sftp - key host pair

[so.nimda]

Hi,

I am trying to sftp from a hpux host to a windows server without password prompt by exchanging key host pair.

I have managed to generate a key "ssh-keygen -t dsa" and files "id_dsa" & "id_dsa.pub" have been created in dir .ssh.

Now, I'm not sure how to proceed :
- should I send "id_dsa.pub" over to the windows server? How should Windows process this file?
- should I also be receiving a similar file from windows? Where should I keep in ux?

Windows is running TitanFTP Server.

Thanks in advance.

[Matti_Kurkela · Accepted solution]

Yes, you should send the id_dsa.pub to the windows server. In there, you should somehow associate the key file with the Windows user account you are going to use for SFTP.

Looks like the manufacturer of TitanFTP has written a Quick Start Guide about this:

http://www.southrivertechnologies.com/docs/Quick%20Start%20Guides/Titan%20FTP/QS-Titan_FTP_SFTP_Host_Key_Authentication.pdf

See steps 18-24 of the listed procedure.

Note: The SSH/SFTP protocol includes two kinds of cryptographic keys:
- "Host keys" to allow the client to reliably identify the server he/she is connecting to.
- "User keys" to optionally allow the server to authenticate client users without using passwords.

TitanFTP confuses the issue by calling both kinds of keys "host keys". They are identical in structure, but their purpose is different.

The host key is generated at the server side. Any SSH/SFTP server MUST offer a host key to the client - this is a protocol requirement.

If the client has not connected to this server before, the client usually requires the user to confirm the connection (usually with a friendly message requiring you to confirm the identity of the server you're connecting to), then stores the host key for future use.

If the client has a previously-stored host key for this server, it is compared to the host key sent by the server at the beginning of the connection - and if the keys are different, the client will display a BIG warning message: either the server has been reinstalled or your connection has been diverted to a fake server.


The user keys are generated at the client side and the public half of the key can be sent to the server to allow you to authenticate without passwords, exactly as you've doing now.

If you're connecting from HP-UX to Windows only, you don't need to receive an user key file from the Windows server. The file transfer direction is not important: after the connection is opened, you can use it to both upload & download ("push" and "pull" from the client's point of view) files between your HP-UX client and the Windows server.

But if you need the Windows machine to connect to your HP-UX machine and initiate file transfers, then the Windows machine is acting as a client and HP-UX is the server. In this case, you should create a SSH key for the user running the SFTP commands at the Windows side, and copy the id_dsa.pub to the .ssh/authorized_keys file of the destination user at the HP-UX side. This file can take several keys if necessary; the format is one key per line. The lines may be *very* long.

MK

[so.nimda]

Hi MK,

Thanks very much for your detailed and prompt reply.

I will give it a try and update this post on the outcome.

Thanks once again !

[so.nimda]

Hi,

Some updates :

Executing sftp from the command prompt doesn't prompt for password, so I guess the importing of id_dsa.pub into the windows server worked.

However, when I run sftp as a background job, say, via crontab, I'm getting the error :

"Host key verification failed."

What could have caused this?

The sftp is executed (in both the cases, via command prompt & as background) using an ID and not as "root".

Thanks

[Matti_Kurkela]

"Host key verification failed" indicates that either the client did not have the server's host key in its ~/.ssh/known_hosts file and could not ask the user to confirm it (because it's running from crontab), or the server is now using a host key that is not the same as before.

The host key is stored in the known_hosts file and associated with the hostname you typed - so if you tested sftp with a short form of the name ("sftp user@servername") and then set up the cron job using a long form ("sftp user@servername.domain.example"), the sftp command does not know these two are actually the same server.

Use "su - userid" to become the user that is going to run the cron job, then run the exact same sftp command that you're using in your cron job.

You will see either a request to confirm the host key of the Windows server (on the first try only) or a big warning telling you that the server's host key has changed (meaning that someone might be redirecting your connection to another server).

MK

[so.nimda]

Hi MK,

Thanks once again for your reply. =)

In ~/.ssh/known_hosts, there are 2 entries - one for IP address and one for hostname (not fully qualified domain name). Both refer to the same server (as indicated in /etc/hosts file)

I have tried "su - userid" and execute the sftp with both IP address & hostname via the command prompt and both had no problems - I was able to connect to the windows server successfully without being prompted for password.

What else should I be looking out for?

Thanks

[so.nimda]

Hi MK,

Found the problem... and you are right...

the script was run under a different ID...

thanks for the patience and pointing me in the right direction...

thanks !

[so.nimda]

Problem resovled