置かないというのはできる。 ssh(1) -A Enables forwarding of the authentication agent connection. This can also be specified on a per-host basis in a configuration file. Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent's Unix-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent. しかし、Bの特権を持っている人は秘密鍵を使うことは出来る(秘密鍵本体は盗めない)。 俺は、秘密鍵を使う時はポップアップで確認するようputtyのpagent(authentication agent)を改造してつかっている。
> ssh (リモートのIP) -l (ユーザー名) -i (秘密鍵) -v OpenSSH_4.3p2, OpenSSL 0.9.8b 04 May 2006 debug1: Connecting to (リモートのIP) [(リモートのIP)] port 22. debug1: Connection established. debug1: identity file (秘密鍵) type -1 debug1: Remote protocol version 1.99, remote software version OpenSSH_4.3 debug1: match: OpenSSH_4.3 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_4.3 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-cbc hmac-md5 none debug1: kex: client->server aes128-cbc hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Host '(リモートのIP)' is known and matches the RSA host key. debug1: Found key in /home/toby/.ssh/known_hosts:2 debug1: ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,password,keyboard-interactive debug1: Next authentication method: publickey
%
342 名前：317 [2006/09/25(月) 22:54:37 ]
debug1: Trying private key: (秘密鍵) debug1: PEM_read_PrivateKey failed debug1: read PEM private key done: type <unknown> Enter passphrase for key '(秘密鍵)': debug1: read PEM private key done: type DSA debug1: Authentications that can continue: publickey,password,keyboard-interactive debug1: Next authentication method: keyboard-interactive debug1: Authentications that can continue: publickey,password,keyboard-interactive debug1: Next authentication method: password (ユーザー名)@(リモートのIP)'s password: debug1: Authentication succeeded (password). debug1: channel 0: new [client-session] debug1: Entering interactive session. Last login: Mon Sep 25 22:48:07 2006 from (前回ログインしたローカルホスト) OpenBSD 3.8-stable (GENERIC) #1: Tue May 9 19:59:50 JST 2006
$ sudo /usr/sbin/sshd -d debug1: sshd version OpenSSH_4.2p1 Debian-7ubuntu3 debug1: read PEM private key done: type RSA debug1: private host key: #0 type 1 RSA debug1: read PEM private key done: type DSA debug1: private host key: #1 type 2 DSA debug1: rexec_argv[0]='/usr/sbin/sshd' debug1: rexec_argv[1]='-d' debug1: Bind to port (ポート番号) on ::. Server listening on :: port (ポート番号). debug1: Bind to port (ポート番号) on 0.0.0.0. debug1: Server will not fork when running in debugging mode. debug1: rexec start in 4 out 4 newsock 4 pipe -1 sock 7 debug1: inetd sockets after dupping: 3, 3 Connection from (クライントIP) port 4435 debug1: Client protocol version 2.0; client software version OpenSSH_4.3 debug1: match: OpenSSH_4.3 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_4.2p1 Debian-7ubuntu3 debug1: permanently_set_uid: 100/65534 debug1: list_hostkey_types: ssh-rsa,ssh-dss debug1: An invalid name was supplied Configuration file does not specify default realm
debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: client->server aes128-cbc hmac-md5 none debug1: kex: server->client aes128-cbc hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT
368 名前：307 mailto:sage [2006/09/30(土) 11:09:58 ]
debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: KEX done debug1: userauth-request for user (ユーザー名) service ssh-connection method none debug1: attempt 0 failures 0 debug1: PAM: initializing for "(ユーザー名)" Failed none for (ユーザー名) from (クライアントIP) port 4435 ssh2 debug1: userauth-request for user (ユーザー名) service ssh-connection method publickey debug1: attempt 1 failures 1
ここで辺で時間がかかっている
debug1: PAM: setting PAM_RHOST to "(クライアントのホスト名)" debug1: PAM: setting PAM_TTY to "ssh" debug1: temporarily_use_uid: 1000/1000 (e=0/0) debug1: trying public key file /home/(ユーザー名)/.ssh/authorized_keys debug1: matching key found: file /home/(ユーザー名)/.ssh/authorized_keys, line 1 Found matching DSA key: ******************************************** debug1: restore_uid: 0/0 debug1: ssh_dss_verify: signature correct debug1: do_pam_account: called Accepted publickey for (ユーザー名) from (クライアントIP) port 4435 ssh2 debug1: monitor_child_preauth: (ユーザー名) has been authenticated by privileged process Accepted publickey for (ユーザー名) from (クライアントIP) port 4435 ssh2
