Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #172585 > unrolled thread

Need a tutorial

Back to article view | Back to linux.debian.user

Contents

  Need a tutorial Gene Heskett <gheskett@shentel.net> - 2016-09-21 16:20 +0200
    Re: Need a tutorial Greg Wooledge <wooledg@eeg.ccf.org> - 2016-09-21 16:30 +0200
      Re: Need a tutorial Gene Heskett <gheskett@shentel.net> - 2016-09-21 22:40 +0200
        Re: Need a tutorial Lars Noodén <lars.nooden@gmail.com> - 2016-09-22 09:50 +0200
          Re: Need a tutorial <tomas@tuxteam.de> - 2016-09-22 10:50 +0200
          Re: Need a tutorial Gene Heskett <gheskett@shentel.net> - 2016-09-22 13:20 +0200
            Re: Need a tutorial <tomas@tuxteam.de> - 2016-09-22 14:10 +0200
              Re: Need a tutorial Gene Heskett <gheskett@shentel.net> - 2016-09-22 18:00 +0200
                Re: Need a tutorial Lars Noodén <lars.nooden@gmail.com> - 2016-09-22 18:10 +0200
                  Re: Need a tutorial Gene Heskett <gheskett@shentel.net> - 2016-09-22 18:40 +0200
            Re: Need a tutorial Lars Noodén <lars.nooden@gmail.com> - 2016-09-22 14:10 +0200
              Re: Need a tutorial Gene Heskett <gheskett@shentel.net> - 2016-09-22 18:20 +0200
                Re: Need a tutorial davidson@freevolt.org - 2016-09-23 05:10 +0200
      Re: Need a tutorial Jude DaShiell <jdashiel@panix.com> - 2016-09-22 15:50 +0200
        Re: Need a tutorial Gene Heskett <gheskett@shentel.net> - 2016-09-22 18:20 +0200
    Re: Need a tutorial <tomas@tuxteam.de> - 2016-09-21 18:30 +0200
      Re: Need a tutorial Gene Heskett <gheskett@shentel.net> - 2016-09-21 22:50 +0200
      Re: Need a tutorial Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-22 17:40 +0200
        Re: Need a tutorial Greg Wooledge <wooledg@eeg.ccf.org> - 2016-09-22 17:50 +0200
          Re: Need a tutorial Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-22 18:20 +0200
        Re: Need a tutorial Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-22 18:10 +0200
        Re: Need a tutorial "Thomas Schmitt" <scdbackup@gmx.net> - 2016-09-22 18:20 +0200
          Re: Need a tutorial Greg Wooledge <wooledg@eeg.ccf.org> - 2016-09-22 18:20 +0200
            Re: Need a tutorial "Thomas Schmitt" <scdbackup@gmx.net> - 2016-09-22 18:30 +0200
              Re: Need a tutorial Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-22 20:10 +0200
              Re: Need a tutorial Stephan Beck <stebe@mailbox.org> - 2016-09-22 20:30 +0200
          Re: Need a tutorial Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-22 19:00 +0200
        Re: Need a tutorial <tomas@tuxteam.de> - 2016-09-22 19:40 +0200
          sending authorized_keys to localhost from an account being created  with adduser --disabled-password [was] Re: Need a tutorial Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-23 14:40 +0200
            Re: sending authorized_keys to localhost from an account being created with adduser --disabled-password [was] Re: Need a tutorial Greg Wooledge <wooledg@eeg.ccf.org> - 2016-09-23 15:00 +0200
              Re: sending authorized_keys to localhost from an account being  created with adduser --disabled-password [was] Re: Need a tutorial Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-23 16:20 +0200
                Re: sending authorized_keys to localhost from an account being  created with adduser --disabled-password [was] Re: Need a tutorial Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-23 16:20 +0200
              Re: sending authorized_keys to localhost from an account being  created with adduser --disabled-password [was] Re: Need a tutorial Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-23 22:30 +0200
            RESOLVED Re: sending authorized_keys to localhost from an account  being created with adduser --disabled-password [was] Re: Need a tutorial Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-23 15:10 +0200
              Re: RESOLVED Re: sending authorized_keys to localhost from an account  being created with adduser --disabled-password [was] Re: Need a tutorial Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-23 16:00 +0200
            Re: sending authorized_keys to localhost from an account being  created with adduser --disabled-password [was] Re: Need a tutorial <tomas@tuxteam.de> - 2016-09-23 15:20 +0200
              Re: sending authorized_keys to localhost from an account being  created with adduser --disabled-password [was] Re: Need a tutorial Stephan Beck <sbeck@secure.mailbox.org> - 2016-09-23 18:50 +0200
                Re: sending authorized_keys to localhost from an account being  created with adduser --disabled-password [was] Re: Need a tutorial <tomas@tuxteam.de> - 2016-09-24 16:10 +0200
    Re: Need a tutorial Dominique Dumont <dod@debian.org> - 2016-09-22 17:30 +0200
      Re: Need a tutorial Gene Heskett <gheskett@shentel.net> - 2016-09-22 18:40 +0200
        Re: Need a tutorial Greg Wooledge <wooledg@eeg.ccf.org> - 2016-09-22 19:00 +0200
          Re: Need a tutorial Bob Bernstein <poobah@ruptured-duck.com> - 2016-09-22 20:10 +0200
            Re: Need a tutorial "Thomas Schmitt" <scdbackup@gmx.net> - 2016-09-22 21:00 +0200
        Re: Need a tutorial Lars Noodén <lars.nooden@gmail.com> - 2016-09-22 19:10 +0200
        Re: Need a tutorial Dominique Dumont <dod@debian.org> - 2016-09-22 20:20 +0200
          Re: Need a tutorial Greg Wooledge <wooledg@eeg.ccf.org> - 2016-09-22 20:40 +0200
            Re: Need a tutorial Dominique Dumont <dod@debian.org> - 2016-09-22 20:50 +0200
          Re: Need a tutorial Gene Heskett <gheskett@shentel.net> - 2016-09-23 04:30 +0200
            Re: Need a tutorial Dominique Dumont <dod@debian.org> - 2016-09-23 09:20 +0200

