabled publickey=0A= > debug1: Next authentication method: publickey=0A> debug1: Trying private = key: /home/mahmood/.ssh/identity=0A> debug3: no such identity: /home/mahmoo= d/.ssh/identity=0A> debug1: Trying private key: /home/mahmood/.ssh/id_rsa= =0A> debug3: no such identity: /home/mahmood/.ssh/id_rsa=0A> debug1: Trying= private key: /home/mahmood/.ssh/id_dsa=0A> debug3: no such identity: /home= /mahmood/.ssh/id_dsa=0A> debug2: we did not send a packet, disable method= =0A> debug3: authmethod_lookup password=0A> debug3: remaining preferred: ,p= assword=0A> debug3: authmethod_is_enabled password=0A> debug1: Next authent= ication method: password=0A> [email protected]'s password:=0A> =0A> =A0= =0A> What is your suggestion?=0A> =0A> // Naderan *Mahmood;=0A> =0A> =0A> -= ---- Original Message -----=0A> From: Sharad <[email protected]>=0A> To:= Mahmood Naderan <[email protected]>=0A> Cc: "secureshell@securityfocus.= com"=0A> <[email protected]>=0A> Sent: Thursday, April 28, 2011= 5:20 PM=0A> Subject: Re: problem with HostbasedAuthentication=0A> =0A> Mah= mood, =0A> =0A> The files are /home/username/.ssh/known_hosts on both=0A> s= erver and client.=0A> =0A> By FQDN, I meant host's fully qualified domain n= ame. =0A> =0A> Following is the example:=0A> =0A> Assuming both client and = server are linux hosts:=0A> =0A> Server IP: 192.168.1.1=0A> Client IP: 192.= 168.1.101=0A> =0A> Server Name: lnx_srvr_1.domain.com=0A> Client Name: lnx_= clnt_101.domain.com=0A> =0A> User name on each host is mahmood.=0A> =0A> Fo= llowing would be the entries in .shosts on lnx_srvr_1=0A> =0A> =0A> lnx_srv= r_1:/home/mahmood $ cat .shosts=0A> =0A> lnx_clnt_101.domain.com mahmood=0A= > 192.168.1.101 mahmood=0A> lnx_clnt_101 mahmood=0A> =0A> Following should = exist in /home/mahmood/.ssh/known_hosts=0A> file on the server side:=0A> 19= 2.168.1.101,lnx_clnt_101,lnx_clnt_101.domain.com=A0=0A> ssh-rsa AAAAB3Nz...= =0A> =0A> Following should also exist in=0A> /home/mahmood/.ssh/known_hosts= file on the client side:=0A> 192.168.1.1,lnx_srvr_1,lnx_srvr_1.domain.com= =A0 ssh-rsa=0A> AAAAB3Nz...=0A> =0A> Ensure that .ssh directory on both cli= ent and server are=0A> rwx for owner only and group/rest of world is 000.= =0A> =0A> Hope this helps! Good Luck! :)=0A> =0A> Regards,=0A> Sharad=A0 = =0A> --- On Thu, 28/4/11, Mahmood Naderan <[email protected]>=0A> wrote:= =0A> =0A> > From: Mahmood Naderan <[email protected]>=0A> > Subject: Re:= problem with HostbasedAuthentication=0A> > To: "Sharad" <sharad2011@yahoo.= com>=0A> > Cc: "[email protected]"=0A> <secureshell@securityfoc= us.com>=0A> > Date: Thursday, 28 April, 2011, 3:54 PM=0A> > Can you explain= exactly which file I=0A> > should edit? What is FQDN? By 'hostname', Do yo= u mean=0A> server=0A> > hostname of client hostname. =0A> > Should I do tha= t on both side or server side?...