Configuring /etc/hosts.equiv file in AIX 5.3

UNIX AIX
1

Need help in configuring /etc/host.equiv file. Though i configure the /etc/hosts.equiv file to prevent users from connecting remotely to the local server " -host" in /etc/hosts.equiv file, it allows the users to login from remote machine. we don't have .rhosts file on the local server. Could you please let me know, how to configure the /etc/hosts.equiv file to prevent login from remote hosts.

Also please let me know, how to configure /etc/hosts.equiv to allow login from remote server without entering password.

2

What service do you use to login ie. want to have blocked? telnet? ssh? ...?

3

we use ssh for login

4

You don't do this when you use ssh and AIX. You can allow/disallow remote login on a per-user basis using the command

chuser -a rlogin=[false|true] <username>

or (which is essentially the same) by modifying the respective stanza in "/etc/security/users", for instance:

username:
       su = true
       sugroups = admin
       login = false
       rlogin = false

If you want to log on to a system/user combination from another system/user combination without using a password then generate ssh-keys and put them into the file ~/.ssh/authorized_keys on the target system.

Example: you want userA@systemA to be able to log on as userB@systemB without using a password.

  1. create a ssh-key as userA@systemA using the "ssh-keygen" utility. Enter no password when asked for one (just press <ENTER>)

  2. Log on as userB at systemB, create a directory ".ssh" (if it is not already there) and create a file "authorized_keys" in this directory (if it is not there already).

3) copy the content of "~/.ssh/id_rsa.pub" (the name can vary slightly depending on the crypto-algorithm you use) from userA@systemA to the file userB@systemB:~/.ssh/authorized_keys

WARNING: beware of line breaks when copying the key via X-copy&paste. Remove them in case there are some.

  1. Save the file. You should now be able to log on from userA@systemA to userB@systemB without passwords. This extends to file transfers with scp.

I hope this helps.

bakunin