Page 2 of 3 — ← Prev page 1 [2] 3  Next page →

#172657

I resolved it.
I have to type (as root)

su - test

and the prompt changes.

Stephan


Stephan Beck:
> 
> 
> tomas@tuxteam.de:
>> On Wed, Sep 21, 2016 at 10:18:55AM -0400, Gene Heskett wrote:

> Sorry, Tomas, it's not Gene, it's me who has a special question
> concerning ssh.
> If you create a new user account ("test"), doing as root
> adduser --disabled-password test
> 
> How can you access this new account to generate an ssh key pair there?
> I cannot login to the account selecting "test" as user in the login
> screen on system startup, it's deactivated.
> I cannot try accessing it by ssh because I need to generate a key pair
> first. Could one generate a key pair for "test" from another account?
> 
> If I try
> ssh test@localhost
> ssh: connect to host localhost port 22: Connection refused
> 
> or, temporary enabling password authentication for a moment in
> sshd_config, it prompts for a password (that has never been created
> because of the --disabled-password option, see above).
> 
> Or, what am I missing?
> 
> Thanks in advance.
> 
> Stephan
> 
> I also read the doc you linked to in your other message of this thread,
> but I cannot find my use case.
> 
> 

[toc] | [prev] | [next] | [standalone]

#172662

Hi,

Stephan Beck wrote:
> How can you access this new account to generate an ssh key pair there?

There seems to be a bug with adduser --disabled-password .
With empty password input i get:

  $ su test_user
  Password: 
  su: Authentication failure

Only this succeeds:

  $ su
  Password: 
  # su test_user
  $ whoami
  test_user

adduser gave the user this line in /etc/passwd:

  test_user:x:<number>:<number>:Test User,,,:/home/test_user:/bin/bash

and in /etc/shadow

  test_user:*:17066:0:99999:7:::


Above will not work with users who have /usr/sbin/nologin as shell

  "NOLOGIN(8)        System Management Commands           NOLOGIN(8)

   NAME
          nologin - politely refuse a login
  "

which is used to nail up the user's lines in /etc/passwd like:

  backup:x:34:34:backup:/var/backups:/usr/sbin/nologin

resulting in

  # su backup
  This account is currently not available.

One has to work around by explicitely giving the shell to use

  # su backup -s /bin/bash
  $ whoami
  backup


Greg Wooledge wrote:
> sudo -u test bash

Does not work for me (at least not out of the box):