=0A> > =0A> > // Naderan *Mahmood;=0A> > = =0A> > =0A> > ----- Original Message -----=0A> > From: Sharad <sharad2011@y= ahoo.com>=0A> > To: Mahmood Naderan <[email protected]>;=0A> > Asif Iqba= l <[email protected]>=0A> > Cc: "[email protected]"=0A> > <secur= [email protected]>=0A> > Sent: Thursday, April 28, 2011 1:16 PM=0A> = > Subject: Re: problem with HostbasedAuthentication=0A> > =0A> > Sometimes = the issue lies with hostname as well. What I=0A> mean=0A> > with that is th= e known_hosts may have just the host=0A> name=0A> > where as when the conne= ction is established, the debug=0A> shows=0A> > the FQDN. I faced this issu= e so to be sure, I edited=0A> the=0A> > known_hosts file and inserted the h= ostname, hostname's=0A> FQDN=0A> > and it's IP address (all comma separated= ).=0A> > =0A> > Also ensure that you both the hosts' known_hosts files=0A> = have=0A> > opposite servers names (as prescribed above). =0A> > =0A> > All = the above checks makes it work for me.=0A> > =0A> > Hope this solves.=0A> >= =0A> > Kind regards,=0A> > Sharad=0A> > --- On Thu, 28/4/11, Asif Iqbal <v= [email protected]>=0A> > wrote:=0A> > =0A> > > From: Asif Iqbal <vadud3@gmail= .com>=0A> > > Subject: Re: problem with=0A> HostbasedAuthentication=0A> > >= To: "Mahmood Naderan" <[email protected]>=0A> > > Cc: "secureshell@secu= rityfocus.com"=0A> > <[email protected]>=0A> > > Date: Thursday= , 28 April, 2011, 12:38 AM=0A> > > On Wed, Apr 27, 2011 at 1:12 AM,=0A> > >= Mahmood Naderan <[email protected]>=0A> > > wrote:=0A> > > >>Change the= order method. Have hostbased=0A> > before=0A> > > password=0A> > > >=0A> >= > > Sorry where should I do that?=0A> > > =0A> > > man ssh_config and look= into=0A> PreferredAuthentications=0A> > > =0A> > > >=0A> > > > // Naderan = *Mahmood;=0A> > > >=0A> > > > From: Asif Iqbal <[email protected]>=0A> > > >= To: Mahmood Naderan <[email protected]>=0A> > > > Cc: "secureshell@secu= rityfocus.com"=0A> > > <[email protected]>=0A> > > > Sent: Wedn= esday, April 27, 2011 9:17 AM=0A> > > > Subject: Re: problem with=0A> > Hos= tbasedAuthentication=0A> > > >=0A> > > >=0A> > > > Change the order method.= Have hostbased=0A> before=0A> > > password=0A> > > > On Apr 26, 2011 11:52= PM, "Mahmood Naderan"=0A> > <[email protected]>=0A> > > wrote:=0A> > > = >>=0A> > > >>=0A> > > >> Hi,=0A> > > >> I am trying to setup a hostbased=0A= > passwrodless=0A> > ssh=0A> > > from a client to a server using this guide= http://www.ehow.com/how_7621307_set-up-hostbased-authentication.html.=0A> = > > >>=0A> > > >> The client looks like:=0A> > > >>=0A> > > >> mahmood@clie= nt:~$ cat=0A> /etc/ssh/ssh_config=A0 |=0A> > grep=0A> > > "HostbasedAuthent= ication"=0A> > > >> =A0=A0 HostbasedAuthentication yes=0A> > > >> mahmood@c= lient:~$ cat=0A> /etc/ssh/ssh_config=A0 |=0A> > grep=0A> > > "EnableSSHKeys= ign"=0A> > > >> =A0=A0 EnableSSHKeysign yes=0A> > > >>=0A> > > >>=0A> > > >= > and the server looks like:=0A> > > >> mahmood@server:~$ cat=0A> /etc/ssh/= sshd_config=A0=0A> > |=0A> > > grep "HostbasedAuthentication"=0A> > > >> Ho= stbasedAuthentication yes=0A> > > >> mahmood@server:~$ cat=0A> /etc/ssh/ssh= d_config=A0=0A> > |=0A> > > grep "IgnoreRhosts"=0A> > > >> IgnoreRhosts no= =0A> > > >>=0A> > > >> also the server has the key for client:=0A> > > >>= =0A> > > >> mahmood@server:~$ cat=0A> > /etc/ssh/ssh_known_hosts=0A> > > >>= client ssh-rsa AAAAB3Nz.....