SSH host based auth. quesion

[Thomas A. Williams]

Question:

Using host based authentication, is it possible to restrict to a single user on a remote (client) node to only have access to a single account on the local (server) node?

I'm under the impression that if you specify a trusted host and user in the shosts.equiv file, that gives that user access to _ALL_ accounts on the local (i.e. server) node. Am I correct?

[Volker Halle]

Thomas,

an initial test on OpenVMS Alpha V8.2 and TCPIP V5.5 seems to support your impression.

Once I add 'client.node.domain user' to SYS$SYSDEVICE:[TCPIP$SSH.SSH2]SHOSTS.EQUIV on the server (after copying all required host key files), this user can login to all accounts on the host (using $ SSH -l username host) from the SSH client.

There may be SSH options, which would prevent this, but I'm not yet familiar enough with all this stuff. The best docu I've found so far, does not seem to talk about this in enough detail:

http://h71000.www7.hp.com/openvms/products/ssh/ssh.pdf

Volker.

[Volker Halle]

Thomas,

if you don't want a user on the client node to access all accounts on the server by creating an entry in TCPIP$SSH_DEVICE:[TCPIP$SSH]SHOSTS.EQUIV, you could use user-based SHOSTS. files.

In the user's login directory on the SSH server, create a file SYS$LOGIN:SHOSTS. and add the ip name of the SSH client and the user name of the user on the SSH client, which should be allowed host based authenticated access to this user account on the SSH server.

See the chapter: 'Customizing Host-Based Authentication on the Server' in the SSH documentation (page 36).

Volker.

[Arch_Muthiah]

Tom,

I hope this is possible.

Normally the hosts.equiv file is searched first, followed by the user's sys$login:shost/rhost file, if it exists. If any entry in the hosts file cannot override the hosts.equiv file. But there is exception to the system user in the order.

So if you want restrict local account access to any specific ssh client user, edit that local user sys$login:shost/rhost file and enter the same entry you have now in your shosts.equiv file, such as
"rfqdn rusername"

This will allow the specific user remote user to have accesss only to the particular account and it deny access to the other accounts in the server.

Archunan