  $ sudo -u test_user bash
  [sudo] password for thomas: 
  Sorry, user thomas is not allowed to execute '/bin/bash' as test_user on [...]
  $


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#172666

On Thu, Sep 22, 2016 at 06:11:18PM +0200, Thomas Schmitt wrote:
> Greg Wooledge wrote:
> > sudo -u test bash
> 
> Does not work for me (at least not out of the box):
> 
>   $ sudo -u test_user bash
>   [sudo] password for thomas: 
>   Sorry, user thomas is not allowed to execute '/bin/bash' as test_user on [...]
>   $

Well, that's not a fair test.  The previous poster was running adduser,
so he already had superuser privileges, either through sudo or su or
direct root console/ssh login.  From whichever shell he was using to
run adduser, he should also be able to run sudo -u test bash.

[toc] | [prev] | [next] | [standalone]

#172668

Hi,

Greg Wooledge wrote:
> From whichever shell he was using to
> run adduser, he should also be able to run sudo -u test bash.

Ah yes. This works. (One just has to accomodate to the idea of the
superuser running sudo ...)


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#172678

Hi,

Thomas Schmitt:
> Hi,
> 
> Greg Wooledge wrote:
>> From whichever shell he was using to
>> run adduser, he should also be able to run sudo -u test bash.
> 
> Ah yes. This works. (One just has to accomodate to the idea of the
> superuser running sudo ...)


Yes, Greg and Thomas, I've just tried

sudo -u test bash

and it definitely works here as well.

Thanks

Stephan

[toc] | [prev] | [next] | [standalone]

#172681

Hi,

Thomas Schmitt:
> Hi,
> 
> Greg Wooledge wrote:
>> From whichever shell he was using to
>> run adduser, he should also be able to run sudo -u test bash.
> 
> Ah yes. This works. (One just has to accomodate to the idea of the
> superuser running sudo ...)

Yes, Greg and Thomas, I've just tried

sudo -u test bash

and it definitely works.

Thanks

Stephan

[toc] | [prev] | [next] | [standalone]

#172673

Hi,

Thomas Schmitt:
> Hi,
> 
> Stephan Beck wrote:
>> How can you access this new account to generate an ssh key pair there?
> 
[sorry for trimming]

> Greg Wooledge wrote:
>> sudo -u test bash
> 
> Does not work for me (at least not out of the box):
> 
>   $ sudo -u test_user bash
>   [sudo] password for thomas: 
>   Sorry, user thomas is not allowed to execute '/bin/bash' as test_user on [...]
>   $
> 
Yes, I was running adduser from the root console, as Greg assumed.
So, I saw/see no reason running sudo from the root console. In fact, I
put a # directly preceeding the generic SUDO (ALL) ALL etc. entry in
/etc/sudoers, granting determined rights only to specific users. (I
don't know if this affects sudo's overall behaviour). At least, it's
more work having to insert additional rights in /etc/sudoers for "test"
(in order to do a sudo), if I just want to ssh-keygen, ssh-copy-id and
then deactivate password authentication in sshd_config once again (to go
for pubkey auth).

Thanks for your additional comments.

Stephan

[toc] | [prev] | [next] | [standalone]

#172675

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Sep 22, 2016 at 03:35:00PM +0000, Stephan Beck wrote:
> 
> 
> tomas@tuxteam.de:

[mumble]

> > This is the bird's view. Ask if you get stuck.


> Sorry, Tomas, it's not Gene, it's me who has a special question

No need to be sorry :-)

But I see you found a solution and other chimed in with sage advice.

Regards
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlfkFd0ACgkQBcgs9XrR2kYIzwCcDK3OkCB1HILwCpFkgyrIla2V
OCEAn2MpMIpG4TfpTTcNEqL32QJiAQr9
=WDsS
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#172703 — sending authorized_keys to localhost from an account being created with adduser --disabled-password [was] Re: Need a tutorial

Hi

tomas@tuxteam.de:
> On Thu, Sep 22, 2016 at 03:35:00PM +0000, Stephan Beck wrote:
> 
> 
>> tomas@tuxteam.de:
> 
> [mumble]
> 
>>> This is the bird's view. Ask if you get stuck.
> 
> 
>> Sorry, Tomas, it's not Gene, it's me who has a special question
> 
> No need to be sorry :-)

Fine! :-)
> 
> But I see you found a solution and other chimed in with sage advice.
> 

Well, I have another one :-), a question, not a solution yet.


