This is the mail archive of the cygwin mailing list for the Cygwin project.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

RE: can't achieve password-less ssh authentication when my home directory is on a network file server

On Sat, 28 Feb 2004 ncokwqc02<at>sneakemail<dot>com wrote:

> [snip]
> > > So my question is this: How do I modify the file(s) on 'Alpha' or on
> > > '//Filer' to obtain password-less access from 'Beta' to 'Alpha' when the
> > > password file on 'Alpha' says '//Filer/john' is my home directory?
> >
> > Sorry, no can do[*].  This is the way Windows/Samba shares (and other
> > authenticated mounts, e.g., DFS) work.  To access the directory, you
> > need a valid token with a password, otherwise the remote machine won't
> > trust it.  To find out that you allow passwordless authentication, you
> > need to access the directory, which you can't without a password.
> > FWIW, I ran into the same problem on AIX (with DFS).
> I had read lots of previous posts on this topic and should have realized
> the futility of the endeavor. I guess that when I found that setting the
> HOME directory in '/etc/passwd' to a directory on the remote drive made
> it possible to ssh into 'Alpha' and still have simultaneous access to
> the local and remote drives, I thought the objective of password-less
> ssh access might be simultaneously achievable.

Yes, for passwordless authentication, you need to be able to access the
~/.ssh directory *without* typing a password.

> > [*] I can think of a couple of things to try, but don't think either will
> > work too well:
> > - If you have control over the //Filer share, you might try to make the
> > share public (i.e., accessible to anyone).  I'd say that this cure is
> > worse than the disease, though...
> No way I can do that.

Fair enough.

> > - Create a local home directory (e.g. /home/john); mount the remote
> > directory (//Filer) onto it; then mount c:\cygwin\home\john\.ssh onto
> > /home/john/.ssh.
> I want to make sure I understand your suggestion. Does it amount to doing
> the following on 'Alpha'?
>         mkdir /home/john
>         mount //Filer/john /home/john
>         mount c:\cygwin\home\john\.ssh /home/john/.ssh
> In this case my home directory is at '//Filer/john'.

Yes, exactly.  Note that, as I said below, you will not be able to access
//Filer/john/.ssh as /home/john/.ssh after that.  You should still be able
to access it directly as //Filer/john/.ssh, though, so it's no big loss.
Oh, and you'll need to *create* /home/john/.ssh before mounting
//Filer/john over it...

> > In theory, this should allow you to keep a local (and therefore
> > accessible without a password) copy of the .ssh directory, while the
> > rest of your files are on the Samba share.  The caveat, of course, is
> > that you won't be able to access the remote .ssh directory, if there
> > is one.  Also, make sure the mounts are all system mounts, so sshd can
> > pick them up.
> >
> > Please let us know if either works for you.
> >       Igor
> BTW, on a related, but slightly different topic, I didn't even get to this
> point until I solved the problem of 'cygrunsrv -S sshd' resulting in 'Error
> 1062'. Thank goodness for 'log' files! When I finally looked at
> '/var/log/sshd.log' I saw it filled with repetitions of the message
>         "/var/empty must be owned by root and not group or world-writable."
> Indeed '/var/empty' was owned by 'john:Users'. After I changed it to
> 'SYSTEM:root', I was able to start 'sshd'. I don't understand why the
> '/var/empty' directory created by '/bin/ssh-host-config' didn't have the
> right ownership. But it didn't.

I actually don't recall you attaching the output of "cygcheck -svr" for
your machine (as requested in <>).  This
would tell us, among other things, the version of Windows and the version
of the openssh package that you're running.  AFAICS, ssh-host-config in
the latest couple of versions of openssh contains a bit of code specific
to NT-based systems that *does* chown /var/empty to SYSTEM:544
(SYSTEM:Administrators, IIRC).  If that didn't work on your machine, we
need to find out why.
      |\      _,,,---,,_
ZZZzz /,`.-'`'    -.  ;-;;,_
     |,4-  ) )-,_. ,\ (  `'-'		Igor Pechtchanski, Ph.D.
    '---''(_/--'  `-'\_) fL	a.k.a JaguaR-R-R-r-r-r-.-.-.  Meow!

"I have since come to realize that being between your mentor and his route
to the bathroom is a major career booster."  -- Patrick Naughton

Unsubscribe info:
Problem reports:

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]