Discussion:
A question about ssh RSA key connection
(too old to reply)
徐广
2009-08-23 03:34:05 UTC
Permalink
Hi
I recently met with a problem when trying to set up ssh connection
through the ssh key

I first create a key through command ssh-keygen -t rsa -f
/.ssh/pmcftp_id_rsa -P "" , two files would be created under /.ssh
pmcftp_id_rsa and pmcftp_id_rsa.pub, then I insert an entry into the
.pub file - from=3D"47.154.169.129,47.154.169.128" this should
restrickt that the ssh key should only work for sources of these two
ips.
Then I push the public key to another server under ~pmcftp/.ssh, after
that, I start the ssh connection through command ssh -I pmcftp -i.
./ssh/pmcftp_id_rsa <server ip>, the ssh connection would be set up
without asking for the passwd.
But, when I create the ssh key on a server that has several ip
address, like following:
=3D=3D=3D=3D=3D
ifconfig -a
lo0: flags=3D2001000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4,VIRTUAL> mtu
8232 index 1
inet 127.0.0.1 netmask ff000000
uplink0: flags=3D1040863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,DEPRECAT=
ED,IPv4>
mtu 1500 index 2
inet 47.154.169.130 netmask ffffff00 broadcast 47.154.169.255
ether 0:0:bb:2e:74:e
uplink0:1: flags=3D1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4>
mtu 1500 index 2
inet 47.154.169.128 netmask ffffff00 broadcast 47.154.169.255
uplink0:2: flags=3D1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4>
mtu 1500 index 2
inet 47.154.169.129 netmask ffffff00 broadcast 47.154.169.255
uplink1: flags=3D1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 inde=
x 3
inet 192.168.47.1 netmask ffffff00 broadcast 192.168.47.255
ether 0:0:bb:2e:74:d
=3D=3D=3D=3D=3D
And added ip 47.154.169.128 and 47.154.169.129 into the from ip list
entry in the key file, then I push the ssh key to server
47.154.169.130 (which should be the same server as the source)
Then when I try to start the ssh connection through command ssh -I
pmcftp -i. ./ssh/pmcftp_id_rsa 47.154.169.130 , the key does not work
anymore, and the log give info like this
=3D=3D
Authentication tried for pmcftp with correct key but not from a
permitted host (host=3Diems196-unit0, ip=3D47.154.169.130)
=3D=3D
Obviously, here the from ip list does not include 47.154.169.130, and
the ssh connection treate the from ip as 47.154.169.130 not other ips
of this server.
Then I tried another command
Ssh -b 47.154.169.128 -I pmcftp -i. ./ssh/pmcftp_id_rsa
47.154.169.130 the key works well again.
The -b option is binding the from ip to 57.154.169.128 and it's in the
from ip list in the key file.

how the ip of the from side of the ssh connection is obtained? When
the from side of the ssh connection has several ips how would the ip
address be determined by the to side?
Any info would be highly appreciated, thanks in advance!

Best regards
Guang

--
=D0=EC=B9=E3
13581797776
Robert Hajime Lanning
2009-08-24 18:36:53 UTC
Permalink
Post by 徐广
how the ip of the from side of the ssh connection is obtained? When
the from side of the ssh connection has several ips how would the ip
address be determined by the to side?
This is actually system specific, not ssh.

It is the address of the outbound interface (as determined by the
routing table.)
If the outbound interface has multiple addresses, then it gets the
primary address.

--=20
And, did Galoka think the Ulus were too ugly to save?
-Centauri
m***@gmail.com
2009-08-24 18:39:10 UTC
Permalink
this is far from a ssh problem, as the connect src address is selected
by system, mostly by the default routing set, in your case, there are
many IP in the same vlan/ip space, that will be choosed to be the first
ip in your ip list, .130 is the first then.

you may use the "-b" option if you really need to set your src ip
address.