I have created a new user account with
adduser --disabled-password
What do I want to do?
I'd like to login to this account "test" from my normal user account by
ssh via pubkey authentication. My (normal) user account has its keys
generated and properly deposited on localhost. I logged into the account
"test" via su - test, creating a keypair. Fine.

How do I get this public key onto localhost?
I mean, I can create an authorized_keys file manually, copying the
public key into this authorized_keys file, but it's still in the user's
directory where it has been generated, it needs to be sent (or get
somehow) to localhost.

I have tried:
test@mymachine cat .ssh/id_rsa.pub | ssh localhost 'cat >>
.ssh/authorized_keys'

But it's asking me a password. There is none.
If I disable Password Authentication in sshd_config, and then try to
send it to localhost, it fails with something like "denied access
publickey required". No mystery at all, because this very public key is
being sent to localhost in this very moment and can't be used in the
same act for authentication purposes.

I've been reading a bunch of related docs in the man pages, debian wiki,
in the exquisite and very readable Debian Administrator's Handbook by
Raphael Mas and Raphaël Hertzog, and other linux ssh documentation. I
can't find my specific use case and I'm stuck.

Any hints (also from other people) welcome.

Stephan

on Debian-Jessie

[toc] | [prev] | [next] | [standalone]

#172704 — Re: sending authorized_keys to localhost from an account being created with adduser --disabled-password [was] Re: Need a tutorial

On Fri, Sep 23, 2016 at 12:31:00PM +0000, Stephan Beck wrote:
> I have created a new user account with
> adduser --disabled-password
> What do I want to do?
> I'd like to login to this account "test" from my normal user account by
> ssh via pubkey authentication. My (normal) user account has its keys
> generated and properly deposited on localhost. I logged into the account
> "test" via su - test, creating a keypair. Fine.

Typically, you want to create the keypair as the user on the machine which
will be the client.  This way the private key never has to be touched,
moved, looked at, etc.

So, you want to ssh
FROM user "stephan" on this machine
TO   user "test"    on this (same) machine

The private key needs to reside in ~stephan/.ssh/ where the client will
see it.

The public key needs to be concatenated into ~test/.ssh/authorized_keys
where the server will see it.

> How do I get this public key onto localhost?

Trick question.  You are already on the correct machine.  You just need
to have everything in the correct places (files/directories) with the
correct ownerships.

> I mean, I can create an authorized_keys file manually, copying the
> public key into this authorized_keys file, but it's still in the user's
> directory where it has been generated, it needs to be sent (or get
> somehow) to localhost.

As user stephan:

stephan@hostname:~$ ssh-keygen

As user root:

stephan@hostname:~$ sudo mkdir -p ~test/.ssh
stephan@hostname:~$ sudo sh -c 'cat ~stephan/.ssh/id_rsa.pub >> ~test/.ssh/authorized_keys'
stephan@hostname:~$ sudo chown test ~test/.ssh ~test/.ssh/authorized_keys
stephan@hostname:~$ sudo chmod 700 ~test/.ssh
stephan@hostname:~$ sudo chmod 600 ~test/.ssh/authorized_keys

(Of course, if you prefer you could just obtain a root shell and then run
all of the commands without sudo.)

As user stephan, to test that it works:

stephan@hostname:~$ ssh test@localhost id

If your username isn't actually "stephan", substitute accordingly.

[toc] | [prev] | [next] | [standalone]

#172708 — Re: sending authorized_keys to localhost from an account being created with adduser --disabled-password [was] Re: Need a tutorial

Thanks, Greg. I trimmed your message just to let you know that it does
not work.

Greg Wooledge:
> On Fri, Sep 23, 2016 at 12:31:00PM +0000, Stephan Beck wrote:

> As user stephan, to test that it works:
> 
> stephan@hostname:~$ ssh test@localhost id
> 
> If your username isn't actually "stephan", substitute accordingly.


me@mymachine:~$ sudo service ssh restart
me@mymachine:~$ ssh xb1158@localhost id
Permission denied (publickey).

