1

I am using OpenSSH 6.7p1 on Debian 8 (Jessie).

I am using public key authentication. As part of that, I am using the "from" authorization option in my authorized_keys file.

I am finding that when I specify the allowed source host by IP address, access restrictions work as expected. But when I specify the allowed source host by hostname, access is not granted. It skips public key authentication and asks for the password.

The working entry in authorized_keys looks like this:

from="10.1.1.1" ssh-rsa ...

The non-working entry in authorized_keys looks like this:

from="snoopy" ssh-rsa ...

Hostname "snoopy" is resolved by the /etc/hosts file. I do not have a DNS client running on either of the machines involved. The following entry appears in /etc/hosts on both of the machines invovled: 10.1.1.1 snoopy

Is there any way I can make this work, or is it a limitation / problem with my OpenSSH version?

Improve this question
2
  • Hmm, when OpenSSH goes to resolve the hostnames of incoming connection I believe it will perform a "reverse" resolve which works somewhat differently than a normal "forward" resolve and often gives very different results. I'm not sure if reverse resolves typically pay attention to /etc/hosts or if they skip straight to hitting your name servers. In fact, this answer over on StackOverflow says it does not.
    – Cliff Armstrong
    Jul 14, 2017 at 19:02
  • Thank you for the reference. I will read it. At some point, I'll be standing up a DNS server, so the problem may resolve then.
    – Dave
    Jul 14, 2017 at 19:03

1 Answer 1

Reset to default
1

For the OpenSSH server, this behavior is controlled by the "UseDNS" setting in the server's sshd_config file:

UseDNS
Specifies whether sshd(8) should look up the remote host name, and to check that the resolved host name for the remote IP address maps back to the very same IP address.
If this option is set to no (the default) then only addresses and not host names may be used in ~/.ssh/authorized_keys from and sshd_config Match Host directives.

So, if you have access to configure the ssh server, then you should enable UseDNS in the server configuration file and then restart sshd.

Note that enabling UseDNS can cause ssh connection attempts to hang for a short time (10-30 seconds) if the DNS lookup on the client's IP address is slow or doesn't work. You may find it better to leave this setting disabled.

Improve this answer
1
  • I know this is an old answer, but I feel this needs to be added: I don't believe the UseDNS option in sshd_config works the way it is described here. UseDNS appears to control whether sshd uses rDNS for incoming connections to resolve an IP address back to a hostname. I tested this by adding a hostname (that resolves to the connecting IP address) to the from="..." field in ~/.ssh/authorized_keys and it didn't let me authenticate until I replaced it with an IP address.
    – Andrew Paglusch
    Jan 21 at 4:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .