Operating System - OpenVMS
cancel
Showing results for 
Search instead for 
Did you mean: 

SSH host based auth. quesion

Thomas A. Williams
Regular Advisor

SSH host based auth. quesion

Question:

Using host based authentication, is it possible to restrict to a single user on a remote (client) node to only have access to a single account on the local (server) node?

I'm under the impression that if you specify a trusted host and user in the shosts.equiv file, that gives that user access to _ALL_ accounts on the local (i.e. server) node. Am I correct?
3 REPLIES
Volker Halle
Honored Contributor

Re: SSH host based auth. quesion

Thomas,

an initial test on OpenVMS Alpha V8.2 and TCPIP V5.5 seems to support your impression.

Once I add 'client.node.domain user' to SYS$SYSDEVICE:[TCPIP$SSH.SSH2]SHOSTS.EQUIV on the server (after copying all required host key files), this user can login to all accounts on the host (using $ SSH -l username host) from the SSH client.

There may be SSH options, which would prevent this, but I'm not yet familiar enough with all this stuff. The best docu I've found so far, does not seem to talk about this in enough detail:

http://h71000.www7.hp.com/openvms/products/ssh/ssh.pdf

Volker.
Volker Halle
Honored Contributor

Re: SSH host based auth. quesion

Thomas,

if you don't want a user on the client node to access all accounts on the server by creating an entry in TCPIP$SSH_DEVICE:[TCPIP$SSH]SHOSTS.EQUIV, you could use user-based SHOSTS. files.

In the user's login directory on the SSH server, create a file SYS$LOGIN:SHOSTS. and add the ip name of the SSH client and the user name of the user on the SSH client, which should be allowed host based authenticated access to this user account on the SSH server.

See the chapter: 'Customizing Host-Based Authentication on the Server' in the SSH documentation (page 36).

Volker.
Arch_Muthiah
Honored Contributor

Re: SSH host based auth. quesion

Tom,

I hope this is possible.

Normally the hosts.equiv file is searched first, followed by the user's sys$login:shost/rhost file, if it exists. If any entry in the hosts file cannot override the hosts.equiv file. But there is exception to the system user in the order.

So if you want restrict local account access to any specific ssh client user, edit that local user sys$login:shost/rhost file and enter the same entry you have now in your shosts.equiv file, such as
"rfqdn rusername"

This will allow the specific user remote user to have accesss only to the particular account and it deny access to the other accounts in the server.

Archunan

Regards
Archie