OpenSSH_6.7p1 hostbased authentication failing on linux->linux connection. what's wrong with my config?

grantksupport at operamail.com grantksupport at operamail.com
Sat Jan 10 03:05:07 AEDT 2015


I run OpenSSH on linux

	@ client

		which ssh
			/usr/local/bin/ssh
		ssh -v
			OpenSSH_6.7p1, OpenSSL 1.0.1j 15 Oct 2014

	@ server

		which sshd
			/usr/local/bin/sshd
		sshd -v
			unknown option -- V
			OpenSSH_6.7p1, OpenSSL 1.0.1j 15 Oct 2014
			usage: sshd [-46DdeiqTt] [-b bits] [-C connection_spec] [-c host_cert_file]
			            [-E log_file] [-f config_file] [-g login_grace_time]
			            [-h host_key_file] [-k key_gen_time] [-o option] [-p port]


I have configured for hostbased authentication

	client ssh_config
		...
		PreferredAuthentications           hostbased,publickey
		HostbasedAuthentication            yes
		PubkeyAuthentication               yes
		PasswordAuthentication             no
		...

	server sshd_config
		...
		AuthenticationMethods              hostbased,publickey
		HostbasedAuthentication            yes
		HostbasedUsesNameFromPacketOnly    yes
		PubkeyAuthentication               yes
		PasswordAuthentication             no
		...

on the server, because I'm not entirely sure where to put it yet

	echo "client.DOMAIN.COM" > /etc/shosts.equiv
	echo "client.DOMAIN.COM" > /usr/local/etc/shosts.equiv

when I try to connect

	ssh -vvv server.DOMAIN.COM

hostname auth fails

	...
	Permission denied (hostbased).

debug logs return

	client log
		...
		debug1: Authentications that can continue: hostbased
		debug3: start over, passed a different list hostbased
		debug3: preferred hostbased,publickey
		debug3: authmethod_lookup hostbased
		debug3: remaining preferred: publickey,password
		debug3: authmethod_is_enabled hostbased
		debug1: Next authentication method: hostbased
		debug2: userauth_hostbased: chost client.DOMAIN.COM.
		debug2: we sent a hostbased packet, wait for reply
		debug1: Authentications that can continue: hostbased
		debug2: userauth_hostbased: chost client.DOMAIN.COM.
		debug2: we sent a hostbased packet, wait for reply
		debug1: Authentications that can continue: hostbased
		debug2: userauth_hostbased: chost client.DOMAIN.COM.
		debug2: we sent a hostbased packet, wait for reply
		debug1: Authentications that can continue: hostbased
		debug2: userauth_hostbased: chost client.DOMAIN.COM.
		debug2: we sent a hostbased packet, wait for reply
		debug1: Authentications that can continue: hostbased
		debug1: No more client hostkeys for hostbased authentication.
		debug2: we did not send a packet, disable method
		debug1: No more authentication methods to try.
		Permission denied (hostbased).

	server log
		...
		Jan  9 07:37:31 server sshd[19835]: debug2: input_userauth_request: try method hostbased [preauth]
		Jan  9 07:37:31 server sshd[19835]: debug1: userauth_hostbased: cuser root chost client.DOMAIN.COM. pkalg ssh-ed25519 slen 83 [preauth]
		Jan  9 07:37:31 server sshd[19835]: debug3: mm_key_allowed entering [preauth]
		Jan  9 07:37:31 server sshd[19835]: debug3: mm_request_send entering: type 22 [preauth]
		Jan  9 07:37:31 server sshd[19835]: debug3: mm_key_allowed: waiting for MONITOR_ANS_KEYALLOWED [preauth]
		Jan  9 07:37:31 server sshd[19835]: debug3: mm_request_receive_expect entering: type 23 [preauth]
		Jan  9 07:37:31 server sshd[19835]: debug3: mm_request_receive entering [preauth]
		Jan  9 07:37:31 server sshd[19835]: debug3: mm_request_receive entering
		Jan  9 07:37:31 server sshd[19835]: debug3: monitor_read: checking request 22
		Jan  9 07:37:31 server sshd[19835]: debug3: mm_answer_keyallowed entering
		Jan  9 07:37:31 server sshd[19835]: debug3: mm_answer_keyallowed: key_from_blob: 0x7cd1262cbc76
		Jan  9 07:37:31 server sshd[19835]: debug2: userauth_hostbased: chost client.DOMAIN.COM. resolvedname xxxx:xxx:xxxx:xxx::10 ipaddr xxxx:xxx:xxxx:xxx::10
		Jan  9 07:37:31 server sshd[19835]: debug2: stripping trailing dot from chost client.DOMAIN.COM.
		Jan  9 07:37:31 server sshd[19835]: debug2: auth_rhosts2: clientuser root hostname client.DOMAIN.COM ipaddr client.DOMAIN.COM
		Jan  9 07:37:31 server sshd[19835]: debug1: temporarily_use_uid: 0/0 (e=0/0)
		Jan  9 07:37:31 server sshd[19835]: debug1: restore_uid: 0/0
		Jan  9 07:37:31 server sshd[19835]: debug1: temporarily_use_uid: 0/0 (e=0/0)
		Jan  9 07:37:31 server sshd[19835]: debug1: restore_uid: 0/0
		Jan  9 07:37:31 server sshd[19835]: Failed hostbased for root from xxxx:xxx:xxxx:xxx::10 port 40452 ssh2: ED25519 xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx, client user "root", client host "client.DOMAIN.COM"
		Jan  9 07:37:31 server sshd[19835]: debug3: mm_answer_keyallowed: key 0x7cd1262cbc76 is not allowed
		Jan  9 07:37:31 server sshd[19835]: debug3: mm_request_send entering: type 23
		Jan  9 07:37:31 server sshd[19835]: debug2: userauth_hostbased: authenticated 0 [preauth]
		Jan  9 07:37:31 server sshd[19835]: debug3: userauth_finish: failure partial=0 next methods="hostbased" [preauth]
		...

I see that

	mm_answer_keyallowed: key 0x7cd1262cbc76 is not allowed

but am not clear what key that is.  grep'ing for '7cd1262cbc76' turns up nothing.

What's wrong or missing in my config?


More information about the openssh-unix-dev mailing list