I'm confused by the difference in behavior of ssh clients I'm seeing on two different hosts. Just to be clear, this is the scenario:
- "macbox" OS X using OpenSSH_5.2p1 ssh client
- "sunbox" Solaris 10 OpenSSH_3.9p1 ssh client
- "linuxbox" Ubuntu running OpenSSH_5.8p1 sshd server
All three hosts have a user by the same name. I wanted to set up things so that macbox and sunbox could ssh in to linuxbox using just ssh keys, no passwords. On linuxbox, I set up sshd_config to allow this:
HostbasedAuthentication yes # To enable empty passwords, change to yes (NOT RECOMMENDED) PermitEmptyPasswords no
Notice the comment. I took the advice and didn't change the setting about empty passwords. I understood that to mean that linuxbox won't allow host based authentication with public keys which don't have a password set for that key.
Then, on macbox and on sunbox, I did this:
ssh-keygen -v -t dsa
And on both of them, when prompted by ssh-keygen, I supplied a password for the key pair it was generating. Next, I copied the contents of the "id_dsa.pub" (from both macbox and sunbox) to the ~/.ssh/authorized_keys file on linuxbox.
From macbox, using the built-in Terminal.app program, I tried ssh-ing to linuxbox. Suddenly, I was looking at GUI password prompt, launched by Terminal, but not in the terminal, and it wanted the password for the key pair I'd generated. I entered the password which I'd given to the ssh-keygen program when I generated those keys. I did NOT check the box offering to remember the password in my Mac's Keychain.app program. I clicked OK and got in to a shell on linux box.
Next, I typed "exit", then ssh-ed back in to linuxbox a second time, but this time Terminal.app did not ask for a password. I repeated this several times.
Then I went to the sunbox, tried an ssh to linuxbox. Sunbox asked for the public key password via the shell (since I don't use a GUI/X11 environment there). I supplied the password, and got in to the shell on linuxbox. Then I typed "exit", then tried to ssh back in to linuxbox and was again asked for the password. Unlike the ssh client on macbox, sunbox's ssh client asks me for the password every time I ssh to linuxbox.
Is this some kind of undocumented Mac OS X user friendliness thing? Or is it a setting in ssh_config? The macbox has everything commented out in ssh_config. The sunbox ssh_config has a few lines uncommented:
GSSAPIAuthentication yes GSSAPIDelegateCredentials yes PreferredAuthentications gssapi-with-mic,publickey,password,keyboard-interactive
I've read the manpage on ssh_config, but I don't see how these settings could account for the difference in ssh client behaviors. I even went into the user Keychain.app file on the macbox and searched for a saved password for the keypair, and there is none saved there.
Can anyone explain why I have to type a key password on sunbox every time I ssh to linuxbox, but never (again) had to type a key password after the first time I ssh-ed to linuxbox from macbox?