07-31-2008
SSH: Avoiding password prompt with rsa key generation
Hi,
I am using a remote storage service for backing up our data - we want to have a script run as part of a cron job which would do the backups from our local Linux machine to the service's Linux machine.
I want to use tar and ssh to do this (rather than mounting the disk and using cp) . Therefore want to learn how to avoid having to type in a password with ssh. I am new to this feature so I went online and read the procedure, downloaded and built OpenSSH and did the following:
$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/homes/12/same/.ssh/id_rsa):
/homes/12/same/.ssh/id_rsa already exists.
Overwrite (y/n)? y
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /homes/12/same/.ssh/id_rsa.
Your public key has been saved in /homes/12/same/.ssh/id_rsa.pub.
The key fingerprint is:
27:a4:d4:63:35:62: ... same@dpdw
$ ssh-copy-id -i ~/.ssh/id_dsa.pub
test3@remote.machine
test3@remote.machine''s password:
Now try logging into the machine, with "ssh 'test3@remote.machine'", and check in:
.ssh/authorized_keys
to make sure we haven't added extra keys that you weren't expecting.
So at this point I'm expecting to be able to ssh into the remote machine and not be prompted for a password. Is this what should happen? As can be below seen I'm still prompted.
$ ssh 'test3@remote.machine'
test3@remote.machine's password:
Can someone please suggest a possible problem with what I'm doing that's preventing this from working?
Thanks in advance,
Sam
10 More Discussions You Might Find Interesting
1. Shell Programming and Scripting
I am trying to SFTP to a couple sites. One has an RSA-KEY that was sent to me. Currently I am running that manually using WinSCP. I would like to set it up as a CRON process on our Linux host (Sun).
Can I use the rsa-key they sent me in any directory or does it need to be placed in a specific... (2 Replies)
Discussion started by: alemat
2 Replies
2. Shell Programming and Scripting
I want to automate the process of generating RSA keys. I want to remotley login to a linux machine from a windows maching without having to enter a password. For this I need to generate the RSA key pair. but I want to do this procedure on alot of linux machines. For which I was looking to automate... (2 Replies)
Discussion started by: lassimanji
2 Replies
3. AIX
While trying to upgrade ssh from v4.7 to v5.0 on AIX 5.3 TL9, I end up with the following error.
Has anyone come across this?
Note: openssl has been upgraded to 0.9.8.840 before this upgrade
Bala (0 Replies)
Discussion started by: balaji_prk
0 Replies
4. AIX
Hi
i have aix 5.3 operating system, and i am trying to do ssh without passwd, when i tried to create a rsakey, it produces empty file as an output, how can solve that problem? why it is giving empty output file, i tried with different user, situation same,.i have restarted sshd server. .ssh... (2 Replies)
Discussion started by: nibiru78
2 Replies
5. Linux
Hi All,
I've followed the exact same steps of how to setup and enable SSH user equivalent including the right permission, but when I "ssh" it still prompts for password. Could you help to see what I did wrong?
I appreciate any helps.
:confused:
server1.com:/u01/oracle
RAC1 > mkdir... (2 Replies)
Discussion started by: Beginer0705
2 Replies
6. UNIX for Dummies Questions & Answers
I have 3 Solaris 10 UNIX servers, the shadow and passwd file are all identical and are automatically sync every 5 minutes. A majority of the users do not have CLI access but rather use a menu. I currently have menu options that allows them to rlogin to another server and I need to have the... (1 Reply)
Discussion started by: creedonjm
1 Replies
7. Programming
Hello forum,
I want to have a function to test for passwordless SSH setup. Pretty simple. However, what I'm finding difficult is to NOT return a password prompt to screen IF it's not in place.
Here's the function:
check_passwordless_ssh_working()
#check passed parameter, assuming it is... (4 Replies)
Discussion started by: doonan_79
4 Replies
8. UNIX for Advanced & Expert Users
We have RSA SecureID softtoken key generator on my Windows machine.
It generates new keys every 1 minute.
Any HPUX server (be it ServerD or ServerP) requires my ID and the randomly generated RSA SecureID softtoken key from my Windows to login.
I login to ServerD.
