Re: [OpenIndiana-discuss] ssh root login

2013-01-14 Thread Jason Matthews
] ssh root login On 01/12/2013 06:01 PM, Bob Friesenhahn wrote: > I am trying to accomplish ssh root login with a forced command via an > entry in /root/.ssh/authorized_keys. This is to support my home-made > backup system. The strategy is already working for Solaris 10, Apple > OS X

Re: [OpenIndiana-discuss] ssh root login

2013-01-14 Thread Ray Arachelian
On 01/12/2013 06:01 PM, Bob Friesenhahn wrote: > I am trying to accomplish ssh root login with a forced command via an > entry in /root/.ssh/authorized_keys. This is to support my home-made > backup system. The strategy is already working for Solaris 10, Apple > OS X, Linux, and FreeBSD hosts. H

Re: [OpenIndiana-discuss] ssh root login

2013-01-13 Thread Edward Ned Harvey (openindiana)
> From: Bob Friesenhahn [mailto:bfrie...@simple.dallas.tx.us] > > I am trying to accomplish ssh root login Besides the sshd_config, there are a bunch of other things that all disable root login. It's a pain to figure out every last one of them. The far, far easier solution is to create a non-

Re: [OpenIndiana-discuss] ssh root login

2013-01-13 Thread Roel_D
Don't forget that rolemod was originaly developed to give USERS roles that normaly ROOT would have. Kind regards, The out-side Op 13 jan. 2013 om 04:10 heeft Jerry Kemp het volgende geschreven: > I am glad that you resolved your issue. > > I realize that I am posting this after the issue

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Jerry Kemp
I am glad that you resolved your issue. I realize that I am posting this after the issue has been solved, but just for completeness, back when Solaris 10 was the current thing (I'm thinking Sol 10u3 - 10u7), somewhere in there, I experienced issues where the ssh application that shipped with Solar

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Ray Butler
You could also run a second ssh instance (port 26) and set up a trusted host configuration. For this instance set PermitRootLogin to yes and reset the public ssh access (port 22) to PermitRootLogin no. It's more legwork, as you'd need to package another ssh installation, but it would safeguard your

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Bob Friesenhahn
On Sat, 12 Jan 2013, Gregory S. Youngblood wrote: Don't forget by default root is not a regular user account. Or at least it didn't used to be. You may need to issue the command to make root a full account before you can ssh to the root account. Also, depending on what you're doing, you might

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Bob Friesenhahn
On Sat, 12 Jan 2013, Ray Butler wrote: rolemod -K type=normal root I set PermitRootLogin without-password and it works without issue. That did it! This should provide me with traditional benefits as well (as well as the security drawback). Thanks! Bob -- Bob Friesenhahn bfrie...@simple.d

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Bob Friesenhahn
On Sun, 13 Jan 2013, Serge Fonville wrote: what are the permissions for the files in the .ssh directory? weerd:/root/.ssh# ls -l total 31 -rw-r--r-- 1 root root1626 Jan 12 18:00 authorized_keys -rw--- 1 root root 866 Jul 5 2008 id_dsa -rw-r--r-- 1 root r

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Ray Butler
rolemod -K type=normal root I set PermitRootLogin without-password and it works without issue. On Sat, Jan 12, 2013 at 8:37 PM, Gregory S. Youngblood < greg...@youngblood.me> wrote: > Don't forget by default root is not a regular user account. Or at least it > didn't used to be. You may need t

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Gregory S. Youngblood
Don't forget by default root is not a regular user account. Or at least it didn't used to be. You may need to issue the command to make root a full account before you can ssh to the root account. Also, depending on what you're doing, you might consider ssh to a regular user and then escalate vi

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Serge Fonville
what are the permissions for the files in the .ssh directory? Kind regards/met vriendelijke groet, Serge Fonville http://www.sergefonville.nl Convince Microsoft! They need to add TRUNCATE PARTITION in SQL Server https://connect.microsoft.com/SQLServer/feedback/details/417926/truncate-partition-

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Bob Friesenhahn
On Sun, 13 Jan 2013, Serge Fonville wrote: It took me 2 minutes to set it up, succesfully The steps I took: create key using ssh-keygen edit sshd_config and set PermitRootLogin to yes restarted sshd added the public key to authorized_keys specified the private key in the connection I tried

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Serge Fonville
It took me 2 minutes to set it up, succesfully The steps I took: > create key using ssh-keygen > edit sshd_config and set PermitRootLogin to yes > restarted sshd > added the public key to authorized_keys > specified the private key in the connection I tried with and without and empty root passwo

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Bob Friesenhahn
On Sun, 13 Jan 2013, Serge Fonville wrote: have your tried logging in normally without the command, but with the private key? Logging in with 'root's normal private key, and with the one which was reserved for rsync, does not work. Logging in using a password does not work. Host-based aut

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Serge Fonville
have your tried logging in normally without the command, but with the private key? Kind regards/met vriendelijke groet, Serge Fonville http://www.sergefonville.nl Convince Microsoft! They need to add TRUNCATE PARTITION in SQL Server https://connect.microsoft.com/SQLServer/feedback/details/41792

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Bob Friesenhahn
On Sun, 13 Jan 2013, Roel_D wrote: Note that sshd uses pam_authenticate(3PAM) so the root (or any other) user # maybe denied access by a PAM module regardless of this setting. Think that says enough It just means that a PAM module has the opportunity to deny access. It does not mean that a P

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Bob Friesenhahn
On Sun, 13 Jan 2013, Serge Fonville wrote: Hi, Are you able to start SSHD in debug mode? This is the pertinent bit I see from the output of 'sshd -d -p 1234': debug2: user_key_allowed: check options: 'command="/usr/bin/rsync --server --da... debug1: matching key found: file /root/.ssh/autho

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Roel_D
I still think it is like asking the other car-users for how to disable the brakes on your car... Kind regards, The out-side Op 13 jan. 2013 om 00:01 heeft Bob Friesenhahn het volgende geschreven: > I am trying to accomplish ssh root login with a forced command via an entry > in /root/.ssh/

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Roel_D
Note that sshd uses pam_authenticate(3PAM) so the root (or any other) user # maybe denied access by a PAM module regardless of this setting. Think that says enough Kind regards, The out-side Op 13 jan. 2013 om 00:01 heeft Bob Friesenhahn het volgende geschreven: > Note that sshd uses pam_au

Re: [OpenIndiana-discuss] ssh root login

2013-01-12 Thread Serge Fonville
Hi, Are you able to start SSHD in debug mode? Perhaps that will provide the relevant information. Kind regards/met vriendelijke groet, Serge Fonville http://www.sergefonville.nl Convince Microsoft! They need to add TRUNCATE PARTITION in SQL Server https://connect.microsoft.com/SQLServer/feedb

[OpenIndiana-discuss] ssh root login

2013-01-12 Thread Bob Friesenhahn
I am trying to accomplish ssh root login with a forced command via an entry in /root/.ssh/authorized_keys. This is to support my home-made backup system. The strategy is already working for Solaris 10, Apple OS X, Linux, and FreeBSD hosts. However, it is failing for OpenIndiana and I am havi