Ssh Key Problem

[ParMan]

i have been having this problem with backtrack ever since i installed r2 when ever i try to start ssh i get the errors.

Could not load host key: /etc/ssh/ssh_host_rsa_key
Could not load host key: /etc/ssh/ssh_host_dsa_key

i ran these commands to get the keys:

ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key
ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key

i am getting these errors on both my laptop running wireless (internet working fine), and a virtual machine (internet works here too).

just dont know whats causing it not to work thanks for all your help.

[Sparda]

Are the files rw-rw-r--?

[ParMan]

-rw------ l root root 736 Jan 4 15:52 /etc/ssh/ssh_host_dsa_key

-rw------ l root root 1743 Jan 4 15:52 /etc/ssh/ssh_host_rsa_key

so i dont think so.

so i changed them to -rw-rw-r and i got this

Edited January 4, 2011 by ParMan

[Sparda]

lol, ok, well, at least it's not a file access problem :P

Change it back of course.

I have to wonder if this is a problem on the server and not the client. ssh-keygen isn't asking you for a passphrase is it?

[ParMan]

when i create the key it ask me for a passphrase.

[Sparda]

You set the passphrase to blank?

[ParMan]

no i didnt but i can.

so i changed them and service started fine. whats up with that?

Edited January 5, 2011 by ParMan

[Sparda]

Go for it :D

[Jason Cooper]

no i didnt but i can.

so i changed them and service started fine. whats up with that?

When starting up the service didn't know what the passphrase was for your keys, so it couldn't decrypt them to use them.

[ParMan]

so its not really a big deal that they keys dont have pass-phases.

[hexophrenic]

Your host keys should not have passphrases. Your user keys most certainly should. Perhaps you are confusing the 2?

[ParMan]

i must be. anyways thanks for clearing it all up for me its working like a charm now.

[hexophrenic]

Host keys identify the system you are connecting to for testing for a MITM or spoofing of the server and do not require a passphrase by design as mentioned above, systems would not start non-interactively without potentially exposing the passphrase programmatically. SSH user keys (pub/priv keys) are used to verify the identify of the user and can be considered multifactor authentication when using a passphrase (something you have and something you know). Much bettwe security that way, but I have seen lazy admins using only pki for authentication so they do not have to type a password and many admins/devs that use pki without passphrases for automated system authentication (hopefully with very limited access).

[Jason Cooper]

Many admins/devs that use pki without passphrases for automated system authentication (hopefully with very limited access).

scponly is a great little program that can help with this sort of setup. It lets you limit a user to only doing file transfers rather than letting them also get a shell on the machine. You should probably run it in a chroot environment to really limit what files they can access.