From owner-ssh@clinet.fi Wed Dec 6 19:09:25 2000 Received: from mail.clinet.fi (mail.clinet.fi [194.100.0.7]) by hutcs.cs.hut.fi (8.9.3/8.9.3) with ESMTP id TAA23680; Wed, 6 Dec 2000 19:09:25 +0200 (EET) Received: (from majordom@localhost) by mail.clinet.fi (8.9.3/8.9.3) id SAA30837 for ssh-outgoing; Wed, 6 Dec 2000 18:48:52 +0200 Received: from proxy4.ba.best.com (root@proxy4.ba.best.com [206.184.139.15]) by mail.clinet.fi (8.9.3/8.9.3) with ESMTP id SAA30831 for ; Wed, 6 Dec 2000 18:48:50 +0200 Received: from shell6.ba.best.com (sbest@shell6.ba.best.com [206.184.139.137]) by proxy4.ba.best.com (8.9.3/8.9.2/best.out) with ESMTP id IAA04036 for ; Wed, 6 Dec 2000 08:46:49 -0800 (PST) Date: Wed, 6 Dec 2000 08:46:49 -0800 (PST) From: "Scott C. Best" X-Sender: sbest@shell6.ba.best.com To: ssh@clinet.fi Subject: host auth question Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-ssh@clinet.fi Precedence: bulk Hello! My ISP shell account has ssh1 available, and I use it to connect to my debian-based server. From following the FAQ and the archives, I've got RSA authentication working well, so I can ssh from me@isp into user@server without supplying a password. Very keen. But I need to make it more difficult now. :) I want to do host-based authentication *and* password authentication together. That is, I want the host-based part to be necessary but not sufficient. My intent is to allow me to cycle the login passwd regularly on the server, giving some measure of added security without having to affect the client-side files (which, being on a big ISP's box, are likely to be compromised on a regular basis). Doable? Any help appreciated! tia, Scott