Passwordless authentication between two domains.
Thu Nov 29 00:00:00 GMT 2012
On 11/28/2012 1:21 PM, anulav2 wrote:
> Keys will "ALWAYS" be different irrespective if it is two servers on same or different domain.
> That is the whole point of copying keys to remote servers authorized_keys file.
I don't think so. I do know the following - here at my current client
there are two distinct domains that I deal with - Irvine and San Jose.
My Windows laptop is in the Irvine domain. My home directory is on a
filer and is shared between my Windows laptop and the various Linux
server machines in Irvine. I generate a key and put it in my
~/.ssh/authorized_keys and I can ssh to localhost or any of the Linux
servers. Additionally I can ssh from Linux to my laptop, passwordlessly.
If I take that key and put it into the ~/.ssh/authorized_keys in San
Jose then this allows me to ssh into from Irvine to San Jose without a
password. But I cannot ssh from San Jose -> Irvine without being
prompted for a password.
However if I generate a key in San Jose and put it in
~/.ssh/authorize_keys in Irvine then I can ssh from San Jose -> Irvine
without a password. This tells me that generated ssh keys are unique per
domain. For bilateral ssh passwordless logins between the two domains
you should have at least 2 lines in your ~/.ssh/authorized_keys file,
one for each domain:
Note that the 3rd field is treated as a comment so I changed it to
adefaria@Irvine and adefaria@San Jose. Note 2: The above keys have been
modified to protect them.
Why don't you try what I suggest and then report back if it worked.
> Else one could just "cat" its own key in its own authorized_keys file, right?
But one can just "cat" their own key to their own authorized_keys file.
That's why permissions on ~/.ssh are of paramount importance to ssh - it
needs to make sure that "Tom" didn't go into "Jane"'s
~/.ssh/authorized_keys file and insert themselves.
It is true that if you run ssh-keygen on different machines in the same
domain you'll get different keys, but within the context of that domain
any one of those keys will work. That's why sharing your home directory
is a good thing and that's why I always work to get my home directory
shared between Windows and Linux systems.
Andrew DeFaria <http://defaria.com>
I'm a tagline virus, please copy me to your signature file
Problem reports: http://cygwin.com/problems.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
More information about the Cygwin