Formerly UCLA-Math/PIC used SSH Secure Shell v3.0.1 (non-commerical license). Some users were experiencing problems connecting, and also this version does not support Kerberos authentication which we want to deploy in the near future, so we have upgraded to OpenSSH v3.2.3p1.
The two versions are mostly compatible, in the sense that a client from one version will be able to connect and authenticate to a server of the other version. However, there are a few quirks which users may encounter on making the transition.
The servers formerly had only DSA host keys; RSA keys were not required and were not provided. Now they are required, and present. Clients ask for RSA keys first, unless configured otherwise. If your client saves host keys (some Window clients don't), it will need to relearn the RSA identities of the Math/PIC servers. You may see a message saying ``the identity of host XYZ cannot be confirmed'' (from OpenSSH clients) or ``WARNING: HOST IDENTIFICATION HAS CHANGED!!!'' (from SSH Secure Shell clients). Follow the on-screen instructions. With an OpenSSH client, answering ``yes'' (not just ``y'') will tell it to add the RSA key to your known_hosts2 file. With SSH Secure Shell clients, you need to edit .ssh2/known_hosts and remove the offending line. It will be sufficient to remove the whole file, forgetting all host identities in it. Afterward you will need to connect again, and answer ``yes'' to let it re-learn the host identity.
Only seven users have authorized themselves to login to Math/PIC securely without a password. In order to do that, you need to append your OpenSSH public key(s), id_dsa.pub and/or id_rsa.pub, to the file .ssh/authorized_keys2. If for some reason your key on the remote machine is different from that on Math/PIC, the remote machine's key is what you put in.
If the remote key is for SSH Secure Shell, you will need to copy it to Math/PIC and convert it using this command line, which appends it directly to the authorized_keys2 file.
ssh-keygen -i -f id_dsa_1024_a.pub >> $HOME/.ssh/authorized_keys2
Only six users have created a public and secret key pair on Math/PIC. This is recommended for the most secure and convenient connection going from the Math/PIC Sun machines to remote sites. The procedure to move your key pair from SSH Secure Shell to OpenSSH is detailed below.
Very few users encounter this issue. On the originating machine (UNIX) you can run ssh-agent, which stores your secret key (added by ssh-add) and decrypts challenges encrypted with your public key. You have to type the pass phrase for the secret key when you run ssh-add, but subsequent ssh executions do not need the pass phrase. If you have agent forwarding turned on in your client configuration, an ssh client on the remote machine, trying to authenticate on an even more remote machine, can get your agent to do the decryption (securely), and you will not have to type your pass phrase on the remote machine either.
This works seamlessly among clients and servers of the same flavor, OpenSSH or SSH Secure Shell. Thus, if you use OpenSSH on the originating machine, agent forwarding will start to work at Math/PIC. Or if you use SSH Secure Shell on the originating machine, it will stop working where it worked before. Sorry about that. You could upgrade to OpenSSH yourself.
The OpenSSH client takes about three seconds to collect entropy for its random number generator. The Math/PIC Solaris machines are all being patched to add a kernel-based /dev/random device, which will speed up this process dramatically, but there's a temporary problem applying the patch, so we're deploying OpenSSH initially with the slow entropy collector. This will be fixed as quickly as possible.
This section applies to you if you already have a secret and public key pair for SSH Secure Shell, and you want to transfer it to OpenSSH.
SSH Secure Shell uses a DSA key pair in its special format, whereas OpenSSH uses a different idiosyncratic format. If you are using OpenSSH on another machine, you might find it most convenient to copy your key pair(s) from that machine to Math/PIC. The relevant filenames (in $HOME/.ssh) are id_dsa, id_dsa.pub, id_rsa, id_rsa.pub. If you previously upgraded from SSH Secure Shell you may not have a RSA key pair, which is optional. Make sure that the secret key is readable only by you (chmod 600 id_dsa).
If your only keys are for SSH Secure Shell, this procedure will transfer them to OpenSSH. Basically, you copy your secret key, remove the pass phrase from the copy, import it into the OpenSSH format, re-encrypt it with the secret key, and delete the copy.
cd $HOME/.ssh2
cp -p id_dsa_1024_a secretkey #Copy the secret key
ssh-keygen2 -e secretkey #Program is interactive
Passphrase needed for... #Type the pass phrase
Do you want to edit... #Answer "yes"
Your key comment... #Answer "no", forget key comment
Do you want to edit passphrase #Answer "yes"
New passphrase : #Press return for no passphrase
Again :
Do you want to continue... #Answer "no"
Do you want to save... #Answer "yes"
cd ..
mkdir .ssh #Some people already have this
cd .ssh
touch id_dsa
chmod 600 id_dsa #Avoid security breaches
ssh-keygen -i -f ../.ssh2/secretkey > id_dsa #Import SSH2 key
ssh-keygen -p -f id_dsa #To re-encrypt the key
Enter new passphrase: #Type your pass phrase
Enter same passphrase again:
ssh-keygen -y -f id_dsa > id_dsa.pub #Creates public key, mode 644
Enter passphrase: #Type your pass phrase
rm ../.ssh2/secretkey #Avoid security breaches