Re: Setting up SSH on Snow Leopard

In article <YrqdnRh7-JTQN4bQnZ2dnUVZ_o0AAAAA@xxxxxxxxxxxx>,
"W" <persistentone@xxxxxxxxxxxxxx> wrote:

"Tom Harrington" <tph@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:tph-5BC244.13512729122010@xxxxxxxxxxxx
In article <CNCdnRP6SIHuE4bQnZ2dnUVZ_hidnZ2d@xxxxxxxxxxxx>,
"W" <persistentone@xxxxxxxxxxxxxx> wrote:

I agree with you that I need to start testing my client, but the way I
interpret debug3 above is that your SSH server supports three different
authentication methods. One of those three is password.

You could potentially clear up a lot of confusion if you'd just open up
a Terminal window on the Mac and try "ssh localhost". Then at least
you'd be sure of whether the client you're using was in any way
connected to the lack of a password prompt.

Okay, thanks to everyone's prompting in this thread, I think I have this
problem solved.

From the Mac client I did a verbose connection with:

ssh - v localhost

That result clearly shows in debug1 that the server supports
keyboard-interactive but does not support Password, in the default
configuration.

I then went to my client and simply selected Keyboard-interactive, and it
immediately worked.

What exactly are the differences between Password and Keyboard-interactive
authentication methods, and is either of those preferred from a security
view?

Someone more experienced with OpenSSH can tell you the difference(s)
between keyboard-interactive and password authentication.

Nevertheless, the most secure configuration will offer the least amount
of access required. If you want to harden your SSH server, you will
disable both keyboard-interactive and password authentication and
instead use only public/private key authentication. If you want exact
steps to do that, just let me know.

What's also interesting is that all of the public UNIX hosts I connect to
for SSH2 seem to support Password, and by default Mac OS X does not.
Apparently the admins of those public systems have chosen to enable Password
and it is not the default configuration of OpenSSH.

While it is the default for the Mac OS X OpenSSH configuration, it's not
necessarily the same for other platforms.

In general, Apple tends to lean more on the secure side of configuration
for the Unix subsystem. Very often, Linux distributions use less secure
configurations to ensure backwards compatibility and so on. While Apple
has the luxury of controlling both software and hardware, and therefore
can take more liberties (for example, the change to support only SSH
Protocol 2 connections in recent Mac OS X versions).

--
Send responses to the relevant news group rather than email to me.
E-mail sent to this address may be devoured by my very hungry SPAM
filter. Due to Google's refusal to prevent spammers from posting
messages through their servers, I often ignore posts from Google
Groups. Use a real news client if you want me to see your posts.

JR
.

Relevant Pages

  • Re: sshd handing all authentication to shell
    ... >I would like to use SSH for transport only into an embedded device. ... >login/password authentication but since it is using SSH for transport, ... You don't state what SSH server you're planning to use, ... I believe that in principle a client should be able to request ...
    (comp.security.ssh)
  • Re: Blocking attacks from spoofed IP addresses
    ... Some of the ssh attacks are distributed. ... So IMHO public key authentication does not necessarily reduce risks. ... if one is scared about login unwanted attempts on a ssh server ...
    (comp.os.linux.networking)
  • Re: Is my ssh session encrypted?
    ... > It seems that you were authenticated using public key authentication, ... ssh -v will show encryption being negotiated & which cipher is in use. ... you're connecting to the right SSH server. ...
    (comp.security.ssh)
  • Re: Reflexive firewalls?
    ... I've recently used an SSH server that had an interesting authentication ... You first had to telnet to the machine on a certain port. ... Commercial/Open Source Two-Factor Authentication ...
    (Security-Basics)
  • Problems with passwordless ssh/scp (W2K client , Solaris 8 server).
    ... configuration for the ssh client and server. ... The SSH server configuration is a pretty standard configuration (Solaris ... Rhosts Authentication disabled, ... debug1: Connection established. ...
    (SSH)