| All Forums |
Register |
Login |
Search |
Subscriptions |
My Profile |
Inbox |
| Tool Warehouse |
FAQs |
Resources |
Help |
Member List |
Address Book |
Logout |
|
|
ssh password-less login from Tectia client
|
Logged in as: Guest |
| Users viewing this topic: none |
|
Login  |
|
|
 ssh password-less login from Tectia client - May 5, '05, 9:07:54 AM
|
|
|
zaphod_fl
Posts: 12
Joined: Mar. 29, '05,
Status: offline
|
I have had this working, on this box pair, but had to move the SFU to the D: drive from the C: drive. No big deal, right!?!?
Solaris 8 box using Tectia SSH2 to login to an OpenSSH SFU Server. Followed the directions on the Tectia website (as I have done before.) I can passwordless login from the SFU client to the Solaris box, but not visa-versa.
I new I would have to regen the keys, etc. so I did all that.
When I ssh from the Solaris box to the SFU box it always asks for a password. I have the Identity and Authorization files setup and have put the public key on the SFU box in the users .ssh directory. Then issued the keygen -i -f command on the public file.
Any thoughts???
Rick
|
|
|
|
|
RE: ssh password-less login from Tectia client - May 5, '05, 11:35:14 AM
|
|
|
Rodney
Posts: 3728
Joined: Jul. 9, '02,
From: /Tools lab
Status: offline
|
> ... No big deal, right!?!?
Shouldn't be. Always best that the drives are NTFS.
> Any thoughts???
Did you set up a home directory for the user account in the user database?
That is what does finger -l username show for the home directory?
|
|
|
|
|
RE: ssh password-less login from Tectia client - May 5, '05, 1:39:35 PM
|
|
|
zaphod_fl
Posts: 12
Joined: Mar. 29, '05,
Status: offline
|
Yup. Shows it properly
/dev/fs/D/SFU/export/home/sadmin
the .ssh directory is under here.
|
|
|
|
|
RE: ssh password-less login from Tectia client - May 10, '05, 10:21:39 AM
|
|
|
zaphod_fl
Posts: 12
Joined: Mar. 29, '05,
Status: offline
|
Bump...
Any help?????
|
|
|
|
|
RE: ssh password-less login from Tectia client - May 10, '05, 12:16:14 PM
|
|
|
Rodney
Posts: 3728
Joined: Jul. 9, '02,
From: /Tools lab
Status: offline
|
Here's what I do and it works:
- two machines: 'A' and 'B' both running Interix OpenSSH current
- on 'A' (client side) I ran ssh-keygen -t rsa
- then I sftp B and put the ~/.ssh/id_rsa.pub from 'A' to 'B' as file ~/.ssh/authorized_keys
Now I can passwordless ssh login from 'A' to 'B' (server side).
In this case I did not have an existing authorized_keys file on 'B' so
sftp it over was fine. Otherwise I'd append the contents of id_rsa.pub
to the server side file authorized_keys. But you should not have the file
id_rsa.pub from 'A' (client side) on 'B' (server side). You only need the
generated key in the authorized_keys file on the server side ('B').
The file mode for authorized_keys should be 0644 (rw-r--r--) on 'B'.
So check the file mode for authorized_keys.
Try removing authorized_keys (in case it has an old key that is being found
for the client host ('A') before your most recent key re-generation) then add the
latest key.
|
|
|
|
|
RE: ssh password-less login from Tectia client - Jul. 5, '05, 12:18:20 PM
|
|
|
tiggerfink
Posts: 13
Joined: Jun. 30, '05,
Status: offline
|
I am having problems with my RSA login. I have done the following:
1. When I sftp to server test, I am in the the directory of d:\sfu\.
2. I created a folder for user test in SFU and then created a .ssh folder. It looks like this: sfu\test\.ssh
3. At workstation, I created the rsa key and copy it over to the .ssh folder of test. I saved it as authorized_keys
4. I then login as "ssh X+test@testserver"
I am still getting a password prompt, so is there something else I need to do?
|
|
|
|
|
RE: ssh password-less login from Tectia client - Jul. 5, '05, 12:58:40 PM
|
|
|
Rodney
Posts: 3728
Joined: Jul. 9, '02,
From: /Tools lab
Status: offline
|
Yes, you need to properly set a home directory for the user.
Refer to the FAQ entries under Administration for this.
If you don't set the home directory then you don't have security of the files.
You ned to make sure the file/directory access is not too permissive.
