host-based ssh authentication (no password) not working ... help needed

[Matthew Seaman]

On Sun, Oct 10, 2004 at 12:20:44PM -0700, Joe Schmoe wrote:
> I have machines CLIENT and SERVER.
> 
> On SERVER, I set the following options in
> /etc/ssh/sshd_config :
> 
> RhostsAuthentication      no
> RhostsRSAAuthentication   yes
> 
> Then I copied the host public key from /etc/ssh on
> CLIENT to /etc/ssh/ssh_known_hosts on SERVER - so now
> the SERVER has the CLIENTs public key.
> 
> Finally, I added the hostname of CLIENT to
> /etc/hosts.equiv on SERVER.  Then I HUPped sshd on
> SERVER.
> 
> So now I go to CLIENT and run:
> 
> ssh username at SERVER
> 
> and it asks me for a password!!
> 
> I even tried:
> 
> ssh -1 username at SERVER
> 
> and that didn't work either.  I thought maybe RSA was
> ssh1 only, so I needed to force ssh1 ... but as I
> said, that didn't work either.
> 
> Two questions:
> 
> 1. What am I doing wrong ?

For ssh(1) to work using key based auth, all of the files in
~user/.ssh on the server must have the correct permissions, and the
host public keys for the server should be known to the client machine,
and vice versa.

A good way to diagnose the problem is to run:

    # sshd -d -d -d -p 2222

on the server (ie. turn on maximum debugging output, and run on a
different port than usual).

Then from the client, run:

    % ssh -v -v -v -p 2222 server

The verbose output from sshd will usually tell you exactly what's wrong.
 
> 2. Am I right that using RSA host authentication like
> this will only work with ssh1 ?  If so, how can I use
> ssh2 with host based key sharing ?

No.  Incorrect.  SSH2 uses two possible key types: rsa or dsa.  Use
either -- it makes little practical difference in most situations.
SSH1 uses an older form of RSA, now called rsa1.  You shouldn't use
SSH1 unless you have no other choice -- ie. a system that only
supports SSH1 -- because it is significantly less secure than SSH2.

	Cheers,

	Matthew

-- 
Dr Matthew J Seaman MA, D.Phil.                       26 The Paddocks
                                                      Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey         Marlow
Tel: +44 1628 476614                                  Bucks., SL7 1TH UK
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20041010/bf1eae55/attachment.bin