1

I am using OpenSSH 6.7p1 on Debian 8 (Jessie).

I am using public key authentication. As part of that, I am using the "from" authorization option in my authorized_keys file.

I am finding that when I specify the allowed source host by IP address, access restrictions work as expected. But when I specify the allowed source host by hostname, access is not granted. It skips public key authentication and asks for the password.

The working entry in authorized_keys looks like this:

from="10.1.1.1" ssh-rsa ...

The non-working entry in authorized_keys looks like this:

from="snoopy" ssh-rsa ...

Hostname "snoopy" is resolved by the /etc/hosts file. I do not have a DNS client running on either of the machines involved. The following entry appears in /etc/hosts on both of the machines invovled: 10.1.1.1 snoopy

Is there any way I can make this work, or is it a limitation / problem with my OpenSSH version?

2
  • Hmm, when OpenSSH goes to resolve the hostnames of incoming connection I believe it will perform a "reverse" resolve which works somewhat differently than a normal "forward" resolve and often gives very different results. I'm not sure if reverse resolves typically pay attention to /etc/hosts or if they skip straight to hitting your name servers. In fact, this answer over on StackOverflow says it does not. Jul 14, 2017 at 19:02
  • Thank you for the reference. I will read it. At some point, I'll be standing up a DNS server, so the problem may resolve then.
    – Dave
    Jul 14, 2017 at 19:03

1 Answer 1

2

For the OpenSSH server, this behavior is controlled by the "UseDNS" setting in the server's sshd_config file:

UseDNS
Specifies whether sshd(8) should look up the remote host name, and to check that the resolved host name for the remote IP address maps back to the very same IP address.
If this option is set to no (the default) then only addresses and not host names may be used in ~/.ssh/authorized_keys from and sshd_config Match Host directives.

So, if you have access to configure the ssh server, then you should enable UseDNS in the server configuration file and then restart sshd.

Note that enabling UseDNS can cause ssh connection attempts to hang for a short time (10-30 seconds) if the DNS lookup on the client's IP address is slow or doesn't work. You may find it better to leave this setting disabled.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.