openssh unix dev - Nov 2002 - apparent ssh_config fascism

It appears that /etc/ssh/ssh_config enforces policy on local users in
addition to its documented role as provider of defaults.

$ ssh -V
OpenSSH_3.5p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f

$ cat .ssh/config
Host localhost
   HostbasedAuthentication yes
   PreferredAuthentications hostbased

$ ssh localhost
Hostbased authentication not enabled in /etc/ssh/ssh_config
ssh_keysign: no reply
key_sign failed
Permission denied (publickey,password,keyboard-interactive,hostbased).

The situation is rectified by enabling Hostbased authentication in
/etc/ssh/ssh_config (as the error message suggests), but this must be
done by the systems administrator.  Why is the setting in .ssh/config not
sufficient?  Is this behaviour a bug or a feature?

BTW these experiences are with the RPM for Red Hat 7.3

On Fri, Nov 15, 2002 at 04:59:24PM +0000, Phillip Brown
wrote:
> $ ssh localhost
> Hostbased authentication not enabled in /etc/ssh/ssh_config
> ssh_keysign: no reply
> key_sign failed
> Permission denied (publickey,password,keyboard-interactive,hostbased).
> 
> The situation is rectified by enabling Hostbased authentication in
> /etc/ssh/ssh_config (as the error message suggests), but this must be
> done by the systems administrator.  Why is the setting in .ssh/config not
> sufficient?  Is this behaviour a bug or a feature?
the systems administrator has to allow the use of the
private hostkey for authentication.

Because man 'ssh-keysign' says:

 	     [..] Since they
             are readable only by root, ssh-keysign must be set-uid root if
             hostbased authentication is used.

So it does the user no good to enabled it if ssh-keysign is not setuid.

So yes.  There is a reason for it.

- Ben

On Fri, 15 Nov 2002, Phillip Brown wrote:
>
> It appears that /etc/ssh/ssh_config enforces policy on local users in
> addition to its documented role as provider of defaults.
>
> $ ssh -V
> OpenSSH_3.5p1, SSH protocols 1.5/2.0, OpenSSL 0x0090602f
>
> $ cat .ssh/config
> Host localhost
>    HostbasedAuthentication yes
>    PreferredAuthentications hostbased
>
> $ ssh localhost
> Hostbased authentication not enabled in /etc/ssh/ssh_config
> ssh_keysign: no reply
> key_sign failed
> Permission denied (publickey,password,keyboard-interactive,hostbased).
>
> The situation is rectified by enabling Hostbased authentication in
> /etc/ssh/ssh_config (as the error message suggests), but this must be
> done by the systems administrator.  Why is the setting in .ssh/config not
> sufficient?  Is this behaviour a bug or a feature?
>
> BTW these experiences are with the RPM for Red Hat 7.3
>
> _______________________________________________
> openssh-unix-dev at mindrot.org mailing list
> http://www.mindrot.org/mailman/listinfo/openssh-unix-dev
>

After reading the man page for ssh-keysign, some admins might be unaware
that root can use Hostbased authentication by only having a setting
in .ssh/config without having to think about the ramifications of going
down the /etc/ssh/ssh_config route.  Maybe man ssh-keysign should be 
fleshed out a little to make the exception absolutely clear.

The fact that Hostbased authentication needs to be enabled in
/etc/ssh/ssh_config to make the method available to users other than
root, even when ssh-keysign is suid root, suggests that it should be a
decision the administrator should not take lightly - and hence that such
ramifications do exist.  Perhaps there are scenarios of abuse or am I
reading to much into this?