Unable To Perform A "Passwordless" SSH Login To A Server
Greetings!
I am trying to perform a passwordless SSH login from a HPUX 11.31 client to a HPUX 11.31 server. Whenever I do a "ssh -l root serverA" from the client, I am prompted for a password. Giving the password, I am able to successfully login. However I am trying to accomplish a "passwordless" authentication.
Yes, I have generated the keys on the client and exported them to the /root/.ssh/authorized_keys file on the server
ssh -v is very informative, as is the web. Permissions on keys and their directories are critical, for instance. You can tell ssh which auth to limit itself to, so there is no prompt and it stops. Start with "ssh localhost pwd" and later move to trying the local ip, host name, remote ip, host name.
Okay, I finally discovered what the problem was and fixed it. I would like to share the solution with the members of this thread because, even though the problem is now fixed, there was something in the solution
that I am not understanding (detailed down below).
Upon reading the system log (/var/adm/log/syslog/syslog.log), it reads as follows:
Apr 20 10:33:30 fyman00 sshd[25874]: Authentication refused: bad ownership or modes for directory /root
That, of course, got me in the ballpark...
I then looked at the permissions on /
# ls -al /
drwxrwxrwx 5 root bin 96 Apr 16 14:55 root
At that point, I knew the problem was going to be either "root bin" (improper owner) or "drwxrwxrwx" (incorrect permissions) or a
combination of both on the file /root
To determine which was the culprit, I corrected each one separately and then tested separately.
I then set the ownership to the correct setting: "root root". Retested and still could not achieve a successful passwordless (publickey) login. I then changed the mode to drwxr-xr-x I retested and then, you guessed it, I was able to successfully achieve a passwordless login. The final correction to /root reads as follows:
drwxr-xr-x 5 root root 96 Apr 16 14:55 root
Okay, here is the part that I do not understand: Why, after changing the mode from a LESS restrictive setting (drwxrwxrwx) to a MORE restrictive setting (drwxr-xr-x), why was I then allowed to finally authenticate correctly? This seems so counterintuitve... I'm quite certain that I am overlooking something rather basic...
Any ideas so I can finally put this one to bed? Thanks!
Why, after changing the mode from a LESS restrictive setting (drwxrwxrwx) to a MORE restrictive setting (drwxr-xr-x), why was I then allowed to finally authenticate correctly?
ssh refuses to operate on keys with incorrect permissions for security reasons. If /root is world-writable, there's no telling who actually put the keys in there!
ssh refuses to operate on keys with incorrect permissions for security reasons. If /root is world-writable, there's no telling who actually put the keys in there!
So, are you saying that the ssh application decides what permissions
are correct/incorrect?
No, sanity. No user should be able to change or steal another's keys, say to allow them to log in without password and no permissions.
I understand the underlying meaning of what you are saying...that the
/root directory (which contains the public key) should always be secure.
What I am asking...is....what is the mechanism which drives the enforcement of the permissions? In other words, what I am asking is
what is actually causing the ssh public key authentication to actually
become disabled when directory level permissions on /root are loosened
rather than tightened.... Stated anothery way... is it the unix operating system or is it the ssh application itself which causes public key authentication to fail? Thanks.
Hello,
What is its mean? Could you please help me?
Best regards,
root@nimserver:/> nimadm -j nimadmvg -c dev4 -s spot1 -l lpp_source1 -d "hdisk7" -Y
Initializing the NIM master.
Initializing NIM client dev4.
0042-006 c_rsh: (exec_nimsh_cmd) exec_cmd Error 0
poll: setup failure... (2 Replies)
Please can you help me understand the significance of providing arguments under sh -s in
> ssh -qtt ${user}@${host} "sh -s "${version}"" < test.sh (4 Replies)
Hello,
Using AIX 6.1 boxes.
User user1 connects from box A to box B using ssh.
When password authentication is used everything is fine. When I configure user1 to use public key authentication sftp client works fine(no password asked), but ssh client fails. This is sshd log:
Accepted publickey... (3 Replies)
Q1
I want to allow particular user only to login into root using ssh.
I have set PermitRootLogin no for security purpose but I want to allow some of
the users to login as a root using ssh how to do this?
I have tried with Allowusers user1 user2 its working for only the user1 and... (3 Replies)
Hello,
I am new to this forums and this is my first "asking help" message!
i have 2 problems:
1- for unknown reasons the "source" command is not avalable in my system (UBUNTU). i can't either see it in my bin directory!
2- again for unknown reasons the "login.cl" file in the home... (0 Replies)
Hi Folks,
I am writing a shell script that can logon to remote machine automatically. But, I am facing one problem. I am using "ssh" command in script and while login into remote machine it asks for passowrd and it stops for STDIN input for password. I want my script to supply password... (2 Replies)
Hi
I have installed solaris 10 on an intel machine. Logged in as root. In CDE, i open terminal session, type login alex (normal user account) and password and i get this message
No utpmx entry: you must exec "login" from lowest level "shell" :confused:
What i want is: open various... (0 Replies)
