I rent a couple of VPSs running latest Ubuntu, both with OpenSSH. I'd like to try password-less login using .rhosts/.shosts. I know this is not recommended, and that it's better to use public-key authentication... I just want to test it and know how to set it up. I want to log-in to my server/remote computer from my client/local computer without password. I'm using a normal non-root user-account on my local computer, and wants to log-in to an account with the same user-name on the remote computer.
Here is a list of my questions:
- Must I list the local-computer's hostname and IP-address in /etc/hosts on the remote-computer? Must I also list the hostname/IP of the remote-computer in /etc/hosts on the local-computer? Does /etc/hosts matter in this at all?
- What's the difference between .rhosts and .shosts?
- As I understand it, the .rhosts/.shosts file goes in the user's home-directory on the remote-computer, and it must only be readable by the owner. It should contain lines in the form "hostname username"... Is this correct?
- Is it possible to drop username if it's the same on both computers, or must it be explicitly stated in .rhosts/.shosts?
- Is it possible to use this mechanism even if I got different username on the two computers (assuming the name I do have, is in .rhosts/.shosts)?
- Can I use IP-address instead of hostnames in .rhosts/.shosts? Can I do it if /etc/hosts on the remote-computer includes this pairing?
- Which changes must I do to /etc/ssh/ssh_config and/or /etc/ssh/sshd_config, on both the remote and the local computer?
- Is it possible to optionally set it up so I avoid using the "global" /etc/ssh/ssh_known_hosts, and just use my local ~/.ssh/known_hosts? Must this be set-up on the client/local, server/remote or both?
- Is it possible to optionally set it up to ignore the host-key(s) for the computer(s), i.e. just looking for .rhosts/.shosts and not authenticating the computer(s)? (Yes I know this would be very stupid... I just want to know if it can be done.)
- Must I use the
rlogincommands to get this to work, or will
sshalso work - if the rest is set-up correctly?
- Is it somehow possible to test this mechanism "locally" - ie. on the same computer? If I have several user-accounts on the same computer, could I add a .rhosts/.shosts file with entries for "localhost", "127.0.0.1" and/or my computers hostname - together with the username for my other account on the same computer - and get this mechanism to work? After all,
sshcan log-in to other accounts on "localhost" too... If it's possible, how could I set it up?
Again, I'm just playing around and wanting to learn... I know it's not only unsafe, but also a case of crossing the stream to look for water.