Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 01 Jul 1999 18:59:39 -0400 (EDT)
From:      John Baldwin <jobaldwi@vt.edu>
To:        cjclark@home.com
Cc:        freebsd-security@FreeBSD.ORG, freebsd-questions@FreeBSD.ORG, (Robert Sowders) <rsowders@usgs.gov>
Subject:   Re: SSH Working Like rsh
Message-ID:  <199907012259.SAA17933@smtp3.erols.com>
In-Reply-To: <199907012037.QAA19191@cc942873-a.ewndsr1.nj.home.com>

next in thread | previous in thread | raw e-mail | index | archive | help

On 01-Jul-99 Crist J. Clark wrote:
> Robert Sowders wrote,
> 
> [snip some good step-by-step directions, but directrions for stuff I
> presonally had already figured out.]
> 
>> If you would like to do password less logins with
>> RSA passphrase then you will need to do the 
>> following.  Be aware that the scary statements
>> about null passphrased private key are there for a 
>> good reason.  If someone can steal your key or copy 
>> it then they will have root on the receiving machine
>> with no questions asked, but to do this from any 
>> machine other than the one they stole it from is very 
>> difficult and again they would have to have a toehold 
>> on your machine to start with.
>> So Caveot Emptor.
> 
> OK, I guess this is what I was really after. First, is RSA-based host
> authentification not better than old-fashioned rhosts authentification? 
> Isn't it better to use this, even if I am going to have to go with
> null-passphrases, than to use rhost authentification within SSH (or
> gods forbid, using the actual rsh suite).
> 
> Hmmm... Now that I think about it, there really is no reason for root
> to be able to ssh in from any other machine but that one (I typically
> ssh in with a mortal user and su to root when being
> interactive). Hmmm... How does an individual user tell the sshd
> configuration which hosts to allow access to this account? The
> ~/.ssh/authroized_keys lets people in, but it does not necesarily turn
> people away. I would like to be able to restrict what hosts can access
> root, but not put any restrictions on certain other users. If that is
> possible, it seems using the null-passphrase would not be much of a
> risk (if it even is in the first place).

Check the sshd manpage.  You can add options to each key listed in
authorized_keys, including which hosts are allowed to use it and even to
restrict it to a certain command.  If you are only going to be running one
command with this key, then take a look at that option.

That way, if someone gets your host key, the only thing they can do is run that
one command.  This may still be bad, but it's not the same as having a root
shell on your box.

---

John Baldwin <jobaldwi@vt.edu> -- http://members.freedomnet.com/~jbaldwin/
PGP Key: http://members.freedomnet.com/~jbaldwin/pgpkey.asc
"Power Users Use the Power to Serve!"  -  http://www.freebsd.org


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199907012259.SAA17933>