I now will read carefully your (and the other messages sent in reply)
and will give a more thorough reply in a while. When I send my messages,
I send them and do not read the answers (arrived in the meantime) first,
so please do not think that I'm not interested in them.

Many thanks.

Stephan

[toc] | [prev] | [next] | [standalone]

#172709 — Re: sending authorized_keys to localhost from an account being created with adduser --disabled-password [was] Re: Need a tutorial

Stephan Beck:
> Thanks, Greg. I trimmed your message just to let you know that it does
> not work.


To be clear: after having found my solution I did your test (only the
test reproduced at the end of your message) and my solution does not work.

Thanks
Stephan

[toc] | [prev] | [next] | [standalone]

#172719 — Re: sending authorized_keys to localhost from an account being created with adduser --disabled-password [was] Re: Need a tutorial

Hi Greg and Tomás (one mail for all to limit the load of this thread on
the list) :-)

Greg Wooledge:
> On Fri, Sep 23, 2016 at 12:31:00PM +0000, Stephan Beck wrote:
[...]
> As user root:
> 
> stephan@hostname:~$ sudo mkdir -p ~test/.ssh
> stephan@hostname:~$ sudo sh -c 'cat ~stephan/.ssh/id_rsa.pub >> ~test/.ssh/authorized_keys'
> stephan@hostname:~$ sudo chown test ~test/.ssh ~test/.ssh/authorized_keys
> stephan@hostname:~$ sudo chmod 700 ~test/.ssh
> stephan@hostname:~$ sudo chmod 600 ~test/.ssh/authorized_keys
I only had to perform command #2, and I ran it from a root shell.
I did the connection test, and it worked fine, but only after
an ssh restart.
Without it, the output was "Permission denied (publickey)"
Command #1 wasn't necessary as ~/test/.ssh had automatically been
created when running ssh-keygen. The permission had already been changed
to its secure values. At least, I came across dash's manpage while
trying to understand what the command actually does! Thanks a lot.

> tomas@tuxteam.de:

> You cannot log into test without superpowers, but you have to modify its
> ~/.ssh/authorized_keys. That means you *need* superpowers. For example
> 
>   sudo -s # or similar
>   cat ~steph/.ssh/id_rsa.pub >> ~/test/.ssh/authorized_keys
>   chown test:test ~/test/.ssh/authorized_keys
>   exit

Ran command #2 from a root shell, did the connection test and it worked,
without having to restart ssh.

By the way, when I logged in via ssh (to *test*) now I was greeted by
"Last login [time of my connection attempt]from localhost". So, I
understand that I had logged into *test* via su - test  and then had
connected to *test* (from *test*) via localhost using ssh! Is this
interpretation correct?

Thanks to both of you again.

Stephan

[toc] | [prev] | [next] | [standalone]

#172705 — RESOLVED Re: sending authorized_keys to localhost from an account being created with adduser --disabled-password [was] Re: Need a tutorial

Hi

Stephan Beck:
> Hi
> 
> tomas@tuxteam.de:
>> On Thu, Sep 22, 2016 at 03:35:00PM +0000, Stephan Beck wrote:
>>
>>

> How do I get this public key onto localhost?

No need to reply, I'll send the answer to document my solution within
minutes.


Stephan

[toc] | [prev] | [next] | [standalone]

#172707 — Re: RESOLVED Re: sending authorized_keys to localhost from an account being created with adduser --disabled-password [was] Re: Need a tutorial

Hi,

Stephan Beck:
> Hi
> 
> Stephan Beck:
>> Hi
>>
>> tomas@tuxteam.de:
>>> On Thu, Sep 22, 2016 at 03:35:00PM +0000, Stephan Beck wrote:
>>>
>>>
> 
>> How do I get this public key onto localhost?
> 
> No need to reply, I'll send the answer to document my solution within
> minutes.