=0A> > > >>=0A> > > >> the ~/.shosts file on t= he server=0A> contains:=0A> > > >> mahmood@server:~$ cat .shosts=0A> > > >>= client.domain mahmood=0A> > > >>=0A> > > >> Then on both server and client= , the ssh=0A> > service is=0A> > > restarted:=0A> > > >> mahmood@client:~$ = sudo service ssh=0A> restart=0A> > > >> ssh start/running, process 1355=0A>= > > >> mahmood@server:~$ sudo service ssh=0A> restart=0A> > > >> ssh start= /running, process 28982=0A> > > >>=0A> > > >> How, when I run "ssh -vvv ser= ver" from=0A> client=0A> > (to=0A> > > show the verbose messages), I still = get the=0A> password=0A> > > prompt.=0A> > > >>=0A> > > >> mahmood@client:~= $ ssh -vvv server=0A> > > >> OpenSSH_5.3p1 Debian-3ubuntu6, OpenSSL=0A> 0.9= .8k=0A> > 25=0A> > > Mar 2009=0A> > > >> debug1: Reading configuration data= =0A> > > /etc/ssh/ssh_config=0A> > > >> debug1: Applying options for *=0A> = > > >> debug2: ssh_connect: needpriv 0=0A> > > >> debug1: Connecting to ser= ver=0A> [192.168.1.1]=0A> > port=0A> > > 22.=0A> > > >> debug1: Connection = established.=0A> > > >> debug1: identity file=0A> > /home/mahmood/.ssh/iden= tity=0A> > > type -1=0A> > > >> debug1: identity file=0A> > /home/mahmood/.= ssh/id_rsa=0A> > > type -1=0A> > > >> debug1: identity file=0A> > /home/mah= mood/.ssh/id_dsa=0A> > > type -1=0A> > > >> debug1: Remote protocol version= 2.0,=0A> remote=0A> > > software version OpenSSH_5.3p1 Debian-3ubuntu4=0A>= > > >> debug1: match: OpenSSH_5.3p1=0A> Debian-3ubuntu4=0A> > pat=0A> > > = OpenSSH*=0A> > > >> debug1: Enabling compatibility mode for=0A> > protocol= =0A> > > 2.0=0A> > > >> debug1: Local version string=0A> > SSH-2.0-OpenSSH_= 5.3p1=0A> > > Debian-3ubuntu6=0A> > > >> debug2: fd 3 setting O_NONBLOCK=0A= > > > >> debug1: SSH2_MSG_KEXINIT sent=0A> > > >> debug3: Wrote 792 bytes f= or a total of=0A> 831=0A> > > >> debug1: SSH2_MSG_KEXINIT received=0A> > > = >> debug2: kex_parse_kexinit:=0A> > >=0A> >=0A> diffie-hellman-group-exchan= ge-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,di= ffie-hellman-=0A> > > >> group1-sha1=0A> > > >> debug2: kex_parse_kexinit:= =0A> ssh-rsa,ssh-dss=0A> > > >> debug2: kex_parse_kexinit:=0A> > >=0A> >=0A= > aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cb= c,blowfish-cbc,cast128-cbc,aes192-=0A> > > >> cbc,aes256-cbc,arcfour,rijnda= [email protected]=0A> > > >> debug2: kex_parse_kexinit:=0A> > >=0A> >= =0A> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des= -cbc,blowfish-cbc,cast128-cbc,aes192-=0A> > > >> cbc,aes256-cbc,arcfour,rij= [email protected]=0A> > > >> debug2: kex_parse_kexinit:=0A> > hmac-m= d5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],= hmac-sha1-96,hmac-=0A> > > >> md5-96=0A> > > >> debug2: kex_parse_kexinit:= =0A> > hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,hmac-ripemd160= @openssh.com,hmac-sha1-96,hmac-=0A> > > >> md5-96=0A> > > >> debug2: kex_pa= rse_kexinit: none,[email protected],zlib=0A> > > >> debug2: kex_parse_kexini= t: none,[email protected],zlib=0A> > > >> debug2: kex_parse_kexinit:=0A> > >= >> debug2: kex_parse_kexinit:=0A> > > >> debug2: kex_parse_kexinit:=0A> fi= rst_kex_follows=0A> > 0=0A> > > >> debug2: kex_parse_kexinit: reserved 0=0A= > > > >> debug2: kex_parse_kexinit:=0A> > >=0A> >=0A> diffie-hellman-group-= exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-s= ha1,diffie-hellman-=0A> > > >> group1-sha1=0A> > > >> debug2: