OpenSSH hostbased authentication - mm_answer_keyallowed: key 0x58c400 is disallowed

Question

I'm trying to set up hostbased authentication for a small subset of hosts. I think I've got all my ducks in a row:

• Copied the public keys to the /etc/ssh/ssh_known_hosts file
• Put all the hosts in to /etc/shosts.equiv
• Enabled HostbasedAuthentication in /etc/ssh/sshd_config and /etc/ssh/ssh_config
• Setuid the /usr/lib64/ssh/ssh-keysign binary and set EnableSSHKeysign yes in the /etc/ssh/ssh_config file on the clients.

However, it still doesn't work. Running the server in debug mode I get the following output:

debug1: attempt 0 failures 0
debug3: mm_getpwnamallow entering
debug3: mm_request_send entering: type 6
debug3: monitor_read: checking request 6
debug3: mm_answer_pwnamallow
debug3: Trying to reverse map address 10.3.128.10.
debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM
debug3: mm_request_receive_expect entering: type 7
debug3: mm_request_receive entering
debug2: parse_server_config: config reprocess config len 137
debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
debug3: mm_request_send entering: type 7
debug2: monitor_read: 6 used once, disabling now
debug3: mm_request_receive entering
debug2: input_userauth_request: setting up authctxt for kamil
debug3: mm_start_pam entering
debug3: mm_request_send entering: type 45
debug3: mm_inform_authserv entering
debug3: mm_request_send entering: type 3
debug2: input_userauth_request: try method none
debug3: monitor_read: checking request 45
debug1: PAM: initializing for "kamil"
debug1: PAM: setting PAM_RHOST to "foo.bar.com"
debug1: PAM: setting PAM_TTY to "ssh"
debug2: monitor_read: 45 used once, disabling now
debug3: mm_request_receive entering
debug3: monitor_read: checking request 3
debug3: mm_answer_authserv: service=ssh-connection, style=
debug2: monitor_read: 3 used once, disabling now
debug3: mm_request_receive entering
debug1: userauth-request for user kamil service ssh-connection method hostbased
debug1: attempt 1 failures 1
debug2: input_userauth_request: try method hostbased
debug1: userauth_hostbased: cuser kamil chost foo.bar.com. pkalg ssh-dss slen 55
debug3: mm_key_allowed entering
debug3: mm_request_send entering: type 20
debug3: monitor_read: checking request 20
debug3: mm_answer_keyallowed entering
debug3: mm_answer_keyallowed: key_from_blob: 0x58c400
debug2: userauth_hostbased: chost foo.bar.com. resolvedname foo.bar.com ipaddr 10.3.128.10
debug2: stripping trailing dot from chost foo.bar.com.
debug2: auth_rhosts2: clientuser kamil hostname foo.bar.com ipaddr 10.3.128.10
debug1: temporarily_use_uid: 1031/1028 (e=0/0)
debug3: mm_key_allowed: waiting for MONITOR_ANS_KEYALLOWED
debug3: mm_request_receive_expect entering: type 21
debug3: mm_request_receive entering
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 1031/1028 (e=0/0)
debug1: restore_uid: 0/0
Failed hostbased for kamil from 10.3.128.10 port 55105 ssh2
debug3: mm_answer_keyallowed: key 0x58c400 is disallowed
debug3: mm_request_send entering: type 21
debug3: mm_request_receive entering
debug2: userauth_hostbased: authenticated 0
debug1: userauth-request for user kamil service ssh-connection method hostbased
debug1: attempt 2 failures 2
debug2: input_userauth_request: try method hostbased
debug1: userauth_hostbased: cuser kamil chost foo.bar.com. pkalg ssh-rsa slen 143
debug3: mm_key_allowed entering
debug3: mm_request_send entering: type 20
debug3: monitor_read: checking request 20
debug3: mm_answer_keyallowed entering
debug3: mm_answer_keyallowed: key_from_blob: 0x58c400
debug2: userauth_hostbased: chost foo.bar.com. resolvedname foo.bar.com ipaddr 10.3.128.10
debug2: stripping trailing dot from chost foo.bar.com.
debug2: auth_rhosts2: clientuser kamil hostname foo.bar.com ipaddr 10.3.128.10
debug1: temporarily_use_uid: 1031/1028 (e=0/0)
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 1031/1028 (e=0/0)
debug1: restore_uid: 0/0
Failed hostbased for kamil from 10.3.128.10 port 55105 ssh2
debug3: mm_answer_keyallowed: key 0x58c400 is disallowed
debug3: mm_request_send entering: type 21
debug3: mm_request_receive entering
debug3: mm_key_allowed: waiting for MONITOR_ANS_KEYALLOWED
debug3: mm_request_receive_expect entering: type 21
debug3: mm_request_receive entering
debug2: userauth_hostbased: authenticated 0
debug1: userauth-request for user kamil service ssh-connection method keyboard-interactive
debug1: attempt 3 failures 3
debug2: input_userauth_request: try method keyboard-interactive

The crux of the problem seems to be the line:

debug3: mm_answer_keyallowed: key 0x58c400 is disallowed

Ideas?

Answer 1

Do you have EnableSSHKeysign enabled on the client? That was another piece that I needed to get hostbased auth working.

Answer 2

Okay, major failure on my part. I had created /etc/shosts.equiv instead of /etc/ssh/shosts.equiv (see point 2 of my question). The reason it worked on some of my other systems was that they also had a residual /etc/hosts.equiv file from some previous work by a coworker.

Things work much better when the right files are in the right location. It took some use of strace on the server to find out what it was reading from what files to finally clue me in on the answer.

Answer 3

Are you on debian with an old host key ? openssh-blacklist package may be preventing use of keys that are affected by the infamous SSL vulnerability.

Regenerate your host keys if this is the case.