On 15 Oct 2019, at 17:49, Rob Crittenden <rcritten@redhat.com> wrote:

Vinícius Ferrão wrote:
Hi Rob

On 15 Oct 2019, at 10:22, Rob Crittenden <rcritten@redhat.com
<mailto:rcritten@redhat.com>> wrote:

Vinícius Ferrão via FreeIPA-users wrote:
Hello,

I’m trying to implement SSH Hostbased Authentication between IPA
joined machines but I’m with difficulties regarding:

* The /etc/ssh/ssh_known_hosts file.

In a FreeIPA environment the known_hosts are stored on IPA, and I’m
aware of the ProxyCommand /usr/bin/sss_ssh_knownhostsproxy; but how
can I create this file with the entries from FreeIPA?

Why do you want to? That is the point of the proxy, so dynamic files
don't need to be maintained.

Because it appears to be a requirement. Unfortunately SSH does not look
at /var/lib/sss/pubconf/known_hosts:

debug1: userauth_hostbased: cuser admin chost
hpclab01.cluster.iq.ufrj.br <http://hpclab01.cluster.iq.ufrj.br>. pkalg
ecdsa-sha2-nistp256 slen 100 [preauth]
debug3: mm_key_allowed entering [preauth]
debug3: mm_request_send entering: type 22 [preauth]
debug3: mm_key_allowed: waiting for MONITOR_ANS_KEYALLOWED [preauth]
debug3: mm_request_receive_expect entering: type 23 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 22
debug3: mm_answer_keyallowed entering
debug3: mm_answer_keyallowed: key_from_blob: 0x561842345040
debug2: hostbased_key_allowed: chost hpclab01.cluster.iq.ufrj.br
<http://hpclab01.cluster.iq.ufrj.br>. resolvedname
hpclab01.cluster.iq.ufrj.br <http://hpclab01.cluster.iq.ufrj.br> ipaddr
172.26.0.1
debug2: stripping trailing dot from chost hpclab01.cluster.iq.ufrj.br
<http://hpclab01.cluster.iq.ufrj.br>.
debug2: auth_rhosts2: clientuser admin hostname
hpclab01.cluster.iq.ufrj.br <http://hpclab01.cluster.iq.ufrj.br> ipaddr
172.26.0.1
debug1: temporarily_use_uid: 1683000000/1683000000 (e=0/0)
debug1: restore_uid: 0/0
debug1: fd 8 clearing O_NONBLOCK
debug2: hostbased_key_allowed: access allowed by auth_rhosts2
debug1: temporarily_use_uid: 1683000000/1683000000 (e=0/0)
debug1: restore_uid: 0/0
debug1: check_key_in_hostfiles: key for host hpclab01.cluster.iq.ufrj.br
<http://hpclab01.cluster.iq.ufrj.br> not found
debug1: temporarily_use_uid: 1683000000/1683000000 (e=0/0)
debug1: restore_uid: 0/0
debug1: check_key_in_hostfiles: key for host hpclab01.cluster.iq.ufrj.br
<http://hpclab01.cluster.iq.ufrj.br> not found
debug3: mm_answer_keyallowed: key 0x561842345040 is not allowed
Failed hostbased for admin from 172.26.0.1 port 55634 ssh2: ECDSA
SHA256:wJ0OVmkiVnMjuoiRe5sdBVz5sMTTKIbYRWorTk+CnUQ, client user "admin",
client host "hpclab01.cluster.iq.ufrj.br
<http://hpclab01.cluster.iq.ufrj.br>”

It does for me:

debug3: hostkeys_foreach: reading file "/root/.ssh/known_hosts"
debug3: hostkeys_foreach: reading file "/var/lib/sss/pubconf/known_hosts"
debug3: record_hostkey: found key type ED25519 in file
/var/lib/sss/pubconf/known_hosts:2
debug3: record_hostkey: found key type RSA in file
/var/lib/sss/pubconf/known_hosts:4
debug3: record_hostkey: found key type ECDSA in file
/var/lib/sss/pubconf/known_hosts:6

The client only pushes the SSHFP records on enrollment if IPA is serving
DNS.