kex_parse_kex= init:=0A> ssh-rsa,ssh-dss=0A> > > >> debug2: kex_parse_kexinit:=0A> > >=0A>= >=0A> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3d= es-cbc,blowfish-cbc,cast128-cbc,aes192-=0A> > > >> cbc,aes256-cbc,arcfour,r= [email protected]=0A> > > >> debug2: kex_parse_kexinit:=0A> > >=0A= > >=0A> aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3= des-cbc,blowfish-cbc,cast128-cbc,aes192-=0A> > > >> cbc,aes256-cbc,arcfour,= [email protected]=0A> > > >> debug2: kex_parse_kexinit:=0A> > hma= c-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected]= om,hmac-sha1-96,hmac-=0A> > > >> md5-96=0A> > > >> debug2: kex_parse_kexini= t:=0A> > hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,hmac-ripemd1= [email protected],hmac-sha1-96,hmac-=0A> > > >> md5-96=0A> > > >> debug2: kex_= parse_kexinit: none,[email protected]=0A> > > >> debug2: kex_parse_kexinit: = none,[email protected]=0A> > > >> debug2: kex_parse_kexinit:=0A> > > >> debu= g2: kex_parse_kexinit:=0A> > > >> debug2: kex_parse_kexinit:=0A> first_kex_= follows=0A> > 0=0A> > > >> debug2: kex_parse_kexinit: reserved 0=0A> > > >>= debug2: mac_setup: found hmac-md5=0A> > > >> debug1: kex: server->client= =0A> aes128-ctr=0A> > hmac-md5=0A> > > none=0A> > > >> debug2: mac_setup: f= ound hmac-md5=0A> > > >> debug1: kex: client->server=0A> aes128-ctr=0A> > h= mac-md5=0A> > > none=0A> > > >> debug1:=0A> > >=0A> SSH2_MSG_KEX_DH_GEX_REQ= UEST(1024<1024<8192)=0A> > sent=0A> > > >> debug1: expecting=0A> SSH2_MSG_K= EX_DH_GEX_GROUP=0A> > > >> debug3: Wrote 24 bytes for a total of=0A> 855=0A= > > > >> debug2: dh_gen_key: priv key bits set:=0A> > 124/256=0A> > > >> de= bug2: bits set: 507/1024=0A> > > >> debug1: SSH2_MSG_KEX_DH_GEX_INIT sent= =0A> > > >> debug1: expecting=0A> SSH2_MSG_KEX_DH_GEX_REPLY=0A> > > >> debu= g3: Wrote 144 bytes for a total of=0A> 999=0A> > > >> debug3: check_host_in= _hostfile:=0A> filename=0A> > > /home/mahmood/.ssh/known_hosts=0A> > > >> d= ebug3: check_host_in_hostfile: match=0A> line 1=0A> > > >> debug3: check_ho= st_in_hostfile:=0A> filename=0A> > > /home/mahmood/.ssh/known_hosts=0A> > >= >> debug3: check_host_in_hostfile: match=0A> line 2=0A> > > >> debug1: Hos= t 'server' is known and=0A> matches=0A> > the RSA=0A> > > host key.=0A> > >= >> debug1: Found key in=0A> > > /home/mahmood/.ssh/known_hosts:1=0A> > > >= > debug2: bits set: 503/1024=0A> > > >> debug1: ssh_rsa_verify: signature= =0A> correct=0A> > > >> debug2: kex_derive_keys=0A> > > >> debug2: set_newk= eys: mode 1=0A> > > >> debug1: SSH2_MSG_NEWKEYS sent=0A> > > >> debug1: exp= ecting SSH2_MSG_NEWKEYS=0A> > > >> debug3: Wrote 16 bytes for a total of=0A= > 1015=0A> > > >> debug2: set_newkeys: mode 0=0A> > > >> debug1: SSH2_MSG_N= EWKEYS received=0A> > > >> debug1: SSH2_MSG_SERVICE_REQUEST sent=0A> > > >>= debug3: Wrote 48 bytes for a total of=0A> 1063=0A> > > >> debug2: service_= accept: ssh-userauth=0A> > > >> debug1: SSH2_MSG_SERVICE_ACCEPT=0A> receive= d=0A> > > >> debug2: key:=0A> /home/mahmood/.ssh/identity=0A> > ((nil))=0A>= > > >> debug2: key: /home/mahmood/.ssh/id_rsa=0A> > ((nil))=0A> > > >> deb= ug2: