[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Google
  Web www.spinics.net

Re: A question about ssh RSA key connection



this is far from a ssh problem, as the connect src address is selected
by system, mostly by the default routing set, in your case, there are
many IP in the same vlan/ip space, that will be choosed to be the first
ip in your ip list, .130 is the first then.

you may use the "-b" option if you really need to set your src ip
address.


在 2009-08-22六的 12:10 +0800,徐广写道:
> Hi
> I recently met with a problem when trying to set up ssh connection
> through the ssh key
> 
> I first create a key through command ssh-keygen -t rsa -f
> /.ssh/pmcftp_id_rsa -P "" , two files would be created under /.ssh
> pmcftp_id_rsa and pmcftp_id_rsa.pub, then I insert an entry into the
> .pub file - from="47.154.169.129,47.154.169.128"  this should
> restrickt that the ssh key should only work for sources of these two
> ips.
> Then I push the public key to another server under ~pmcftp/.ssh, after
> that, I start the ssh connection through command ssh -I pmcftp -i.
> ./ssh/pmcftp_id_rsa <server ip>, the ssh connection would be set up
> without asking for the passwd.
> But, when I create the ssh key on a server that has several ip
> address, like following:
> =====
> ifconfig -a
> lo0: flags=2001000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4,VIRTUAL> mtu
> 8232 index 1
>         inet 127.0.0.1 netmask ff000000
> uplink0: flags=1040863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,DEPRECATED,IPv4>
> mtu 1500 index 2
>         inet 47.154.169.130 netmask ffffff00 broadcast 47.154.169.255
>         ether 0:0:bb:2e:74:e
> uplink0:1: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4>
> mtu 1500 index 2
>         inet 47.154.169.128 netmask ffffff00 broadcast 47.154.169.255
> uplink0:2: flags=1000863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST,IPv4>
> mtu 1500 index 2
>         inet 47.154.169.129 netmask ffffff00 broadcast 47.154.169.255
> uplink1: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 3
>         inet 192.168.47.1 netmask ffffff00 broadcast 192.168.47.255
>         ether 0:0:bb:2e:74:d
> =====
> And added ip 47.154.169.128  and 47.154.169.129  into the from ip list
> entry in the key file, then I push the ssh key to server
> 47.154.169.130 (which should be the same server as the source)
> Then when I try to start the ssh connection through command ssh -I
> pmcftp -i. ./ssh/pmcftp_id_rsa 47.154.169.130 , the key does not work
> anymore, and the log give info like this
> ==
>  Authentication tried for pmcftp with correct key but not from a
> permitted host (host=iems196-unit0, ip=47.154.169.130)
> ==
> Obviously, here the from ip list does not include 47.154.169.130, and
> the ssh connection treate the from ip as 47.154.169.130 not other ips
> of this server.
> Then I tried another command
> Ssh -b 47.154.169.128  -I pmcftp -i. ./ssh/pmcftp_id_rsa
> 47.154.169.130 the key works well again.
> The -b option is binding the from ip to 57.154.169.128 and it's in the
> from ip list in the key file.
> 
> how the ip of the from side of the ssh connection is obtained? When
> the from side of the ssh connection has several ips how would the ip
> address be determined by the to side?
> Any info would be highly appreciated, thanks in advance!
> 
> Best regards
> Guang
> 
> --
> 徐广
> 13581797776


[Home]     [Fedora Users]     [Fedora Legacy]     [Fedora Desktop]     [Yosemite Photos]     [Yosemite News]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

Add to Google Powered by Linux