< Message edited by Rodney -- Jul. 5, '05, 1:33:21 PM >
|
|
|
|
|
RE: ssh password-less login from Tectia client - Jul. 5, '05, 2:24:39 PM
|
|
|
tiggerfink
Posts: 13
Joined: Jun. 30, '05,
Status: offline
|
I read the two FAQs and setup the home diredctory in AD. I use the command below to login but still have to type in my password.
3.08 – How can I verify what a user's home directory is in the user database?
3.09 – How do I properly set a user's home directory?
I created the following:
sfu\home\test
sfu\home\test\.ssh
ssh -i "private key name" hq+test@testserver
bash-3.00$ ssh -i test hq+test@testserver
hq+test@testserver's password:
Welcome to the Interix UNIX utilities.
DISPLAY=localhost:0.0
$ pwd
/dev/fs/Z/SFU/home/test
$ dir
Volume in drive Z is New Volume
Volume Serial Number is B4FF-DCE5
Directory of Z:\SFU\home\test
07/05/2005 01:03 PM <DIR> .
07/05/2005 01:03 PM <DIR> ..
07/05/2005 01:01 PM <DIR> .ssh
07/05/2005 01:00 PM 227 authorized_keys
1 File(s) 227 bytes
3 Dir(s) 6,854,090,752 bytes free
$
|
|
|
|
|
RE: ssh password-less login from Tectia client - Jul. 5, '05, 3:09:22 PM
|
|
|
Rodney
Posts: 3728
Joined: Jul. 9, '02,
From: /Tools lab
Status: offline
|
Okay, stop giving Win32 style information. This is Unix.
If you created the user's home directory with Win32 then get rid of it
and start again using the Interix/Unix utilities. The Win32 tools don't
create correct ACE's in the ACL's.
You have specified the "Z" drive: did you install SFU on a network filesystem?
This is a "no-no". You need to install on a local NTFS filesystem.
For passwordless login to work you need to have the user's home directory
on a disk local to the machine. Interix can have "carte blanche" access to
the local drives (as root on other Unix systems). You need to have specified
that "setuid" is turned on when you installed (refer to the FAQ otherwise).
With the power of setuid 'on' the ssh daemon can then read the key file of
the user to decide if access is to be granted. If setuid is off or the drive
is a network filesystem then access cannot be had and you will be asked for
a password. "Carte Blanche" access to network FS's are not allowed as this
would be too big a security hole to permit.
|
|
|
|
|
RE: ssh password-less login from Tectia client - Jul. 5, '05, 3:47:41 PM
|
|
|
tiggerfink
Posts: 13
Joined: Jun. 30, '05,
Status: offline
|
The Z drive is a local Clariion drive. It is not a network drive. Setuid is on.
What is the name of the Interix/Unix utilities to create home directories?
|
|
|
|
|
RE: ssh password-less login from Tectia client - Jul. 5, '05, 4:08:37 PM
|
|
|
Rodney
Posts: 3728
Joined: Jul. 9, '02,
From: /Tools lab
Status: offline
|
mkdir and chown and chmod. Ther are manual pages for
all of these (i.e. "man mkdir). e.g.:
% mkdir -p /home/kanga
% chown kanga /home/kanga
% chmod 754 /home/kanga
Plus, if you run the ssh client to connect to somewhere, it will create
the ~/.ssh directory correctly.
|
|
|
|
|
RE: ssh password-less login from Tectia client - Jul. 5, '05, 4:20:11 PM
|
|
|
tiggerfink
Posts: 13
Joined: Jun. 30, '05,
Status: offline
|
Does Interix have a equivalent to user add?
|
|
|
|
|
RE: ssh password-less login from Tectia client - Jul. 5, '05, 5:38:22 PM
|
|
|
Rodney
Posts: 3728
Joined: Jul. 9, '02,
From: /Tools lab
Status: offline
|
There is, but it was written for Interix 2.2 and continued to ship in 3.0 and 3.5.
But the changes means it doesn't work. MarkF updated this utility for 3.0 several
months back. You can find a tar-ball of all these on the ftp site:
ftp://ftp.interopsystems.com/beta/sysadmin-examples-interix30.tar
It has three tools: userdel, useradd and usermod.
|
|
|
|
|
[Deleted] - Jul. 6, '05, 10:08:39 AM
|
|
|
tiggerfink
|
Post has been moved to the Recycle Bin at Jul. 6, '05, 11:13:38 AM by tiggerfink
|
|
|
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
|
 Locked w/ New Messages |
 Locked w/o New Messages |
|
 Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts |
|
|
|
Printable Version
