SSH login using passwordless entry

[Michael Miller_22]

Hello all,

We are running an HP UX 11.x system with OpenSSH 4.1 (HP's latest adaptation). Client
will be either hp ux machine or windows machine.

I'm having trouble setting up passwordless login for ssh.

This is my first time setting this up so I'd like to trace my steps and you can all
tell me what I screwed up :). I take lumps well.

I don't want them running rampant through the system so I ran
/opt/ssh/ssh_chroot_setup.sh allowing them to scp, SFTP, and ssh. For sake of
example, I'll call the user nopassuser.

I set them up so they are homed to /apps/newroot/home/nopassuser.

I then chown'd the directory (since i was root) to nopassuser:users and chmod'd
it to 700. So it looks like this
drwx------ 4 nopassuser users 1024 Sep 27 14:11 nopassuser

Under it I placed the following dirs (nopassuser/.ssh and nopassuser/pub)
drwxr-xr-x 2 nopassuser users 1024 Sep 27 15:25 .ssh
drwxrwxrwx 2 root sys 96 Sep 23 15:51 pub

The pub is just a location to test whether transfer of a file works correctly so
I chmod'd it to 777 when I was testing if they could get in with a password. Yeah,
that worked.

Anyway, within .ssh I have 2 files with 700 permissions
-rwx------ 1 nopassuser users 2481 Sep 27 15:25 authorized_keys
-rwx------ 1 nopassuser users 2481 Sep 27 15:25 authorized_keys2

The people on the client side passed me 4 public keys. They looked like this
ssh-dss *normal junk code* user@servername. I got this in email on my windows work
client. I SFTP'd those to the HP box.

I ceated the authorized_keys2 by "touch" and then inserted the text
with an append.

I believe I probably only need the authorized_keys2 and not the first one.

I haven't restarted the sshd since we have lots of admins in the system.

Am I missing something?

Someone said it would probably be best to check the authorized_keys2 file for
spaces or problems.

Is there a better way to create that file and is it in the correct location and
does it have the correct permissions?

From what I gathered on google, etc., it appears to be.

Thanks for any help!

[Rick Garland]

Did you stop and restart the ssh daemon?

[Michael Miller_22]

>>Did you stop and restart the ssh daemon?

Hello Rick!

No I have not.

And that actually leads me to a question I've had for a while.

When sshd starts up, what types of information are cached into it?

I believe it reads the configuration file so any modification to that requires a kill and restart of sshd.

However, every time I add a user must I restart sshd? And if I add a new key or change the authorized_keys2 (for a user) must I also restart?

I hesitated to do that (restart) since I have multiple admins in the system most of the time.

Thanks for any help!

[Rick Garland]

For configuration changes you should stop/restart sshd.

Your worries about other admins, use the 'kill -HUP ' and there will be no interference.

As to adding users - no.
As to making mods to the keys or hosts - no.

[Michael Miller_22]

>>As to adding users - no.
>>As to making mods to the keys or hosts - no.

Okay, so for your original "restart," that was just a suggestion in case something else was changed?

Only thing I really did was add the new user and establish the authorized_keys2.

Thank you for your help so far! It's good information to have.

[Rick Garland · Accepted solution]

Here is a previous post

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=779355

There is an attachment with this post (look at the post from SEP) and this has a cheat sheet for HPUX Secure Shell.

[Michael Miller_22]

It appears I have the option OFF in the
sshd_config! Duh!

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys

I'm assuming that pubkey defaults to no.

Now, this would make sense heh...

I'll try swapping both and seeing if i can get the oracle dba, other admins off long enough for me to restart.

Thanks.

p.s. Is it a good idea to turn RSA on also?

[Rick Garland]

I do both.

I haven't been hurt by it

[Michael Miller_22]

FYI... I'll assign points later. I have someone testing for me and I've got a few other fires I need to turn my attention to... haven't forgotten ;)

[Michael Miller_22]

Ok, from the cheat sheet and from comments from Rick we got it going.

It was a combination (as I expected it would be) of some stupidity (forgetting to turn on the options in sshd_config) and also having the correct file permissions on dir/auth file.

Thanks again!

[Michael Miller_22]

Ooops, see previous post. Rick, cheat sheet, google... it's all good :)