圚 2009-08-22六的 12:10 +0800埐广写道
Post by 徐广
Hi
I recently met with a problem when trying to set up ssh connection
through the ssh key
I first create a key through command ssh-keygen -t rsa -f
/.ssh/pmcftp_id_rsa -P "" , two files would be created under /.ssh
pmcftp_id_rsa and pmcftp_id_rsa.pub, then I insert an entry into the
.pub file - from="47.154.169.129,47.154.169.128" this should
restrickt that the ssh key should only work for sources of these two
ips.
Then I push the public key to another server under ~pmcftp/.ssh, after
that, I start the ssh connection through command ssh -I pmcftp -i.
./ssh/pmcftp_id_rsa <server ip>, the ssh connection would be set up
without asking for the passwd.
But, when I create the ssh key on a server that has several ip
=====
ifconfig -a
lo0: flags=2001000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4,VIRTUAL> mtu
8232 index 1
inet 127.0.0.1 netmask ff000000
uplink0: flags=1040863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,DEPRECATED,IPv4>
mtu 1500 index 2
inet 47.154.169.130 netmask ffffff00 broadcast 47.154.169.255
ether 0:0:bb:2e:74:e
uplink0:1: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4>
mtu 1500 index 2
inet 47.154.169.128 netmask ffffff00 broadcast 47.154.169.255
uplink0:2: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4>
mtu 1500 index 2
inet 47.154.169.129 netmask ffffff00 broadcast 47.154.169.255
uplink1: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
inet 192.168.47.1 netmask ffffff00 broadcast 192.168.47.255
ether 0:0:bb:2e:74:d
=====
And added ip 47.154.169.128 and 47.154.169.129 into the from ip list
entry in the key file, then I push the ssh key to server
47.154.169.130 (which should be the same server as the source)
Then when I try to start the ssh connection through command ssh -I
pmcftp -i. ./ssh/pmcftp_id_rsa 47.154.169.130 , the key does not work
anymore, and the log give info like this
==
Authentication tried for pmcftp with correct key but not from a
permitted host (host=iems196-unit0, ip=47.154.169.130)
==
Obviously, here the from ip list does not include 47.154.169.130, and
the ssh connection treate the from ip as 47.154.169.130 not other ips
of this server.
Then I tried another command
Ssh -b 47.154.169.128 -I pmcftp -i. ./ssh/pmcftp_id_rsa
47.154.169.130 the key works well again.
The -b option is binding the from ip to 57.154.169.128 and it's in the
from ip list in the key file.
how the ip of the from side of the ssh connection is obtained? When
the from side of the ssh connection has several ips how would the ip
address be determined by the to side?
Any info would be highly appreciated, thanks in advance!
Best regards
Guang
--
埐广
13581797776
徐广
2009-08-24 18:41:48 UTC
Permalink
Thanks ming for your reply

