AIX

AIX

Connect with fellow AIX users and experts to gain knowledge, share insights, and solve problems.


#Power
#Power
 View Only
Back to discussions
Expand all | Collapse all

SSH or RSH multi users with same home to one user on another server

  • 1.  SSH or RSH multi users with same home to one user on another server

    Posted Tue April 04, 2017 11:09 AM

    Originally posted by: stephane_AM


    Hello.

     

    Here is the environment:

     - 2 AIX servers : softsrv and targetsrv

     

    I have plenty of users on softsrv, and they all have the same $HOME : /home/common

    There is only one user on targetsrv.

    Each softsrv user must be able to launch a script which will connect to targetsrv with the only user who exists on it and launch some local commands.

    So, each user must be able to connect to only one target user on targetsrv.

     

    RSH and SSH are allowed.

     

    Is it possible to generate only one ssh key ?

    Any other idea ?

     

    Thank you

     


    #AIX-Forum


  • 2.  Re: SSH or RSH multi users with same home to one user on another server

    Posted Thu April 06, 2017 12:31 PM

    Originally posted by: AncientAIXer


    Generate the key for the user on targetsrv.  Put that key into the /home/common/.ssh/authorized_keys2 file on softsrv.  The users will have to use the ssh user@targetsrv syntax.


    #AIX-Forum


  • 3.  Re: SSH or RSH multi users with same home to one user on another server

    Posted Tue May 02, 2017 10:23 AM

    Originally posted by: stephane_AM


    It seems that I missed something :

    - on targetsrv server, as user : ssh-keygen -t dsa  - I set no passphrase

    - copy the file ~/.ssh/id.dsa.pub to softsrv:/home/common/.ssh/authorized_keys2

    - from the softsrv server, logged as softuser, I tried to ssh to the targetsrv : ssh -vvv user@targetsrv , it doesn't work, it asks for a password :

     

     ssh -vvv user@targetsrv
    OpenSSH_6.0p1, OpenSSL 1.0.1e 11 Feb 2013
    debug1: Reading configuration data /etc/ssh/ssh_config
    debug1: Failed dlopen: /usr/krb5/lib/libkrb5.a(libkrb5.a.so):   0509-022 Impossible de charger le module /usr/krb5/lib/libkrb5.a(libkrb5.a.so).
            0509-026 Erreur syst\350me: Un fichier ou un r\351pertoire du chemin d'acc\350s n'existe pas.