key: /home/mahmood/.ssh/id_dsa=0A> > ((nil))=0A> > > >> debug3: Wrote = 64 bytes for a total of=0A> 1127=0A> > > >> debug1: Authentications that ca= n=0A> continue:=0A> > > publickey,password,hostbased=0A> > > >> debug3: sta= rt over, passed a different=0A> list=0A> > > publickey,password,hostbased= =0A> > > >> debug3: preferred=0A> > >=0A> >=0A> gssapi-keyex,gssapi-with-mi= c,gssapi,hostbased,publickey,keyboard-interactive,password=0A> > > >> debug= 3: authmethod_lookup hostbased=0A> > > >> debug3: remaining preferred:=0A> = > > publickey,keyboard-interactive,password=0A> > > >> debug3: authmethod_i= s_enabled hostbased=0A> > > >> debug1: Next authentication method:=0A> > ho= stbased=0A> > > >> debug2: userauth_hostbased: chost=0A> client.=0A> > > >>= debug2: ssh_keysign called=0A> > > >> debug3: ssh_msg_send: type 2=0A> > >= >> debug3: ssh_msg_recv entering=0A> > > >> debug1: permanently_drop_suid:= 1000=0A> > > >> debug2: we sent a hostbased packet, wait=0A> for=0A> > > r= eply=0A> > > >> debug3: Wrote 608 bytes for a total of=0A> 1735=0A> > > >> = debug1: Authentications that can=0A> continue:=0A> > > publickey,password,h= ostbased=0A> > > >> debug2: userauth_hostbased: chost=0A> client.=0A> > > >= > debug2: ssh_keysign called=0A> > > >> debug3: ssh_msg_send: type 2=0A> > = > >> debug3: ssh_msg_recv entering=0A> > > >> debug1: permanently_drop_suid= : 1000=0A> > > >> debug2: we sent a hostbased packet, wait=0A> for=0A> > > = reply=0A> > > >> debug3: Wrote 672 bytes for a total of=0A> 2407=0A> > > >>= debug1: Authentications that can=0A> continue:=0A> > > publickey,password,= hostbased=0A> > > >> debug1: No more client hostkeys for=0A> > hostbased=0A= > > > authentication.=0A> > > >> debug2: we did not send a packet,=0A> disa= ble=0A> > method=0A> > > >> debug3: authmethod_lookup publickey=0A> > > >> = debug3: remaining preferred:=0A> > > keyboard-interactive,password=0A> > > = >> debug3: authmethod_is_enabled publickey=0A> > > >> debug1: Next authenti= cation method:=0A> > publickey=0A> > > >> debug1: Trying private key:=0A> >= > /home/mahmood/.ssh/identity=0A> > > >> debug3: no such identity:=0A> > >= /home/mahmood/.ssh/identity=0A> > > >> debug1: Trying private key:=0A> > >= /home/mahmood/.ssh/id_rsa=0A> > > >> debug3: no such identity:=0A> > > /ho= me/mahmood/.ssh/id_rsa=0A> > > >> debug1: Trying private key:=0A> > > /home= /mahmood/.ssh/id_dsa=0A> > > >> debug3: no such identity:=0A> > > /home/mah= mood/.ssh/id_dsa=0A> > > >> debug2: we did not send a packet,=0A> disable= =0A> > method=0A> > > >> debug3: authmethod_lookup password=0A> > > >> debu= g3: remaining preferred: ,password=0A> > > >> debug3: authmethod_is_enabled= password=0A> > > >> debug1: Next authentication method:=0A> password=0A> >= > >> mahmood@server's password:=0A> > > >>=0A> > > >>=0A> > > >> Any idea = about that?=0A> > > >>=0A> > > >> // Naderan *Mahmood;=0A> > > >>=0A> > > >= =0A> > > =0A> > > =0A> > > =0A> > > -- =0A> > > Asif Iqbal=0A> > > PGP Key:= 0xE62693C5 KeyServer: pgp.mit.edu=0A> > > A: Because it messes up the orde= r in which=0A> people=0A> > normally=0A> > > read text.=0A> > > Q: Why is t= op-posting such a bad thing?=0A> > >=0A> >=0A> =0A>