Solution (feel free to comment)

#setting password authentication to no
root@mymachine nano /etc/ssh/sshd_config
root@mymachine:~# su - test
test@mymachine:~/.ssh$ chmod 600 authorized_keys
test@mymachine:~/.ssh$ dd if=id_rsa.pub of=authorized_keys
[test@mymachine:~/.ssh$ ssh localhost 'cat >> .ssh/authorized_keys']
test@mymachine:~/.ssh$ ssh -v test@localhost
[..many debug1 messages]
Enter passphrase for key /home/test/.ssh/id_rsa.pub':
debug1: Authentication succeeded (publickey).
Authenticated to localhost ([127.0.0.1]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = de_DE.UTF-8

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
test@mymachine:~$


I think the one put in square brackets by me is redundant, isn't it? I
remember that the system hung for a moment and I did a CTRL-C to abort,
and proceeded with the next command, and then always used the -v option.
How did I find it? I remembered that somewhere in the manpages (not
sure) there was a reference to better make use of dd to copy, and I just
tried.

Have a nice weekend!

Stephan

[toc] | [prev] | [next] | [standalone]

#172706 — Re: sending authorized_keys to localhost from an account being created with adduser --disabled-password [was] Re: Need a tutorial

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, Sep 23, 2016 at 12:31:00PM +0000, Stephan Beck wrote:
> Hi
> 
> tomas@tuxteam.de:
> > On Thu, Sep 22, 2016 at 03:35:00PM +0000, Stephan Beck wrote:
> > 
> > 
> >> tomas@tuxteam.de:
> > 
> > [mumble]
> > 
> >>> This is the bird's view. Ask if you get stuck.
> > 
> > 
> >> Sorry, Tomas, it's not Gene, it's me who has a special question
> > 
> > No need to be sorry :-)
> 
> Fine! :-)
> > 
> > But I see you found a solution and other chimed in with sage advice.
> > 
> 
> Well, I have another one :-), a question, not a solution yet.
> 
> 
> I have created a new user account with
> adduser --disabled-password
> What do I want to do?
> I'd like to login to this account "test" from my normal user account by
> ssh via pubkey authentication. My (normal) user account has its keys
> generated and properly deposited on localhost. I logged into the account
> "test" via su - test, creating a keypair. Fine.

Hang on: your new account (test( doesn't need a keypair. It's your regular
account which needs one (and has one already). You want to log in *from*
your regular account (let's call it "seph" for now) *to* test, right?

Then it's *steph* who has to have a keypair and *test* who has to have
*steph*'s public key included in its ~/.ssh/authorized_keys:


     *steph*             *test*
     .ssh/                 .ssh/
       id_rsa                authorized_keys
       id_rsa.pub              ^
           \                   |
            ------ add -------´


The background is that now *steph* can prove to *test* that he has the
right secret key (without disclosing it).

> How do I get this public key onto localhost?
> I mean, I can create an authorized_keys file manually, copying the
> public key into this authorized_keys file, but it's still in the user's
> directory where it has been generated, it needs to be sent (or get
> somehow) to localhost.
> 
> I have tried:
> test@mymachine cat .ssh/id_rsa.pub | ssh localhost 'cat >>
> .ssh/authorized_keys'

You cannot log into test without superpowers, but you have to modify its
~/.ssh/authorized_keys. That means you *need* superpowers. For example

  sudo -s # or similar
  cat ~steph/.ssh/id_rsa.pub >> ~/test/.ssh/authorized_keys
  chown test:test ~/test/.ssh/authorized_keys
  exit

(the chown just in case authorized_keys didn't exist before).

> But it's asking me a password. There is none.
> If I disable Password Authentication in sshd_config, and then try to
> send it to localhost, it fails with something like "denied access
> publickey required". No mystery at all, because this very public key is
> being sent to localhost in this very moment and can't be used in the
> same act for authentication purposes.
> 
> I've been reading a bunch of related docs in the man pages, debian wiki,
> in the exquisite and very readable Debian Administrator's Handbook by
> Raphael Mas and Raphaël Hertzog, and other linux ssh documentation. I
> can't find my specific use case and I'm stuck.

Either you give this new user a password (temporarily) or you have to
be able to write to its .ssh directory by other means. One of those
means is by becoming root (as sketched above). There are others, like

  - adding yourself to this new user's group and making sure
    its ~/.ssh/authorized_keys is group writable (feels somewhat
    uncomfortable, though)

  - creating the user's home directory from a prepared skeleton
    already containing an "authorized_keys" as you need it

But all those methods need you being root at the machine where
*test* is created. You have to be root to create *test* in the
first place, though! So the proposed method above seems the
least intrusive to me.