    debug1: Error loading Kerberos, disabling Kerberos auth.
    debug2: ssh_connect: needpriv 0
    debug1: Connecting to targetsrv [194.4.115.182] port 22.
    debug1: Connection established.
    debug1: identity file /u/softuser/.ssh/id_rsa type -1
    debug1: identity file /u/softuser/.ssh/id_rsa-cert type -1
    debug1: identity file /u/softuser/.ssh/id_dsa type -1
    debug1: identity file /u/softuser/.ssh/id_dsa-cert type -1
    debug1: identity file /u/softuser/.ssh/id_ecdsa type -1
    debug1: identity file /u/softuser/.ssh/id_ecdsa-cert type -1
    debug1: Remote protocol version 2.0, remote software version OpenSSH_5.2
    debug1: match: OpenSSH_5.2 pat OpenSSH_5*
    debug1: Enabling compatibility mode for protocol 2.0
    debug1: Local version string SSH-2.0-OpenSSH_6.0
    debug2: fd 4 setting O_NONBLOCK
    debug3: load_hostkeys: loading entries for host "targetsrv" from file "/u/softuser/.ssh/known_hosts"
    debug3: load_hostkeys: found key type RSA in file /u/softuser/.ssh/known_hosts:1
    debug3: load_hostkeys: loaded 1 keys
    debug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa
    debug1: SSH2_MSG_KEXINIT sent
    debug1: SSH2_MSG_KEXINIT received
    debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    debug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-dss-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-dss
    debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
    debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
    debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
    debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit: first_kex_follows 0
    debug2: kex_parse_kexinit: reserved 0
    debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
    debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
    debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
    debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
    debug2: kex_parse_kexinit: none,zlib@openssh.com
    debug2: kex_parse_kexinit: none,zlib@openssh.com
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit:
    debug2: kex_parse_kexinit: first_kex_follows 0
    debug2: kex_parse_kexinit: reserved 0
    debug2: mac_setup: found hmac-md5
    debug1: kex: server->client aes128-ctr hmac-md5 none
    debug2: mac_setup: found hmac-md5
    debug1: kex: client->server aes128-ctr hmac-md5 none
    debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
    debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
    debug2: dh_gen_key: priv key bits set: 126/256
    debug2: bits set: 484/1024
    debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
    debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
    debug1: Server host key: RSA 2c:6a:3a:86:76:13:7e:12:d7:af:e3:a7:ed:12:0e:02
    debug3: load_hostkeys: loading entries for host "targetsrv" from file "/u/softuser/.ssh/known_hosts"
    debug3: load_hostkeys: found key type RSA in file /u/softuser/.ssh/known_hosts:1
    debug3: load_hostkeys: loaded 1 keys
    debug3: load_hostkeys: loading entries for host "194.4.115.182" from file "/u/softuser/.ssh/known_hosts"
    debug3: load_hostkeys: found key type RSA in file /u/softuser/.ssh/known_hosts:1
    debug3: load_hostkeys: loaded 1 keys
    debug1: Host 'targetsrv' is known and matches the RSA host key.
    debug1: Found key in /u/softuser/.ssh/known_hosts:1
    debug2: bits set: 509/1024
    debug1: ssh_rsa_verify: signature correct
    debug2: kex_derive_keys
    debug2: set_newkeys: mode 1
    debug1: SSH2_MSG_NEWKEYS sent
    debug1: expecting SSH2_MSG_NEWKEYS
    debug2: set_newkeys: mode 0
    debug1: SSH2_MSG_NEWKEYS received
    debug1: Roaming not allowed by server
    debug1: SSH2_MSG_SERVICE_REQUEST sent
    debug2: service_accept: ssh-userauth
    debug1: SSH2_MSG_SERVICE_ACCEPT received
    debug2: key: /u/softuser/.ssh/id_rsa (0)
    debug2: key: /u/softuser/.ssh/id_dsa (0)
    debug2: key: /u/softuser/.ssh/id_ecdsa (0)
    debug1: Authentications that can continue: publickey,password,keyboard-interactive
    debug3: start over, passed a different list publickey,password,keyboard-interactive
    debug3: preferred publickey,keyboard-interactive,password
    debug3: authmethod_lookup publickey
    debug3: remaining preferred: keyboard-interactive,password
    debug3: authmethod_is_enabled publickey
    debug1: Next authentication method: publickey
    debug1: Trying private key: /u/softuser/.ssh/id_rsa
    debug3: no such identity: /u/softuser/.ssh/id_rsa
    debug1: Trying private key: /u/softuser/.ssh/id_dsa
    debug3: no such identity: /u/softuser/.ssh/id_dsa
    debug1: Trying private key: /u/softuser/.ssh/id_ecdsa
    debug3: no such identity: /u/softuser/.ssh/id_ecdsa
    debug2: we did not send a packet, disable method
    debug3: authmethod_lookup keyboard-interactive
    debug3: remaining preferred: password
    debug3: authmethod_is_enabled keyboard-interactive
    debug1: Next authentication method: keyboard-interactive
    debug2: userauth_kbdint
    debug2: we sent a keyboard-interactive packet, wait for reply
    debug1: Authentications that can continue: publickey,password,keyboard-interactive
    debug3: userauth_kbdint: disable: no info_req_seen
    debug2: we did not send a packet, disable method
    debug3: authmethod_lookup password
    debug3: remaining preferred:
    debug3: authmethod_is_enabled password
    debug1: Next authentication method: password
    user@targetsrv's password:

     

    Thank you for your help.


    #AIX-Forum


  • 4.  Re: SSH or RSH multi users with same home to one user on another server

    Posted Wed May 17, 2017 10:10 AM

    Originally posted by: wloszczowa


    if so maybe you could try host key based authentication beetween the two IPs for a given group users?

     

    btw. who owns the private key in your shared home directory? maybe the other users has no access to the .ssh/id_rsa if there is openssh restricion met to the 400 mode

    debug3: no such identity: /u/softuser/.ssh/id_dsa

     

    you could try with acls set on the id_rsa (400)  and .ssh dir (700) giving grants for the sharing users or group they are in

     

    or,.... maybe strictmode set to no in ssh config would "workaround" it?


    #AIX-Forum


Related Content