Verzwiflung: SSH und DSA/RSA-Keys

[NoMoRe@]

Hi Leute,

ich versuche zur Zeit einem CVS-Server Authorisierung über SSH beizubringen. Das einloggen via SSH und Passwörter
funktioniert soweit problemlos. Aber leider schaffe ich es nicht dass er die RSA/DSA Keys benutzt.

Ich gehe nach folgenden Schritten vor:

1) wechseln in $HOME/.ssh - Verzeichnis
2) dort DSA und RSA keys generieren, bei der Passwort eingabe einfach nur RETURN eingeben :


nomore@silverstorm:~/.ssh$ ssh-keygen -t dsa
Generating public/private dsa key pair.
Enter file in which to save the key (/home/nomore/.ssh/id_dsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/nomore/.ssh/id_dsa.
Your public key has been saved in /home/nomore/.ssh/id_dsa.pub.
The key fingerprint is:
48:1a:ac:c9:6a:0f:d4:d8:8d:0b:ea:21:cf:ff:d9:49 nomore@silverstorm

nomore@silverstorm:~/.ssh$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/nomore/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/nomore/.ssh/id_rsa.
Your public key has been saved in /home/nomore/.ssh/id_rsa.pub.
The key fingerprint is:
fc:78:38:2f:42:65:8e:2f:88:ba:ae:a7:8f:46:02:ef nomore@silverstorm


3) jetzt kopiere ich id_rsa zu identity und id_rsa.pub identity.pub

4) Damit wären die Schritte auf der Client-Seite abgeschlossen. Jetzt kopiere ich die public keys
auf den Server:



scp id_rsa.pub nomore@somewhere.far.beyond:/home/nomore/.ssh/authorized_keys
scp id_dsa.pub nomore@somewhere.far.beyond:/home/nomore/.ssh/authorized_keys2


Laut den HowTos bin ich jetzt fertig und sollte mich auf dem Server ohne Passworteingabe anmelden können.
Vorher schecke ich aber noch einmal die /etc/ssh/ssh_config:


# Site-wide defaults for various options

# Host *
# ForwardAgent no
# ForwardX11 no
# RhostsRSAAuthentication no
# RSAAuthentication yes
# PasswordAuthentication yes
# HostbasedAuthentication no
# BatchMode no
# CheckHostIP yes
# AddressFamily any
# ConnectTimeout 0
# StrictHostKeyChecking ask
IdentityFile ~/.ssh/identity
IdentityFile ~/.ssh/id_rsa
IdentityFile ~/.ssh/id_dsa
# Port 22
# Protocol 2,1
# Cipher 3des
# Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes2
56-cbc
# EscapeChar ~


Sollte also stimmen... also schaun wir mal:


nomore@silverstorm:~/.ssh$ ssh -v nomore@somewhere.far.beyond
OpenSSH_3.7.1p2, SSH protocols 1.5/2.0, OpenSSL 0.9.7c 30 Sep 2003
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to somewhere.far.beyond [666.666.666.666] port 22.
debug1: Connection established.
debug1: identity file /home/nomore/.ssh/identity type 1
debug1: identity file /home/nomore/.ssh/id_rsa type 1
debug1: identity file /home/nomore/.ssh/id_dsa type 2
debug1: Remote protocol version 1.99, remote software version OpenSSH_3.4p1
debug1: match: OpenSSH_3.4p1 pat OpenSSH_3.2*,OpenSSH_3.3*,OpenSSH_3.4*,OpenSSH_3.5 *
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.7.1p2
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'somewhere.far.beyond' is known and matches the RSA host key.
debug1: Found key in /home/nomore/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering public key: /home/nomore/.ssh/identity
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Offering public key: /home/nomore/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Offering public key: /home/nomore/.ssh/id_dsa
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: password
nomore@somewhere.far.beyond's password:
debug1: Authentication succeeded (password).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.


Leider funktionierte es nicht. Passwort soll eingegeben werden... weiss jemand was ich da falsch mache ??
Jegliche Hilfe ist willkommen !!!

Bye, Alex

[dilindam]

Moin

sieht eigentlich soweit alles richtig aus.
Ich habe aber die beiden .pub-Dateien in eine authorized_keys getan.

cat id_rsa.pub > authorzied_keys
cat id_dsa.pub >> authorized_keys



Versuche mal so.

MfG Torsten

[Stage]

hast du in der serverconfig auch folgende 2 zeilen drinnen stehen ?
für Protokoll 2

PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

für Protokoll 1 solltest du noch

RSAAuthentication yes

drinnen stehen haben

[NoMoRe@]

Hi,

ich habe das mit den beiden Keys in der authorized_keys auch mal ausprobiert. Ebenfalls ohne Erfolg.... hier mal die sshd_config des Servers.. vielleicht seht ihr ja was...

Ich habe in der man-page von sshd_config gelesen dass es ein %h für das Home-Verzeichnis eines Users gibt.
Muss ich dann 'AuthorizedKeysFile /%h/.ssh/authorized_keys' in die sshd_config schreiben ??



#Port 22
Protocol 2,1
#ListenAddress 0.0.0.0
#ListenAddress ::

# HostKey for protocol version 1
HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 3600
#ServerKeyBits 768

# Logging
#obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 600
#PermitRootLogin yes
#StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

# rhosts authentication should not be used
#RhostsAuthentication no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to no to disable s/key passwords
#ChallengeResponseAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

#AFSTokenPassing no

# Kerberos TGT Passing only works with the AFS kaserver
#KerberosTgtPassing no

# Set this to 'yes' to enable PAM keyboard-interactive authentication
# Warning: enabling this may bypass the setting of 'PasswordAuthentication'
#PAMAuthenticationViaKbdInt yes

X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
#PrintLastLog yes
#KeepAlive yes
#UseLogin no
UsePrivilegeSeparation yes
#Compression yes

#MaxStartups 10
# no default banner path
#Banner /some/path
#VerifyReverseMapping no

# override default of no subsystems
Subsystem sftp /usr/lib/ssh/sftp-server

[Stage]

achso
schonmal versucht ssh dann mit -i aufzurufen

-i file Identity for public key authentication (default: ~/.ssh/identity)
also
ssh -i nomore@somewhere.far.beyond

[NoMoRe@]

Das -i kann ich weglassen ,da es ja per default das identity-File holt

[NoMoRe@]

Hi,

hab's mittlerweile zum Laufen gekriegt !

Fehler waren:

- .ssh und authorized_keys dürfen auf dem server von anderen Benutzern nicht lesbar sein !
- ssh-agent muss auf dem client laufen. -> http://happygiraffe.net/ssh-agent

Dank für eure Hilfe !

Bye, Alex