When I connect to 47.154.169.130 the from ip would be
47.154.169.130, but when I try to connect to other servers, the from
ip became 47.154.169.128, so this is really refusing me.
Post by m***@gmail.com
this is far from a ssh problem, as the connect src address is selected
by system, mostly by the default routing set, in your case, there are
many IP in the same vlan/ip space, that will be choosed to be the first
ip in your ip list, .130 is the first then.
you may use the "-b" option if you really need to set your src ip
address.
=D4=DA 2009-08-22=C1=F9=B5=C4 12:10 +0800=A3=AC=D0=EC=B9=E3=D0=B4=B5=C0=
=A3=BA
Post by m***@gmail.com
Post by 徐广
Hi
I recently met with a problem when trying to set up ssh connection
through the ssh key
I first create a key through command ssh-keygen -t rsa -f
/.ssh/pmcftp_id_rsa -P "" , two files would be created under /.ssh
pmcftp_id_rsa and pmcftp_id_rsa.pub, then I insert an entry into the
.pub file - from=3D"47.154.169.129,47.154.169.128" this should
restrickt that the ssh key should only work for sources of these two
ips.
Then I push the public key to another server under ~pmcftp/.ssh, after
that, I start the ssh connection through command ssh -I pmcftp -i.
./ssh/pmcftp_id_rsa <server ip>, the ssh connection would be set up
without asking for the passwd.
But, when I create the ssh key on a server that has several ip
=3D=3D=3D=3D=3D
ifconfig -a
lo0: flags=3D2001000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4,VIRTUAL> mtu
8232 index 1
inet 127.0.0.1 netmask ff000000
uplink0: flags=3D1040863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,DEPRE=
CATED,IPv4>
Post by m***@gmail.com
Post by 徐广
mtu 1500 index 2
inet 47.154.169.130 netmask ffffff00 broadcast 47.154.169.255
ether 0:0:bb:2e:74:e
uplink0:1: flags=3D1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv=
4>
Post by m***@gmail.com
Post by 徐广
mtu 1500 index 2
inet 47.154.169.128 netmask ffffff00 broadcast 47.154.169.255
uplink0:2: flags=3D1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv=
4>
Post by m***@gmail.com
Post by 徐广
mtu 1500 index 2
inet 47.154.169.129 netmask ffffff00 broadcast 47.154.169.255
uplink1: flags=3D1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 i=
ndex 3
Post by m***@gmail.com
Post by 徐广
inet 192.168.47.1 netmask ffffff00 broadcast 192.168.47.255
ether 0:0:bb:2e:74:d
=3D=3D=3D=3D=3D
And added ip 47.154.169.128 and 47.154.169.129 into the from ip list
entry in the key file, then I push the ssh key to server
47.154.169.130 (which should be the same server as the source)
Then when I try to start the ssh connection through command ssh -I
pmcftp -i. ./ssh/pmcftp_id_rsa 47.154.169.130 , the key does not work
anymore, and the log give info like this
=3D=3D
Authentication tried for pmcftp with correct key but not from a
permitted host (host=3Diems196-unit0, ip=3D47.154.169.130)
=3D=3D
Obviously, here the from ip list does not include 47.154.169.130, and
the ssh connection treate the from ip as 47.154.169.130 not other ips
of this server.
Then I tried another command
Ssh -b 47.154.169.128 -I pmcftp -i. ./ssh/pmcftp_id_rsa
47.154.169.130 the key works well again.
The -b option is binding the from ip to 57.154.169.128 and it's in the
from ip list in the key file.
how the ip of the from side of the ssh connection is obtained? When
the from side of the ssh connection has several ips how would the ip
address be determined by the to side?
Any info would be highly appreciated, thanks in advance!
Best regards
Guang
--
=D0=EC=B9=E3
13581797776
--=20
=D0=EC=B9=E3
13581797776
Sharad
2009-08-24 19:56:11 UTC
Permalink
How is your DNS setup? How does this work when you connect with hostnames i=
nstead of IP Addresses? Do other two aliases (uplink0:1 and 0:2) have same =
name as primary interface's?=0A=0ASharad=0A=0A--- On Mon, 24/8/09, =E5=BE=
=90=E5=B9=BF <***@gmail.com> wrote:=0A=0A> From: =E5=BE=90=E5=B9=BF =
<***@gmail.com>=0A> Subject: Re: A question about ssh RSA key connec=
tion=0A> To: "***@gmail.com" <***@gmail.com>=0A> Cc: secureshell@=
securityfocus.com=0A> Date: Monday, 24 August, 2009, 8:46 AM=0A> Thanks min=
g for your reply=0A> =0A> When I connect to=C2=A0 47.154.169.130 the from i=
p would=0A> be=0A> 47.154.169.130, but when I try to connect to other serve=
rs,=0A> the from=0A> ip became 47.154.169.128, so this is really refusing m=
e.=0A> =0A> =0A> =0A> 2009/8/24 ***@gmail.com=0A> <***@gmail.com>=
:=0A> > this is far from a ssh problem, as the connect src=0A> address is s=
