Setting up OpenSSH to use rhosts?

Question

I rent a couple of VPSs running latest Ubuntu, both with OpenSSH. I'd like to try password-less login using .rhosts/.shosts. I know this is not recommended, and that it's better to use public-key authentication... I just want to test it and know how to set it up. I want to log-in to my server/remote computer from my client/local computer without password. I'm using a normal non-root user-account on my local computer, and wants to log-in to an account with the same user-name on the remote computer.

Here is a list of my questions:

• Must I list the local-computer's hostname and IP-address in /etc/hosts on the remote-computer? Must I also list the hostname/IP of the remote-computer in /etc/hosts on the local-computer? Does /etc/hosts matter in this at all?
• What's the difference between .rhosts and .shosts?
• As I understand it, the .rhosts/.shosts file goes in the user's home-directory on the remote-computer, and it must only be readable by the owner. It should contain lines in the form "hostname username"... Is this correct?
• Is it possible to drop username if it's the same on both computers, or must it be explicitly stated in .rhosts/.shosts?
• Is it possible to use this mechanism even if I got different username on the two computers (assuming the name I do have, is in .rhosts/.shosts)?
• Can I use IP-address instead of hostnames in .rhosts/.shosts? Can I do it if /etc/hosts on the remote-computer includes this pairing?
• Which changes must I do to /etc/ssh/ssh_config and/or /etc/ssh/sshd_config, on both the remote and the local computer?
• Is it possible to optionally set it up so I avoid using the "global" /etc/ssh/ssh_known_hosts, and just use my local ~/.ssh/known_hosts? Must this be set-up on the client/local, server/remote or both?
• Is it possible to optionally set it up to ignore the host-key(s) for the computer(s), i.e. just looking for .rhosts/.shosts and not authenticating the computer(s)? (Yes I know this would be very stupid... I just want to know if it can be done.)
• Must I use the rsh or rlogin commands to get this to work, or will ssh also work - if the rest is set-up correctly?
• Is it somehow possible to test this mechanism "locally" - ie. on the same computer? If I have several user-accounts on the same computer, could I add a .rhosts/.shosts file with entries for "localhost", "127.0.0.1" and/or my computers hostname - together with the username for my other account on the same computer - and get this mechanism to work? After all, ssh can log-in to other accounts on "localhost" too... If it's possible, how could I set it up?

Again, I'm just playing around and wanting to learn... I know it's not only unsafe, but also a case of crossing the stream to look for water.

Answer 1

The desired functionality doesn't require setting up trust between two machines. Also, this, as you properly mentioned, is not recommended from the security point of view.

What you likely want to do (if you want a password-less) login to the remote server is the following:

1. on your local machine under your user generate a passphrase-less key using ssh-keygen -t rsa and just pressing the Enter key on the password prompts. This will generate a key without a passphrase. So, if somebody steal the private key they would be able to access your server (unless you use a firewall to restrict access to the server to your IP address only)
2. copy the public key (e.g. ~/.ssh/id_rsa.pub if you didn't change the name of the key pair in the previous step) to your server to the home directory of the desired account.
3. under your desired account on the server create (if it's not there) the ~/.ssh directory with mkdir -m700 -p ~/.ssh
4. add the content of the public key you copied in step 2 to the ~/.ssh/authorized_keys (or if the file is not there, just rename the copied public key to that name)
5. ensure that the ownership and permissions on ~/.ssh and ~/.ssh/authorized_keys are proper. Both should be owned by the user of the home directory and their primary group, the ~/.ssh directory should have 0700 permission and ~/.ssh/authorized_key should have 0600 permissions.

From this point on connecting to the desired account from your local machine will be passwordless (you could use ssh desired_user@remote.host if you didn't change the name of the key pair, or use ssh -i ~/.ssh/name_of_your_private_key desired_user@remote.host if you changed the key name in step 1),

Now, if you still want to go the "totally insecure" way and establish trust between machines this is the HOWTO you are after: http://itg.chem.indiana.edu/inc/wiki/software/openssh/189.html -- I still do not recommend to go that route, unless you just want to see how it works. Even in this case it is questionable since it's really a bad idea from the security standpoint.