[Tfug] OpenSSH question

[Chris Hilton]

On Tue, 11 Jun 2002 13:17:09 -0700
"Chris Hilton" <lists@particlewars.com> wrote:

> On Mon, 10 Jun 2002 13:04:38 -0700 (MST)
> "Mike Morrell" <mike@themorrells.org> wrote:
> 
> >   In OpenSSH is there a way to specify the authentication method by
> > connecting host name?  I would like to set up a trusted domain to
> > connect using keyboard-interactive and password for the
> > authentication but force all other hosts to only use a public key. 
> > Ideally I would like the configuration to be configurable by each
> > user (in their$home/.ssh ?) and not use the global sshd_config.  I
> > checked the man pages but I could not find host type control for
> > incoming connections to sshd.
> > 
> > 
> > 
> > Mike
> 
> Mike-
> 
> I don't see a way to do this with one sshd_config file.  I can't
> figure any combination of flags that would allow per host login
> control.  I have to beleive there is a slick way to do this and if
> anyone knows, I'm interested also.  $HOME/.shosts files (see 'man
> sshd') might help with some of this.  A clunky way to do it might be
> to have a couple of sshd_config files, the trusted domain sshd
> configured in one listening to port 22 and the other sshd configured
> in the second listening to 22x.
> 
> -C-

There, I've gone and replied to my own damn self.  Heh.

You could do this with ssh_config files in each users $HOME/.ssh/ like
this:
 
Host	trusted.domain.net
   ForwardAgent			yes
   ForwardX11 			yes
   RhostsAuthentication 	no
   RhostsRSAAuthentication 	no
   RSAAuthentication 		no
   PasswordAuthentication 	yes
   PAMAuthenticationViaKbdInt 	yes
   FallBackToRsh 	no
   UseRsh 	no
   CheckHostIP 		yes
   StrictHostKeyChecking 	yes
   IdentityFile 	~/.ssh/id_dsa
   Protocol 	2

But that won't stop funny buisness on the server side.  Which is what I
was concerned about in my first post.  The client config files don't
control what sshd listens/responds to.  Only how the client acts when
that user calls it.  The ssh daemon will still respond according to the
global sshd_config file it read when it starts.  

-C-