topic Re: SSH host based auth. quesion in Operating System - OpenVMS

SSH host based auth. quesion

Thomas A. Williams — Thu, 02 Mar 2006 12:00:56 GMT

Question:

Using host based authentication, is it possible to restrict to a single user on a remote (client) node to only have access to a single account on the local (server) node?

I'm under the impression that if you specify a trusted host and user in the shosts.equiv file, that gives that user access to _ALL_ accounts on the local (i.e. server) node. Am I correct?

Re: SSH host based auth. quesion

Volker Halle — Thu, 02 Mar 2006 13:05:41 GMT

Thomas,

an initial test on OpenVMS Alpha V8.2 and TCPIP V5.5 seems to support your impression.

Once I add 'client.node.domain user' to SYS$SYSDEVICE:[TCPIP$SSH.SSH2]SHOSTS.EQUIV on the server (after copying all required host key files), this user can login to all accounts on the host (using $ SSH -l username host) from the SSH client.

There may be SSH options, which would prevent this, but I'm not yet familiar enough with all this stuff. The best docu I've found so far, does not seem to talk about this in enough detail:

http://h71000.www7.hp.com/openvms/products/ssh/ssh.pdf

Volker.

Re: SSH host based auth. quesion

Volker Halle — Thu, 02 Mar 2006 13:36:46 GMT

Thomas,

if you don't want a user on the client node to access all accounts on the server by creating an entry in TCPIP$SSH_DEVICE:[TCPIP$SSH]SHOSTS.EQUIV, you could use user-based SHOSTS. files.

In the user's login directory on the SSH server, create a file SYS$LOGIN:SHOSTS. and add the ip name of the SSH client and the user name of the user on the SSH client, which should be allowed host based authenticated access to this user account on the SSH server.

See the chapter: 'Customizing Host-Based Authentication on the Server' in the SSH documentation (page 36).

Volker.

Re: SSH host based auth. quesion

Arch_Muthiah — Thu, 02 Mar 2006 13:58:42 GMT

Tom,

I hope this is possible.

Normally the hosts.equiv file is searched first, followed by the user's sys$login:shost/rhost file, if it exists. If any entry in the hosts file cannot override the hosts.equiv file. But there is exception to the system user in the order.

So if you want restrict local account access to any specific ssh client user, edit that local user sys$login:shost/rhost file and enter the same entry you have now in your shosts.equiv file, such as
"rfqdn rusername"

This will allow the specific user remote user to have accesss only to the particular account and it deny access to the other accounts in the server.

Archunan