4

Have two servers communicating via ssh and crontab, a "master" and a "slave". Only the master can connect (execute command) on the slave.

Authentication was done automatically (IPv4) thanks to

  • master's ~/.ssh/id_rsa.pub added to slave's ~/.ssh/authorized_keys
  • slave's sshd_config having AllowUsers me@1.2.3.4

It was working fine until IPv6 was added

  • both master and slave have IPv6 enabled
  • both servers have had DNS reverse setup for both protocols
  • sshd_config changed to AllowUsers me@myhost.tld

and was hoping sshd slave does a reverse lookup of the incoming IPv6 IP (to get myhost.tld) but auth.log shows

User me from 2103:cc11::...:fe93:4a10 not allowed because not listed in AllowUsers

I'd have two questions

  1. does sshd perform an IPv6 reverse lookup to find out if the host matches? (if yes, there is another problem)
  2. what is the correct way to add an IPv6 address hard-coded in AllowUsers? It seems me@[2103:cc11::...:fe93:4a10] doesn't work. (edit works without the [])
  • @anx Actually the servers have other ways to be accessed for maintenance, and if DNS resolution is down from these machines POV we'll have more problems than that, but that's a good point. And incidentally came across this question and nsswitch's mdns4_minimal could be an issue. – e2-e4 Dec 17 '17 at 3:00
1

Have a look at the UseDNS directive.

"UseDNS Specifies whether sshd(8) should look up the remote host name, and to check that the resolved hostname for the remote IP address maps back to the very same IP address.

If this option is set to no (the default) then only addresses and not host names may be used in ~/.ssh/authorized_keys from and sshd_config Match Host directives."

As a side-note you could always configure the client to force IPv4 for connection to that particular host in your ssh_config. I mostly used AllowUsers to match usernames, if you want to match on hostnames and IP you might want to have a look at using TCP wrapper instead.

See: https://www.akadia.com/services/ssh_tcp_wrapper.html

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.