Restrict ssh to only accept certain session with a certificate

[Tonatiuh]

Server to connect to: Red Hat Enterprise Linux AS 4
Station to connect from: Windows XP Service Pack 2

I want to configure my SSH server, so tath it only accept ssh sessions from my Station (using Secure CRT 5.1).

Does anyone can share me a step-by-step to perform this configuration (in both server and station)?

Thank you in advance!

[jjh]

Hello Tonatiuh.

It is possible to configure VShell to only accept
connections from a certain IP address.

Are you running VShell as your SSH2 server?

Thank you

JJH

[Tonatiuh]

I do not know exactly what you mean.

I have activated SSH service into server, and I connect from any ssh client into my Windows station.

To restrict to just certain IPs is something tha could be done easly just using operating system config. Nothing to config into Vandyke Software.

Restrict to certain IP is not enough to me, because the IP that I connect from, is not always the same. That is what I think a certificate validation is bettar than IP.

In fact this is one of keys to decide if Vandike software is the one I am looking for.

[Tonatiuh]

I have generated my identity.pub file. I have copied the content of this file into the ~/.ssh/authorized_keys in my Linux Server.

But everybody still can open an ssh session (not only the one who have the identitiy.pub ley). I think I must configure something else in my Linux Server to restrict to authenticate only according to that ~/.ssh/ahutorized_keys.

Any idea?

[Tonatiuh]

I have succesfullo configured the ssh to only accept a Certificate authentication. No password.

[jjh]

Hello Tonatiuh

If your server is an OpenSSH server, you will probably need
to edit your sshd_config file to allow public key
authentication and you might want to disallow password
authentication and/or keyboard interactive authentication.

I believe the lines in the sshd_config file that you would
need to modify are as follows:

PubkeyAuthentication yes
PasswordAuthentication no
PAMAuthenticationViaKbdInt no

Are you able to modify your sshd_config file such that only
public key authentication is allowed?

Thanks

JJH