Subject: Passwordless key-based ssh2 authentication

From: Joe DeBattista <[email-masked]>
Date: Thu, 25 Jul 2002 20:10:54 -0700 (PDT)

Greetings,
  I'm in the process of setting up IMAP to work with Pine 4.44 on my
client server.  Everything works fine, except that I'd like to be able to
not require my users to give a login and password to get to the IMAP
server.  I found the posting for ssh at
http://www.washington.edu/pine/pine-info/1999.12/msg00170.html
but I haven't had any luck doing the equivalent steps under SSH2.

Here's what I tried:
Under a user login, I ran ssh-keygen on the client machine, leaving the
passphrase blank. It created the private key as ~user/.ssh2/id_dsa_1024_a
and the public key as ~user/.ssh2/id_dsa_1024_a.pub

I ftp'ed the id_dsa_1024_a.pub to the IMAP server and placed it  under
~user/.ssh2/hostkeys/key_22_clientmachine.pub

According to the posting, from the client machine, I should be able to
type
  ssh (I'm trying ssh2) my.imap.server
and connect without being asked for a password, but it continues to query
me for the password.

Any help will be greatly appreciated.

                                 Joe DeBattista
                                 UCSF, ITS
                      INTERNET:  [email-masked]

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Bob Rasmussen <[email-masked]>
Date: Thu, 25 Jul 2002 19:59:45 -0700 (PDT)

> and connect without being asked for a password, but it continues to query

First, try running your ssh client with its debugging and/or logging turned
on, you can learn a lot that way.

Second, note that it is possible that the server's sshd is configured to
require both a public key and a password. Again, you'll get a glimpse of this
with the debugging output of your client.

Regards,
....Bob Rasmussen,   President,   Rasmussen Software, Inc.

personal e-mail: [email-masked]
 company e-mail: [email-masked]
          voice: (US) 503-624-0360 (9:00-6:00 Pacific Time)
            fax: (US) 503-624-0760
            web: http://www.anzio.com

---

From: "Mark T. Valites" <[email-masked]>
Date: Thu, 25 Jul 2002 23:25:57 -0400 (EDT)

Joe,

You need to concatonate the public key onto a file called authorized_keys2
in the .ssh directory (or different depending on the ssh version you're
running....).  It doesn't explicity say how to do it, but it does
say you need to in the link you posted.  You can do this to make it work:

cat some_pub_key >> ~/.ssh/authorized_keys2

Check the permissions on all the ssh files though!  ssh is picky (for good
reason about the perms).  ssh -v -v -v won't pick up this problem for you,
but tailing the logs on the sshd machine will.

Once that works, the passworless ssh imapping to preauth'd imapd works
without any problem.

Now if only I could get this to go with the courier imap preauth imapd...

>--))> >--))>
Mark T. Valites
Unix Systems Analyst
1 College Circle - 124b1 South Hall
SUNY Geneseo
Geneseo, NY 14454
585-245-5577
585-259-3471 (Cell)
585-245-5579 (Fax)

---

From: Joe DeBattista <[email-masked]>
Date: Thu, 25 Jul 2002 20:52:19 -0700 (PDT)

Does it still use the authorized_keys file with ssh2?

                                 Joe DeBattista
                                 UCSF, ITS

---

From: "Mark T. Valites" <[email-masked]>
Date: Thu, 25 Jul 2002 23:55:38 -0400 (EDT)

authorized_keys2 with openssh2.  I'm not sure about commercial ssh2 off
hand.  ssh, the Definitice Guide from O'Reilly has it in there.
Unfortuneatly, it's at work & I'm not...  I think commercial ssh uses
authorized_keys.  There's only two, so try I guess...

Mark T. Valites
Unix Systems Analyst

---

From: Scot Elliott <[email-masked]>
Date: Fri, 26 Jul 2002 07:54:39 +0100 (BST)

If you're using DSA keys then it's authorized_keys2 in openSSH.

As an aside, there's also a useful feature that make using passphrase-less
keys a bit more secure, eg:

from="<host>",command="exec /usr/local/libexec/imapd",no-pty,no-port-forwarding,no-X11-forwarding ssh-dss AAAAB3NzaC... pine key

Which forces SSHd to run the imap server whenever a login occurs using
your PINE key.  That was if someone gets hold of the key, they can (only)
mess with my mail, not get shell access.

Scot