Regards
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlflK5QACgkQBcgs9XrR2kb0AACeO1pPTe9vm31zAzvWVhNdH/Wb
EqUAn1Ftz5STEPa2JHhXScrq7nrYbpPa
=cIRd
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#172713 — Re: sending authorized_keys to localhost from an account being created with adduser --disabled-password [was] Re: Need a tutorial

Thank you very much, Tomás.

tomas@tuxteam.de:
> On Fri, Sep 23, 2016 at 12:31:00PM +0000, Stephan Beck wrote:
>> Hi
>> tomas@tuxteam.de:
>>> On Thu, Sep 22, 2016 at 03:35:00PM +0000, Stephan Beck wrote:
[...]
>> I have created a new user account with
>> adduser --disabled-password
>> What do I want to do?
>> I'd like to login to this account "test" from my normal user account by
>> ssh via pubkey authentication. My (normal) user account has its keys
>> generated and properly deposited on localhost. I logged into the account
>> "test" via su - test, creating a keypair. Fine.
> 
> Hang on: your new account (test( doesn't need a keypair. It's your regular
> account which needs one (and has one already). You want to log in *from*
> your regular account (let's call it "seph" for now) *to* test, right?

There are two things here: I had in mind to login from my user account
via ssh to the test account (just to be able to (completely) ssh inside
my machine [for training purposes] and, on the other hand, to ssh
towards the outside (see next sentence) as well. As to the "outside"
part, from the test account I want to login as client to a remote server
and because of that this test account needs a key pair, too. Yes, I know
it has to be deposited on that server, but, again, at the moment of this
thread I still am with (setting up) sshing inside my machine.
> 
> Then it's *steph* who has to have a keypair and *test* who has to have
> *steph*'s public key included in its ~/.ssh/authorized_keys:
> 
> 
>      *steph*             *test*
>      .ssh/                 .ssh/
>        id_rsa                authorized_keys
>        id_rsa.pub              ^
>            \                   |
>             ------ add -------´
> 
> 
> The background is that now *steph* can prove to *test* that he has the
> right secret key (without disclosing it).

OK, I got it, concerning sshing inside my machine. I got confused here
as I remembered that when I had a normal user account (with wheezy) and
a chroot environment (with debian sid installed) on the same machine I
could login from one to the other and vice versa via localhost using ssh
(well, if I remember correctly). It's different, for sure, but it
confused me.
> 
[...]
> You cannot log into test without superpowers, but you have to modify its
> ~/.ssh/authorized_keys. That means you *need* superpowers. For example
> 
>   sudo -s # or similar
>   cat ~steph/.ssh/id_rsa.pub >> ~/test/.ssh/authorized_keys
>   chown test:test ~/test/.ssh/authorized_keys
>   exit

But once my user's (in your terminology, steph's) public key is in the
test account's authorized_keys file, user steph can login without
superpowers, by presenting the private part of the key (well ssh-agent
does it, if I understand things correctly), can't I?
My great mistake was to think that localhost, although being on the same
machine, acts as a somewhat separated server and for that reason the
public keys of all users have to be deposited physically, in a sort of
directory structure within localhost (not in the user's directory),as it
is the case on a remote server. But, as Greg made very clear, I'm
already on the same machine. That was the conceptual mistake I made.
> 
> (the chown just in case authorized_keys didn't exist before).

Well, I have, i.e. had created an authorized_keys with the dd command.
It's there and it contains the public key.
> 
[,,,]
> Either you give this new user a password (temporarily) or you have to
> be able to write to its .ssh directory by other means. One of those
> means is by becoming root (as sketched above). There are others, like
> 
>   - adding yourself to this new user's group and making sure
>     its ~/.ssh/authorized_keys is group writable (feels somewhat
>     uncomfortable, though)

Uuuuuh! No way.
> 
>   - creating the user's home directory from a prepared skeleton
>     already containing an "authorized_keys" as you need it

Ah, that would be fine, but I guess, this time it has to be the hard
way, by typing, without prepared skeletons.

I have to make a break and then I will try to get it done.

Thanks again.