Rob, I’m not sure if we are talking about the same thing. In fact this part works for me too:

debug1: Authenticating to hpclab03:22 as 'root'
debug3: hostkeys_foreach: reading file "/var/lib/sss/pubconf/known_hosts"
debug3: record_hostkey: found key type ED25519 in file /var/lib/sss/pubconf/known_hosts:2
debug3: record_hostkey: found key type ECDSA in file /var/lib/sss/pubconf/known_hosts:4
debug3: record_hostkey: found key type RSA in file /var/lib/sss/pubconf/known_hosts:6
debug3: load_hostkeys: loaded 3 keys from hpclab03

But it’s not here the problem. The problem is when starting HBA (Hostbased Authentication).

debug1: Next authentication method: hostbased

Here is the problem:

debug3: userauth_hostbased: trying key type ecdsa-sha2-nistp256-cert-v01@openssh.com
debug3: userauth_hostbased: trying key type ecdsa-sha2-nistp384-cert-v01@openssh.com
debug3: userauth_hostbased: trying key type ecdsa-sha2-nistp521-cert-v01@openssh.com
debug3: userauth_hostbased: trying key type ssh-ed25519-cert-v01@openssh.com
debug3: userauth_hostbased: trying key type ssh-rsa-cert-v01@openssh.com
debug3: userauth_hostbased: trying key type ssh-dss-cert-v01@openssh.com
debug3: userauth_hostbased: trying key type ecdsa-sha2-nistp256
debug1: userauth_hostbased: trying hostkey ecdsa-sha2-nistp256 SHA256:Nwwv7gndOGwipEM3I8AGQEUX7OP9LvgFG0V7TXJ0XcI
debug2: userauth_hostbased: chost hpclab01.cluster.iq.ufrj.br.
debug3: send packet: type 50
debug2: we sent a hostbased packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive,hostbased
debug3: userauth_hostbased: trying key type ecdsa-sha2-nistp256
debug3: userauth_hostbased: trying key type ecdsa-sha2-nistp384
debug3: userauth_hostbased: trying key type ecdsa-sha2-nistp521
debug3: userauth_hostbased: trying key type ssh-ed25519
debug1: userauth_hostbased: trying hostkey ssh-ed25519 SHA256:9O5hkM8gLvGPcoZE9t5zbGxAxHGq7RsCZ5ScjltBZpQ
debug2: userauth_hostbased: chost hpclab01.cluster.iq.ufrj.br.
debug3: send packet: type 50
debug2: we sent a hostbased packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive,hostbased
debug3: userauth_hostbased: trying key type ssh-ed25519
debug3: userauth_hostbased: trying key type rsa-sha2-512
debug3: userauth_hostbased: trying key type rsa-sha2-256
debug3: userauth_hostbased: trying key type ssh-rsa
debug1: userauth_hostbased: trying hostkey ssh-rsa SHA256:+Zl4g2C+AALTHr0K/qkcSDkU6wVQ+CygatAn7x9bRUI
debug2: userauth_hostbased: chost hpclab01.cluster.iq.ufrj.br.
debug3: send packet: type 50
debug2: we sent a hostbased packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive,hostbased
debug3: userauth_hostbased: trying key type ssh-rsa
debug3: userauth_hostbased: trying key type ssh-dss
debug1: No more client hostkeys for hostbased authentication.

If I manually create the file: /etc/ssh/ssh_known_hosts with the entries it works, so it’s definitely not looking in /var/lib/sss/pubconf/known_hosts or the proxy isn’t being called during HBA.

If it’s still not clear what I mean I can try to rephrase it.

Thanks again.


rob



If you look at the sshd log there is this:
debug1: check_key_in_hostfiles: key for host hpclab01.cluster.iq.ufrj.br
<http://hpclab01.cluster.iq.ufrj.br> not found




But if I create the file manually it will work:

debug1: check_key_in_hostfiles: key for hpclab01.cluster.iq.ufrj.br
<http://hpclab01.cluster.iq.ufrj.br> found at /etc/ssh/ssh_known_hosts:1



Any ideias?


* Another issue is with the /etc/ssh/shosts.equiv file.

It supports plain hostnames or netgroups, which is a NIS thing.
FreeIPA offers any netgroups compatibility? I’m expecting to put
something like: @nodes on this file to keep it simple. Any changes on
IPA hosts would be reflected automatically.

IPA hostgroups are automatically mirrored as netgroups.

Nice, this worked flawlessly!!!


rob

Thank you very much.

V.