Passwordless login

[user001]

Hello,
I'm trying to setup passwordless login on HPUX 11.31.

On our old box the ssh_config has authorized_keys commented out and its working OK.

How else can you setup ssh passwordless login? I thought it could only be done using the authorized_keys file.

Thank you.

[Matti_Kurkela]

The authorized_keys file is used by sshd, not by the ssh client. So you'll find the configuration in sshd_config, not in ssh_config.

Furthermore, the built-in default for user's authorized_keys file is $HOME/.ssh/authorized_keys. It's often included in commented form in sshd_config to document the factory default settings.

To stop SSH passwordless logins, you must explicitly set "PubkeyAuthentication no" (for SSH protocol version 2) and "RSAAuthentication no" (for SSH protocol version 1 which you shouldn't be using anyway).

MK

[AwadheshPandey]

First generate a key for user, login as the user:
cd $HOME
mkdir .ssh
chmod 700 .ssh
cd .ssh
ssh-keygen -b 1024 -t dsa -f identity

copy the identity.pub file on other machine.

$HOME/.ssh//identity.pub >> :$HOME//.ssh/authorized_keys

permissions must be 600.

[Steven Schweda]

> [...] the ssh_config has authorized_keys
> commented out and its working OK.

As the comments in the file should explain,
many SSH configuration files are supplied
with the default settings shown by comments.
So, removing the "#" from such a line may do
approximately nothing. If you wanted to
store your authorized-key data in a file with
some other path/name, _then_ you might want a
non-comment "authorized_keys" directive in
that file.

> On our old box [...]

As usual, adding "-v" (or "-vv", ...) to a
working "ssh" (client) command can reveal
what the thing is doing, and (with enough
v's) the "ssh" diagnostic messages might
mention the use of "authorized_keys" (or
whatever), but if the SSH server is the one
who cares, then you might not hear about it
from the client side.

[user001]

Hi,

thanks for the replies.

I guess i'm looking for alernate ways other than the authorized_keys file. I know how this one works.

I have a couple of HPUX currently connecting without passwords and without the authorized_keys file. So something else is happening here, i think it has something to do with the .shosts file.

I'll keep looking into it.

Thank you.

[Steven Schweda]

> I have a couple of HPUX currently
> connecting without passwords and without
> the authorized_keys file. So something else
> is happening here, [...]

> As usual, adding "-v" (or "-vv", ...) to a
> working "ssh" (client) command can reveal
> what the thing is doing, [...]

Still true.

> i think it has something to do with the
> .shosts file.

There is a "hostbased" authentication scheme,
which you could be using. I don't use it, so
I know nothing, but it sounds plausible here.
Inspection of that "-v[v[v]]" diagnostic
output really might be helpful. Honest.

[user001]

Got it working.

I think i'll be ditching hostbased auth seems less secure than exchanging both host keys on the servers?

i had to import the key into ssh_host_key.

Thank you.

[Steven Schweda · Accepted solution]

> I think i'll be ditching hostbased auth
> seems less secure than exchanging both host
> keys on the servers?

I see a question mark, but I don't see a
question. Have you a question?


> i had to import the key into ssh_host_key.

You may think that this conveys some useful
information, but you may be wrong.


Using "hostbased" authentication can make
sense if you can be sure that any user on one
system should be allowed access (as that same
user) on another system. In that situation,
it can save much effort because each user is
not required to create and distribute his
own private and public keys. If you want
more fine-grained (per-user) control over
access, then it may be less useful.

[user001]

ssh_known_hosts

[Steven Schweda]

> ssh_known_hosts

Thanks for that wonderfully concise
explanation. Future readers are certain to
appreciate its value.

[user001]

i had to put something in....the answer is in previous post seemed pointless repeating myself.