RSH por SSH

 Como usar ssh sin password

 Esto permite ejecutar un comando remoto si necesidad de ingresar una contraseña .. pero pues bien inseguro asi que cierre la vaina bien.

La otra opcion es con intercambio de llaves y no mas

1. Ejecute   ssh-keygen -t rsa
2. Copia en el archivo /suario/.ssh/id_dsa.pub(en el cliente) en /otrousuario/.ssh/authorized_keys2 (en el servidor)
3. Ponga permisos 600 al authorized_keys2   y el .ssh debe ser 700 usualmente

y voila 
 

Por seguridad vayanse siempre con protocolo version2.

Debe crear un archivo /etc/shost.equiv con los nombres de los servidores confiables y en el directorio del usuario crear un .shosts con el nombre del servidor remoto  y de su usuario equivalente. (mirar anexo)

Agregue las opciones

HostbasedAuthentication yesProtocol 2EnableSSHKeysign yes 

Agregue las opciones

HostbasedAuthentication yes

Cuando ssh-keysign no es suid .. se ve

I»»»»»> debug1: Next authentication method: hostbased
I»»»»»> could not open any host key
I»»»»»> ssh_keysign: no reply

Un problema es que el authorized_keys y authorized_keys2 deben existir
ambos

Debe ponerse passphrase ..pero sin ella es mas facil

-

http://www.cs.umd.edu/~arun/misc/ssh.html o su copia local ssh_without_pass.html

http://www.csua.berkeley.edu/~ranga/notes/ssh_nopass.html o su copia local ssh_nopass.html

FIN

Anexo /etc/ssh/ssh_config

# $OpenBSD: ssh_config,v 1.19 2003/08/13 08:46:31 markus Exp $

# This is the ssh client system-wide configuration file. See # ssh_config(5) for more information. This file provides defaults for # users, and the values can be changed in per-user configuration files # or on the command line.

# Configuration data is parsed as follows: # 1. command line options # 2. user-specific file # 3. system-wide file # Any configuration value is only changed the first time it is set. # Thus, host-specific definitions should be at the beginning of the # configuration file, and defaults at the end.

# Site-wide defaults for various options

# Host * # ForwardAgent no # ForwardX11 no # ForwardX11Trusted yes # RhostsRSAAuthentication yes # RSAAuthentication yes # PasswordAuthentication yes HostbasedAuthentication yes # BatchMode no # CheckHostIP yes # AddressFamily any # ConnectTimeout 0 # StrictHostKeyChecking ask # IdentityFile ~/.ssh/identity # IdentityFile ~/.ssh/id_rsa # IdentityFile ~/.ssh/id_dsa # Port 22 # Protocol 2,1 Protocol 2 # Cipher 3des # Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc # EscapeChar ~

#############

EnableSSHKeysign yes

Anexo /etc/ssh/sshd_config

# Package generated configuration file # See the sshd(8) manpage for defails

# What ports, IPs and protocols we listen for Port 22 # Use these options to restrict which interfaces/protocols sshd will bind to #ListenAddress :: #ListenAddress 0.0.0.0 Protocol 2 # HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key #Privilege Separation is turned on for security UsePrivilegeSeparation yes

# …but breaks Pam auth via kbdint, so we have to turn it off # Use PAM authentication via keyboard-interactive so PAM modules can # properly interface with the user (off due to PrivSep) #PAMAuthenticationViaKbdInt no # Lifetime and size of ephemeral version 1 server key KeyRegenerationInterval 3600 ServerKeyBits 768

# Logging SyslogFacility AUTH LogLevel INFO

# Authentication: LoginGraceTime 600 PermitRootLogin no StrictModes yes

RSAAuthentication yes PubkeyAuthentication yes #AuthorizedKeysFile %h/.ssh/authorized_keys

# rhosts authentication should not be used #RhostsAuthentication no # Don't read the user's ~/.rhosts and ~/.shosts files IgnoreRhosts no # For this to work you will also need host keys in /etc/ssh_known_hosts RhostsRSAAuthentication no # similar for protocol version 2 HostbasedAuthentication yes # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication #IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED) PermitEmptyPasswords no

# Uncomment to disable s/key passwords #ChallengeResponseAuthentication no

# To disable tunneled clear text passwords, change to no here! PasswordAuthentication yes

# To change Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #AFSTokenPassing no #KerberosTicketCleanup no

# Kerberos TGT Passing does only work with the AFS kaserver #KerberosTgtPassing yes

X11Forwarding no X11DisplayOffset 10 PrintMotd no #PrintLastLog no KeepAlive yes #UseLogin no

#MaxStartups 10:30:60 #Banner /etc/issue.net #ReverseMappingCheck yes

Subsystem sftp /usr/lib/sftp-server

UsePAM yes

Anexo /etc/shosts.equiv

zion.skina.com.co babylon.skina.com.co

Anexo $HOME/.shosts

zion.skina.com.co demo babylon.skina.com.co demo

15-Marzo-2006 J.E.Gomez v1.0 Primera version
14-Mayo-2005 J.E.Gomez v0.5