Linux Security Cookbook

6.8. Authenticating by Trusted Host

Problem

You want to authenticate between an OpenSSH client and server using hostbased or “trusted host” authentication.

Solution

Suppose you want to allow the account [e-mail] access to [e-mail]. Then:

1. Make sure hostbased authentication enabled in on server.foo.net:

                        /etc/ssh/sshd_config:
   HostbasedAuthentication yes
   IgnoreRhosts no

   and optionally (see “Discussion”):

   HostbasedUsesNameFromPacketOnly yes

   and restart sshd.

2. Ensure that the ssh-keysign program is setuid root on the client machine. The file is usually located in /usr/libexec or /usr/libexec/openssh:

   $ ls -lo /usr/libexec/openssh/ssh-keysign
   -rwsr-xr-x   1 root   222936 Mar  7 16:09 /usr/libexec/openssh/ssh-keysign

3. Enable trusted host authentication in your system’s client configuration file: [Recipe 6.12]

                        /etc/ssh/ssh_config:
   Host remotehost
           HostName remotehost
           HostbasedAuthentication yes

4. Insert the client machine’s host keys, /etc/ssh/ssh_host_dsa_key.pub and /etc/ssh/ssh_host_rsa_key.pub, into the server’s known hosts database, /etc/ssh/ssh_known_hosts , using the client host’s canonical name (supplicant.foo.net here; see “Discussion”):

                        /etc/ssh/ssh_known_hosts on server.foo.net:
   supplicant.foo.net ssh-dss ...key...

5. Authorize the client account to log into the server, by creating the file ~/.shosts :

                        ~whosthere/.shosts on server.foo.net:
   supplicant.foo.net nocnoc

   If the account names on the client and server hosts happen to be the same, you can omit the username. ...