This is the mail archive of the
mailing list for the Cygwin project.
RE: can't achieve password-less ssh authentication when my home directory is on a network file server
- From: Igor Pechtchanski <pechtcha at cs dot nyu dot edu>
- To: ncokwqc02 at sneakemail dot com
- Cc: cygwin at cygwin dot com
- Date: Sat, 28 Feb 2004 20:49:45 -0500 (EST)
- Subject: RE: can't achieve password-less ssh authentication when my home directory is on a network file server
- References: <firstname.lastname@example.org>
- Reply-to: cygwin at cygwin dot com
On Sat, 28 Feb 2004 ncokwqc02<at>sneakemail<dot>com wrote:
> > > So my question is this: How do I modify the file(s) on 'Alpha' or on
> > > '//Filer' to obtain password-less access from 'Beta' to 'Alpha' when the
> > > password file on 'Alpha' says '//Filer/john' is my home directory?
> > Sorry, no can do[*]. This is the way Windows/Samba shares (and other
> > authenticated mounts, e.g., DFS) work. To access the directory, you
> > need a valid token with a password, otherwise the remote machine won't
> > trust it. To find out that you allow passwordless authentication, you
> > need to access the directory, which you can't without a password.
> > FWIW, I ran into the same problem on AIX (with DFS).
> I had read lots of previous posts on this topic and should have realized
> the futility of the endeavor. I guess that when I found that setting the
> HOME directory in '/etc/passwd' to a directory on the remote drive made
> it possible to ssh into 'Alpha' and still have simultaneous access to
> the local and remote drives, I thought the objective of password-less
> ssh access might be simultaneously achievable.
Yes, for passwordless authentication, you need to be able to access the
~/.ssh directory *without* typing a password.
> > [*] I can think of a couple of things to try, but don't think either will
> > work too well:
> > - If you have control over the //Filer share, you might try to make the
> > share public (i.e., accessible to anyone). I'd say that this cure is
> > worse than the disease, though...
> No way I can do that.
> > - Create a local home directory (e.g. /home/john); mount the remote
> > directory (//Filer) onto it; then mount c:\cygwin\home\john\.ssh onto
> > /home/john/.ssh.
> I want to make sure I understand your suggestion. Does it amount to doing
> the following on 'Alpha'?
> mkdir /home/john
> mount //Filer/john /home/john
> mount c:\cygwin\home\john\.ssh /home/john/.ssh
> In this case my home directory is at '//Filer/john'.
Yes, exactly. Note that, as I said below, you will not be able to access
//Filer/john/.ssh as /home/john/.ssh after that. You should still be able
to access it directly as //Filer/john/.ssh, though, so it's no big loss.
Oh, and you'll need to *create* /home/john/.ssh before mounting
//Filer/john over it...
> > In theory, this should allow you to keep a local (and therefore
> > accessible without a password) copy of the .ssh directory, while the
> > rest of your files are on the Samba share. The caveat, of course, is
> > that you won't be able to access the remote .ssh directory, if there
> > is one. Also, make sure the mounts are all system mounts, so sshd can
> > pick them up.
> > Please let us know if either works for you.
> > Igor
> BTW, on a related, but slightly different topic, I didn't even get to this
> point until I solved the problem of 'cygrunsrv -S sshd' resulting in 'Error
> 1062'. Thank goodness for 'log' files! When I finally looked at
> '/var/log/sshd.log' I saw it filled with repetitions of the message
> "/var/empty must be owned by root and not group or world-writable."
> Indeed '/var/empty' was owned by 'john:Users'. After I changed it to
> 'SYSTEM:root', I was able to start 'sshd'. I don't understand why the
> '/var/empty' directory created by '/bin/ssh-host-config' didn't have the
> right ownership. But it didn't.
I actually don't recall you attaching the output of "cygcheck -svr" for
your machine (as requested in <http://cygwin.com/problems.html>). This
would tell us, among other things, the version of Windows and the version
of the openssh package that you're running. AFAICS, ssh-host-config in
the latest couple of versions of openssh contains a bit of code specific
to NT-based systems that *does* chown /var/empty to SYSTEM:544
(SYSTEM:Administrators, IIRC). If that didn't work on your machine, we
need to find out why.
|\ _,,,---,,_ email@example.com
ZZZzz /,`.-'`' -. ;-;;,_ firstname.lastname@example.org
|,4- ) )-,_. ,\ ( `'-' Igor Pechtchanski, Ph.D.
'---''(_/--' `-'\_) fL a.k.a JaguaR-R-R-r-r-r-.-.-. Meow!
"I have since come to realize that being between your mentor and his route
to the bathroom is a major career booster." -- Patrick Naughton
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
Problem reports: http://cygwin.com/problems.html