<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 10pt; color: #000000"><div>In fact I did a bit more tests but I couldn't get the "match" configuration working.<br></div><div><br></div><div>It seems to be like this</div><div><br></div><div>1) user authenticates via SSH with identity "nx" and the dsa key from his IP</div><div>2) the user then authenticates via SSH with his account and password coming this time from localhost ===> i thought this would work with only his password, without public keys ==> but for some reason it seems like there's still public key authentication going on, and it does not work for users who don't have their public key in authorized_keys of their home</div><div><br></div><div>I can't figure out why it goes like this, but then I decided to try with a double SSH daemon, and that works fine, it seems.</div><div><br></div><div><br></div><div><br></div><div><br></div><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>"Chris" <chris@ccburton.com><br><b>To: </b>"User Support for FreeNX Server and kNX Client" <freenx-knx@kde.org><br><b>Sent: </b>Thursday, 1 August, 2013 5:03:53 PM<br><b>Subject: </b>Re: [FreeNX-kNX] preventing data transfers over SSH, yet still allow NX sessions.<br><div><br></div>
<br><tt><span size="2" data-mce-style="font-size: small;" style="font-size: small;">freenx-knx-bounces@kde.org wrote on 01/08/2013 14:14:39:<br>
<br>
> Hi,</span></tt>
<br><tt><span size="2" data-mce-style="font-size: small;" style="font-size: small;">> <br>
> Maybe I found a better way, at least for my case. I edited <br>
> /etc/ssh/sshd_config with these fields:</span></tt>
<br><tt><span size="2" data-mce-style="font-size: small;" style="font-size: small;">> <br>
> PermitRootLogin without-password</span></tt>
<br>
<br><tt><span size="2" data-mce-style="font-size: small;" style="font-size: small;">Hmm, your choice, but I think root should never log
in.</span></tt>
<br>
<br><tt><span size="2" data-mce-style="font-size: small;" style="font-size: small;">> PasswordAuthentication no</span></tt>
<br><tt><span size="2" data-mce-style="font-size: small;" style="font-size: small;">> Match Address 127.0.0.1<br>
> PasswordAuthentication yes</span></tt>
<br><tt><span size="2" data-mce-style="font-size: small;" style="font-size: small;">> <br>
> In this way I allow password-authentication only from localhost (so
<br>
> from the nx shell), and key-based authentication from the outside.</span></tt>
<br><tt><span size="2" data-mce-style="font-size: small;" style="font-size: small;">> I'm providing to the users a very limited Fluxbox-based
graphical <br>
> interface and I'm not going to give them access to the local shell.
<br>
> In this way they aren't going to be able to copy their ssh keys locally.</span></tt>
<br><tt><span size="2" data-mce-style="font-size: small;" style="font-size: small;"> <br>
I haven't ever bothered moving over to "match address"</span></tt>
<br><tt><span size="2" data-mce-style="font-size: small;" style="font-size: small;"> (call me over
cautious if you wish)</span></tt>
<br><tt><span size="2" data-mce-style="font-size: small;" style="font-size: small;">but it certainly saves having two sets of config files
and startup scripts. </span></tt>
<br>
<br><tt><span size="2" data-mce-style="font-size: small;" style="font-size: small;">If I was you I'd keep any match(es) right at the end
of the</span></tt>
<br><tt><span size="2" data-mce-style="font-size: small;" style="font-size: small;">sshd_config file.</span></tt>
<br>
<br><tt><span size="2" data-mce-style="font-size: small;" style="font-size: small;">Watch out for them emailing themselves . . . . </span></tt>
<br><div><br></div>________________________________________________________________<br> Were you helped on this list with your FreeNX problem?<br> Then please write up the solution in the FreeNX Wiki/FAQ:<br><div><br></div>http://openfacts2.berlios.de/wikien/index.php/BerliosProject:FreeNX_-_FAQ<br><div><br></div> Don't forget to check the NX Knowledge Base:<br> http://www.nomachine.com/kb/<br><div><br></div>________________________________________________________________<br> FreeNX-kNX mailing list --- FreeNX-kNX@kde.org<br> https://mail.kde.org/mailman/listinfo/freenx-knx<br>________________________________________________________________</div><div><br></div></div></body></html>