Re: Question on SSH configuration in a cluster environment.

From: Snoopy_ (snoopy__at_excite.com)
Date: 01/20/04 

Date: 20 Jan 2004 13:01:41 -0800

Thanks for the replies, I think the idea of having seperate keys and
thenusing two entries works best, however, how will outgoing
connections from the servers be affected?
For example: Server A and B have seperate host keys, which allow you
to connect to each server regardless who is the primary node. What
happens on remote hosts when I try to connect from one of the nodes?
I assume I just need to make sure the known_host files in the
user's/application's .ssh directory are identical? Also, can I place
these keys in a shared disk resource that follows the primary node, or
does the authentication in the .ssh/known_host depend on the host key
for decrytion? In other words, I need to sets of .ssh/known_host for
each user as well.

Richard E. Silverman <res@qoxp.net> wrote in message news:<m2isja1jp3.fsf@darwin.oankali.net>...
> >>>>> "KL" == Kyler Laird <Kyler@news.Lairds.org> writes:
>
> >> b. Copy the /usr/local/etc/ssh* and /usr/local/ssh files from the
> >> current node, onto the secondary node.
>
> KL> Sounds like a winner. If everything is configured identicially so
> KL> that a failover can occur easily, why not have ssh look the same
> KL> too?
>
> Because now it is impossible for SSH to tell the difference between these
> hosts in *any* situation, not just when users are connecting to the
> clustered service. In other words, when someone does "ssh cluster," they
> simply want to be assured that they are logging into one of the cluster
> machines -- which the solution given here allows:
>
> http://groups.google.com/groups?&threadm=m1l1ylwuijr.fsf%40sys1.des.jhy.us.ml.com
>
> However, if a sysadmin does "ssh cluster-member-1", he wants to be assured
> he's actually logging into that box. Giving them all the same key defeats
> that ability; if one box is compromised, they can all be spoofed.

Relevant Pages

  • Debian SSH server configuration
    ... Before you flame me --- I asked this question over in debian-ssh and after 24 hours I didn't have a single hit on it. ... I would like to configure a Debian server to only allow clients to ssh in if the public keys already reside on the hard drives of both machines. ...
    (Debian-User)
  • Re: Is SSH worth it??
    ... > Andre sent stuff on Expect which would solve the RSA problem but then I ... DSA keys are only supported by SSH v2. ... and even then have a problem because on the server authorized keys ...
    (Security-Basics)
  • RE: Publick key authentication problem
    ... format to keep the encoding correct. ... Check the keys again. ... I have trouble connection to a server with ssh. ...
    (SSH)
  • RE: SBS SHared Printer Problem
    ... Does this issue happen for all the client workstations? ... If you try printing on the SBS server, ... Clear the registry keys and the driver on both the server and the client ... Microsoft Shared Fax Monitor ...
    (microsoft.public.windows.server.sbs)
  • Re: sshd / ssh setup
    ... USA server and his windows/xp notebook to use SSH. ... followed sshd instruction and built ... I don't have many users so I disable ChallengeResponse authentication and require users to submit keys. ...
    (freebsd-questions)