SSH, The Secure Shell: The Definitive Guide, 2nd Edition

Hostbased Access Control

A limited type of per-account configuration is possible in OpenSSH if you use hostbased authentication rather than public-key authentication. Specifically, you can permit SSH access to your account based on the client’s remote username and hostname via the system files /etc/shosts.equiv and /etc/hosts.equiv, and personal files ~/.rhosts and ~/.shosts. A line like:

    +client.example.com jones

permits hostbased SSH access by the user [e-mail]. Since we’ve already covered the details of these four files, we won’t repeat the information in this chapter. [3.6.2]

Per-account configuration with hostbased authentication is similar to using host access control in your OpenSSH authorized_keys or Tectia authorization file. [8.2.4] Both methods may restrict SSH connections from particular hosts. The differences are shown in this table:

Feature	Hostbased access	Public-key host access
Authenticate by hostname	Yes	Yes
Authenticate by IP address	Yes	Yes
Authenticate by remote username	Yes	No
Wildcards in hostnames and IP	No	Yes
Passphrase required for logins	No	Yes
Use other public-key features	No	Yes
Security	Less	More

To use hostbased authentication for access control, all of the following conditions must be true:

• Hostbased authentication is enabled in the server, both at compile time and in the serverwide configuration file.

• Your desired client hosts aren’t specifically excluded by serverwide configuration, e.g., by AllowHosts and DenyHosts.

• For OpenSSH, the server configuration ...