elected=0A> > by system, mostly by the default routing set, in your=0A> cas=
e, there are=0A> > many IP in the same vlan/ip space, that will be=0A> choo=
sed to be the first=0A> > ip in your ip list, .130 is the first then.=0A> >=
=0A> > you may use the "-b" option if you really need to set=0A> your src i=
p=0A> > address.=0A> >=0A> >=0A> > =E5=9C=A8 2009-08-22=E5=85=AD=E7=9A=84 1=
2:10 +0800=EF=BC=8C=E5=BE=90=E5=B9=BF=E5=86=99=E9=81=93=EF=BC=9A=0A> >> Hi=
=0A> >> I recently met with a problem when trying to set=0A> up ssh connect=
ion=0A> >> through the ssh key=0A> >>=0A> >> I first create a key through c=
ommand ssh-keygen -t=0A> rsa -f=0A> >> /.ssh/pmcftp_id_rsa -P "" , two file=
s would be=0A> created under /.ssh=0A> >> pmcftp_id_rsa and pmcftp_id_rsa.p=
ub, then I insert=0A> an entry into the=0A> >> .pub file -=0A> from=3D"47.1=
54.169.129,47.154.169.128"=C2=A0 this should=0A> >> restrickt that the ssh =
key should only work for=0A> sources of these two=0A> >> ips.=0A> >> Then I=
push the public key to another server under=0A> ~pmcftp/.ssh, after=0A> >>=
that, I start the ssh connection through command=0A> ssh -I pmcftp -i.=0A>=
./ssh/pmcftp_id_rsa <server ip>, the ssh=0A> connection would be set up=
=0A> >> without asking for the passwd.=0A> >> But, when I create the ssh ke=
y on a server that=0A> has several ip=0A> >> address, like following:=0A> >=
=3D=3D=3D=3D=3D=0A> >> ifconfig -a=0A> >> lo0:=0A> flags=3D2001000849<UP,=
LOOPBACK,RUNNING,MULTICAST,IPv4,VIRTUAL>=0A> mtu=0A> >> 8232 index 1=0A> >>=
=C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0inet=0A> 127.0.0.1 netmask ff000000=
=0A> >> uplink0:=0A> flags=3D1040863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTIC=
AST,DEPRECATED,IPv4>=0A> >> mtu 1500 index 2=0A> >>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0=C2=A0=C2=A0inet=0A> 47.154.169.130 netmask ffffff00 broadcast 47.154.16=
9.255=0A> >>=C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0ether=0A> 0:0:bb:2e:74:e=
=0A> >> uplink0:1:=0A> flags=3D1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULT=
ICAST,IPv4>=0A> >> mtu 1500 index 2=0A> >>=C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0=
=C2=A0inet=0A> 47.154.169.128 netmask ffffff00 broadcast 47.154.169.255=0A>=
uplink0:2:=0A> flags=3D1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAS=
T,IPv4>=0A> >> mtu 1500 index 2=0A> >>=C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=
=A0inet=0A> 47.154.169.129 netmask ffffff00 broadcast 47.154.169.255=0A> >>=
uplink1:=0A> flags=3D1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu=0A> =
1500 index 3=0A> >>=C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0inet=0A> 192.168.=
47.1 netmask ffffff00 broadcast 192.168.47.255=0A> >>=C2=A0 =C2=A0 =C2=A0 =
=C2=A0=C2=A0=C2=A0ether=0A> 0:0:bb:2e:74:d=0A> >> =3D=3D=3D=3D=3D=0A> >> An=
d added ip 47.154.169.128=C2=A0 and=0A> 47.154.169.129=C2=A0 into the from =
ip list=0A> >> entry in the key file, then I push the ssh key to=0A> server=
=0A> >> 47.154.169.130 (which should be the same server as=0A> the source)=
=0A> >> Then when I try to start the ssh connection=0A> through command ssh=
-I=0A> >> pmcftp -i. ./ssh/pmcftp_id_rsa 47.154.169.130 ,=0A> the key does=
not work=0A> >> anymore, and the log give info like this=0A> >> =3D=3D=0A>=
=C2=A0 Authentication tried for pmcftp with correct=0A> key but not from=
a=0A> >> permitted host (host=3Diems196-unit0,=0A> ip=3D47.154.169.130)=0A=
=3D=3D=0A> >> Obviously, here the from ip list does not include=0A> 47=
..154.169.130, and=0A> >> the ssh connection treate the from ip as=0A> 47.15=
4.169.130 not other ips=0A> >> of this server.=0A> >> Then I tried another =
command=0A> >> Ssh -b 47.154.169.128=C2=A0 -I pmcftp -i.=0A> ./ssh/pmcftp_i=
d_rsa=0A> >> 47.154.169.130 the key works well again.=0A> >> The -b option =
is binding the from ip to=0A> 57.154.169.128 and it's in the=0A> >> from ip=
list in the key file.=0A> >>=0A> >> how the ip of the from side of the ssh=
connection=0A> is obtained? When=0A> >> the from side of the ssh connectio=
n has several=0A> ips how would the ip=0A> >> address be determined by the =
to side?=0A> >> Any info would be highly appreciated, thanks in=0A> advance=
!=0A> >>=0A> >> Best regards=0A> >> Guang=0A> >>=0A> >> --=0A> >> =E5=BE=90=
=E5=B9=BF=0A> >> 13581797776=0A> >=0A> >=0A> =0A> =0A> =0A> -- =0A> =E5=BE=
=90=E5=B9=BF=0A> 13581797776=0A> =0A=0A=0A Love Cricket? Check out liv=
e scores, photos, video highlights and more. Click here http://cricket.yaho=
o.com

Loading...