Date: Thu, 01 Jul 1999 18:59:39 -0400 (EDT) From: John Baldwin <jobaldwi@vt.edu> To: cjclark@home.com Cc: freebsd-security@FreeBSD.ORG, freebsd-questions@FreeBSD.ORG, (Robert Sowders) <rsowders@usgs.gov> Subject: Re: SSH Working Like rsh Message-ID: <199907012259.SAA17933@smtp3.erols.com> In-Reply-To: <199907012037.QAA19191@cc942873-a.ewndsr1.nj.home.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 01-Jul-99 Crist J. Clark wrote: > Robert Sowders wrote, > > [snip some good step-by-step directions, but directrions for stuff I > presonally had already figured out.] > >> If you would like to do password less logins with >> RSA passphrase then you will need to do the >> following. Be aware that the scary statements >> about null passphrased private key are there for a >> good reason. If someone can steal your key or copy >> it then they will have root on the receiving machine >> with no questions asked, but to do this from any >> machine other than the one they stole it from is very >> difficult and again they would have to have a toehold >> on your machine to start with. >> So Caveot Emptor. > > OK, I guess this is what I was really after. First, is RSA-based host > authentification not better than old-fashioned rhosts authentification? > Isn't it better to use this, even if I am going to have to go with > null-passphrases, than to use rhost authentification within SSH (or > gods forbid, using the actual rsh suite). > > Hmmm... Now that I think about it, there really is no reason for root > to be able to ssh in from any other machine but that one (I typically > ssh in with a mortal user and su to root when being > interactive). Hmmm... How does an individual user tell the sshd > configuration which hosts to allow access to this account? The > ~/.ssh/authroized_keys lets people in, but it does not necesarily turn > people away. I would like to be able to restrict what hosts can access > root, but not put any restrictions on certain other users. If that is > possible, it seems using the null-passphrase would not be much of a > risk (if it even is in the first place). Check the sshd manpage. You can add options to each key listed in authorized_keys, including which hosts are allowed to use it and even to restrict it to a certain command. If you are only going to be running one command with this key, then take a look at that option. That way, if someone gets your host key, the only thing they can do is run that one command. This may still be bad, but it's not the same as having a root shell on your box. --- John Baldwin <jobaldwi@vt.edu> -- http://members.freedomnet.com/~jbaldwin/ PGP Key: http://members.freedomnet.com/~jbaldwin/pgpkey.asc "Power Users Use the Power to Serve!" - http://www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199907012259.SAA17933>