Stephan

[toc] | [prev] | [next] | [standalone]

#172733 — Re: sending authorized_keys to localhost from an account being created with adduser --disabled-password [was] Re: Need a tutorial

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, Sep 23, 2016 at 04:41:00PM +0000, Stephan Beck wrote:
> Thank you very much, Tomás.

glad to help.

[...]

> But once my user's (in your terminology, steph's) public key is in the
> test account's authorized_keys file, user steph can login without
> superpowers, by presenting the private part of the key (well ssh-agent
> does it, if I understand things correctly), can't I?

That's how it's supposed to work (strictly speaking it doesn't present
the private part of the key, but just a *proof* that it is in control
of said private part, which the host account (test) can check).

The ssh-agent is just in charge of keeping unlocked private keys around
so that you only have to unlock them with your passphrase once per
session.

> My great mistake was to think that localhost, although being on the same
> machine, acts as a somewhat separated server and for that reason the
> public keys of all users have to be deposited physically, in a sort of
> directory structure within localhost (not in the user's directory),as it
> is the case on a remote server. But, as Greg made very clear, I'm
> already on the same machine. That was the conceptual mistake I made.

Exactly: the authorized_keys is a per-account thing, meaning "whoever
has the private key corresponding to *this* public key is allowed
to log in as me". Note that you even can restrict what commands are
allowed for each private key -- a "backup" user would only be allowed
to invoke a specific backup script at login, for example.

> > (the chown just in case authorized_keys didn't exist before).

[...]

> >   - creating the user's home directory from a prepared skeleton
> >     already containing an "authorized_keys" as you need it
> 
> Ah, that would be fine, but I guess, this time it has to be the hard
> way, by typing, without prepared skeletons.

And it would only make sense if you go "industrial", as in "every user
on this box shall allow the user "backup" to invoke the per-user
backup script" or some such. I haven't needed that. Just a copy (or
an ssh-copy-id, if at he beginning the password access is available).

Regards
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlfmh/cACgkQBcgs9XrR2ka8lwCdEDbXPQ4Rhr24DmzstfbuzThD
LoIAn1BE33kb23NvEPuidLvc7NxAUnN5
=qpNT
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#172649

On Wednesday, 21 September 2016 10:18:55 CEST Gene Heskett wrote:
> su gene -c "sshfs gene@shop:/ /sshnet/shop"
> su gene -c "sshfs gene@lathe:/ /sshnet/lathe"
> su gene -c "sshfs gene@GO704:/ /sshnet/GO704"

Others have explained how to generate keys. Then you can simplify the process 
by setting up your ~/.ssh/config file with something like:

Host shop lathe GO704
 user gene
 # private key file
 IdentityFile ~/.ssh/my_key_for_sshfs

If you want to use different keys for the several hosts, you will have to 
duplicate the config snippet shown above.

If you're not sure of the syntax of ssh config file, you can use 
'cme edit ssh' to perform this task.

HTH

All the best

-- 
 https://github.com/dod38fr/   -o- http://search.cpan.org/~ddumont/
http://ddumont.wordpress.com/  -o-   irc: dod at irc.debian.org

[toc] | [prev] | [next] | [standalone]

#172670

On Thursday 22 September 2016 11:16:45 Dominique Dumont wrote:

> On Wednesday, 21 September 2016 10:18:55 CEST Gene Heskett wrote:
> > su gene -c "sshfs gene@shop:/ /sshnet/shop"
> > su gene -c "sshfs gene@lathe:/ /sshnet/lathe"
> > su gene -c "sshfs gene@GO704:/ /sshnet/GO704"
>
> Others have explained how to generate keys. Then you can simplify the
> process by setting up your ~/.ssh/config file with something like:
>
Interesting, I don't have that file, its all in /etc/ssh.

> Host shop lathe GO704
>  user gene
>  # private key file
>  IdentityFile ~/.ssh/my_key_for_sshfs
>
> If you want to use different keys for the several hosts, you will have
> to duplicate the config snippet shown above.
>
> If you're not sure of the syntax of ssh config file, you can use
> 'cme edit ssh' to perform this task.

cme=command not found.
> HTH
>
> All the best


Cheers, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

Page 2 of 3 — ← Prev page 1 [2] 3  Next page →

Back to top | Article view | linux.debian.user

csiph-web