How to RSA authentication

ERBRMN · 04-17-2005, 09:52 PM

How to RSA authentication

I configured SSH with RSA authentication.
But when I start SSH , it showed following message. What is it mean?
I think RSA authentication of my server SSH is not good ?

Message is :

"... Disabling protocol version 2. Could not load host key"

Step configuration is :
---------------------------------------------

I have changed config file SSH "/etc/ssh/sshd_config"
(There is not showed other config which is default.)

Port 22

HostKey /etc/ssh/ssh_host_key

KeyRegenerationInterval 3600

SyslogFacility AUTHPRIV

PermitRootLogin no

RsaAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

IgnoreRhosts yes

IgnoreUserKnownHosts yes

X11Forwarding yes

AllowUsers user1 user2

---------------------------------------------

I have created a local RSA key:

ssh-keygen -t rsa -f /home/user/.ssh/user_id.pub

mv .ssh/user_id.pub .ssh/authorized_keys

*********************************

When i login to SSH remote to using (same when i not use it) "user_id.pub" , it is OK.
So i think RSH authentication is not completed.

Could u help me to find my mistake ??????

Gibsonist · 04-18-2005, 04:32 AM

I don't think that it is the RSA conf but something seems to be going wrong with your Host key file.

If I am not mistaken the conf for Prot2 should have something like this at the top

Code:

Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key

Furthermore I would change this line to

Code:

AuthorizedKeysFile %h/.ssh/authorized_keys

Also make sure that PAM auth is disabled.

ERBRMN · 04-18-2005, 04:45 AM

Quote:

Originally posted by Gibsonist
I don't think that it is the RSA conf but something seems to be going wrong with your Host key file.

If I am not mistaken the conf for Prot2 should have something like this at the top

Code:

Protocol 2 # HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key

Also make sure that PAM auth is disabled.

Thk u Gibsonist

I have enabled protocol 2 like you said, but it was not changed.
Message changed : "Disabling protocol version 1. Could not load host key"

I think can use only "rsa" not rsa and dsa parameter when I create host key file. Is it OK ?

"Also make sure that PAM auth is disabled." What it means ?

Gibsonist · 04-18-2005, 05:06 AM

I don't know at the moment if you need both host files or not - I have both.

about the PAM
you should have a line like this somewhere

Code:

UsePAM no

I'll have a look into the hostkeys

mychl · 04-18-2005, 11:14 AM

I think rsa is for protocol 1, and dsa is for 2???

Just a thought... I think that's what I read recently....

HTH

ERBRMN · 04-18-2005, 07:52 PM

Quote:

Originally posted by mychl
I think rsa is for protocol 1, and dsa is for 2???

Just a thought... I think that's what I read recently....

HTH

YES, So I enabled protocol 1 , desabled protocol 2.
But after this config or ... , showing following error:

"... Disabling protocol version 2. Could not load host key"

Gibsonist · 04-19-2005, 04:41 AM

I wouldn't enable Prot 1 if I was you - it is unsecure.

SSH2 needs both DSA and RSA keys as hostkeys as SSH knows 3 types of encryptions for Host keys

SSH1 RSA / SSH2 DSA /SSH2 RSA if I am not totally mistaken.

use these commands to generate new SSH2 hoskeypairs (the strenght can be set by you to something higher if wished)

Code:

ssh-keygen -t dsa -b 1024   # Generate a 1024 bit DSA key for SSHv2 protocol
ssh-keygen -t rsa -b 1024    # Generate a 1024 bit RSA key for SSHv2 protocol

hope it helps

ERBRMN · 04-19-2005, 06:38 AM

Quote:

Originally posted by Gibsonist
I wouldn't enable Prot 1 if I was you - it is unsecure.

SSH2 needs both DSA and RSA keys as hostkeys as SSH knows 3 types of encryptions for Host keys

SSH1 RSA / SSH2 DSA /SSH2 RSA if I am not totally mistaken.

use these commands to generate new SSH2 hoskeypairs (the strenght can be set by you to something higher if wished)

Code:

ssh-keygen -t dsa -b 1024 # Generate a 1024 bit DSA key for SSHv2 protocol ssh-keygen -t rsa -b 1024 # Generate a 1024 bit RSA key for SSHv2 protocol

hope it helps

Thk u Gibsonist

It is still some message, which is like before.
"Disabling protocol version 1. Could not load host key"

Gibsonist , Have you some sample sshd_config file. Or if you use ssh server with RSA authentication, could you give me it for sample ?

ERBRMN · 04-20-2005, 03:03 AM

I could it ..........

I have display my config file here for people wich is first time set SSH RSA authentication. We write here How to create host key and other.
Following config only for RSA, when want to use DSA , please change RSA -> dsa.

*************************
I have changed config file SSH "/etc/ssh/sshd_config"
(There is not showed other config which is default.)

Port 22
Protocol 1,2

HostKey /etc/ssh/ssh_host_key
HostKey /etc/ssh/ssh_host_rsa_key

KeyRegenerationInterval 3600

PermitRootLogin no

RsaAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

IgnoreRhosts yes

IgnoreUserKnownHosts yes

AllowUsers user1 user2
**********************************

major.tom · 07-29-2005, 12:04 AM

I hope you don't mind me jump starting an old thread. But in case you haven't sorted this out yet...

Quote:

Originally posted by ERBRMN
Protocol 1,2

I was getting the same warning message as you until I changed that to:

Code:

Protocol 2

I also wouldn't use:

Quote:

HostKey /etc/ssh/ssh_host_key

As explained above, it is the "old" (rsa1=protocol1) way of doing things. I would stick with rsa and/or dsa (protocol2).

That makes the following unnecessary, since (I believe) it applies only to rsa1:

Quote:

KeyRegenerationInterval 3600

I'm not sure about the following settings, but they weren't necessary to get public-key authentication working.

Quote:

IgnoreRhosts yes

IgnoreUserKnownHosts yes

After a few days of learning the ropes and and many hours of trial and error, I think I've managed to get public-key authentication working successfully. So I'm by no means an expert. But if you still haven't gotten it working to your satisfaction, I'd be happy to help.

Garry

major.tom · 07-29-2005, 12:33 AM

Quote:

Originally posted by Gibsonist
Furthermore I would change this line to

Code:

AuthorizedKeysFile %h/.ssh/authorized_keys

I hope you don't mind me asking, why is this preferable to:

Code:

AuthorizedKeysFile .ssh/authorized_keys

Cheers!

Garry

Gibsonist · 07-29-2005, 11:22 AM

If I'm not entirely mistaken - due to some heavy headaches - it was because some versions of ssh had problems and wanted the full path.

Also I tend to give cfg files the full path to stop confussion.

If it works fine for you with .ssh/ ... then leave it.