| 1 |
On Fri 19 August 2011 12:58:10 Grant did opine thusly: |
| 2 |
> >> Is the purpose of the Host block in .ssh/config to store the |
| 3 |
> >> hostname of the backup server so it doesn't need to be used |
| 4 |
> >> directly in the rdiff-backup command? |
| 5 |
> > |
| 6 |
> > It forces key-based authentication when connecting to the backup |
| 7 |
> > server. The default is password-based, which obviously won't |
| 8 |
> > work in a cron job. |
| 9 |
> I don't use an .ssh/config at all and I'm not prompted for a |
| 10 |
> password if the keys are in place. My sshd_config is pretty much |
| 11 |
> default and my normal user is prompted for a password. |
| 12 |
|
| 13 |
|
| 14 |
sshd can use various schemes for user authentication. The overall |
| 15 |
process is: |
| 16 |
|
| 17 |
user connects |
| 18 |
user is authenticated somehow |
| 19 |
user's shell is launched |
| 20 |
|
| 21 |
The middle step is highly variable. sshd can do all of it itself using |
| 22 |
only keys, or it could be happy with password authentication, it can |
| 23 |
even use PAM and obey whatever yes/no result PAM comes back with. |
| 24 |
|
| 25 |
sshd runs as root (therefore with access to /etc/shadow) so it could |
| 26 |
even validate passwords itself if it wanted, bypassing login and PAM |
| 27 |
entirely. This is of course a silly idea, but still technically |
| 28 |
feasible. |
| 29 |
. |
| 30 |
.ssh/config is only useful when the user desires options different |
| 31 |
from the global defaults in /etc/ssh/sshd_config, or wants to do extra |
| 32 |
actions for specific destination hosts |
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
> |
| 37 |
> >> Why create a password for the backup user? Doesn't that open |
| 38 |
> >> up the possibility of someone logging in as that user, when |
| 39 |
> >> otherwise the account would only be used for backing up |
| 40 |
> >> files? |
| 41 |
> > |
| 42 |
> > It might work without one; in these instructions the |
| 43 |
> > machine-to-be-backed-up never connects to the backup server as |
| 44 |
> > root, and so you need a way to SCP stuff to the backup server. |
| 45 |
> > I usually use a `pwgen 16` password for these accounts and then |
| 46 |
> > immediately forget it, so nobody will log in to them for a few |
| 47 |
> > billion years at least. |
| 48 |
> > |
| 49 |
> > Does key-based authentication work with no password? I've never |
| 50 |
> > tried. |
| 51 |
> It does! :) |
| 52 |
> |
| 53 |
> - Grant |
| 54 |
-- |
| 55 |
alan dot mckinnon at gmail dot com |
Archives