Then I run a script... (0 Replies)
Discussion started by: mohtashims
0 Replies
9. UNIX for Dummies Questions & Answers
Hello,
I'm trying to perform these operations without entering any password, as user "fzd":fzd@machine1> scp /tmp/srcFile1 fzd@machine2:/tmp/$destFile
fzd@machine1> scp fzd@machine2:/tmp/$srcFile /tmp/$destFilebut alsofzd@machine1> scp /tmp/srcFile1 machine2:/tmp/$destFile
fzd@machine1> scp... (6 Replies)
Discussion started by: fzd
6 Replies
10. Red Hat
I am not sure what I am missing here. I have the following identical entry in /etc/sudoers on multiple Red Hat 6.4 servers.
icinga ALL=NOPASSWD:/usr/bin/yum --security --exclude\="kernel*" check-update
On one server when I enter the command over SSH as follows it works fine.
ssh -t -q... (1 Reply)
Discussion started by: scotbuff
1 Replies
LEARN ABOUT MOJAVE
ssh-copy-id
SSH-COPY-ID(1) BSD General Commands Manual SSH-COPY-ID(1)
NAME
ssh-copy-id -- use locally available keys to authorise logins on a remote machine
SYNOPSIS
ssh-copy-id [-f] [-n] [-i [identity_file]] [-p port] [-o ssh_option] [user@]hostname
ssh-copy-id -h | -?
DESCRIPTION
ssh-copy-id is a script that uses ssh(1) to log into a remote machine (presumably using a login password, so password authentication should
be enabled, unless you've done some clever use of multiple identities). It assembles a list of one or more fingerprints (as described below)
and tries to log in with each key, to see if any of them are already installed (of course, if you are not using ssh-agent(1) this may result
in you being repeatedly prompted for pass-phrases). It then assembles a list of those that failed to log in, and using ssh, enables logins
with those keys on the remote server. By default it adds the keys by appending them to the remote user's ~/.ssh/authorized_keys (creating
the file, and directory, if necessary). It is also capable of detecting if the remote system is a NetScreen, and using its 'set ssh pka-dsa
key ...' command instead.
The options are as follows:
-i identity_file
Use only the key(s) contained in identity_file (rather than looking for identities via ssh-add(1) or in the default_ID_file). If the
filename does not end in .pub this is added. If the filename is omitted, the default_ID_file is used.
Note that this can be used to ensure that the keys copied have the comment one prefers and/or extra options applied, by ensuring that
the key file has these set as preferred before the copy is attempted.
-f Forced mode: doesn't check if the keys are present on the remote server. This means that it does not need the private key. Of
course, this can result in more than one copy of the key being installed on the remote system.
-n do a dry-run. Instead of installing keys on the remote system simply prints the key(s) that would have been installed.
-h, -? Print Usage summary
-p port, -o ssh_option
These two options are simply passed through untouched, along with their argument, to allow one to set the port or other ssh(1)
options, respectively.
Rather than specifying these as command line options, it is often better to use (per-host) settings in ssh(1)'s configuration file:
ssh_config(5).
Default behaviour without -i, is to check if 'ssh-add -L' provides any output, and if so those keys are used. Note that this results in the
comment on the key being the filename that was given to ssh-add(1) when the key was loaded into your ssh-agent(1) rather than the comment
contained in that file, which is a bit of a shame. Otherwise, if ssh-add(1) provides no keys contents of the default_ID_file will be used.
The default_ID_file is the most recent file that matches: ~/.ssh/id*.pub, (excluding those that match ~/.ssh/*-cert.pub) so if you create a
key that is not the one you want ssh-copy-id to use, just use touch(1) on your preferred key's .pub file to reinstate it as the most recent.
EXAMPLES
If you have already installed keys from one system on a lot of remote hosts, and you then create a new key, on a new client machine, say, it
can be difficult to keep track of which systems on which you've installed the new key. One way of dealing with this is to load both the new
key and old key(s) into your ssh-agent(1). Load the new key first, without the -c option, then load one or more old keys into the agent,
possibly by ssh-ing to the client machine that has that old key, using the -A option to allow agent forwarding:
user@newclient$ ssh-add
user@newclient$ ssh -A old.client
user@oldl$ ssh-add -c
... prompt for pass-phrase ...
user@old$ logoff
user@newclient$ ssh someserver
now, if the new key is installed on the server, you'll be allowed in unprompted, whereas if you only have the old key(s) enabled, you'll be
asked for confirmation, which is your cue to log back out and run
user@newclient$ ssh-copy-id -i someserver
The reason you might want to specify the -i option in this case is to ensure that the comment on the installed key is the one from the .pub
file, rather than just the filename that was loaded into you agent. It also ensures that only the id you intended is installed, rather than
all the keys that you have in your ssh-agent(1). Of course, you can specify another id, or use the contents of the ssh-agent(1) as you pre-
fer.
Having mentioned ssh-add(1)'s -c option, you might consider using this whenever using agent forwarding to avoid your key being hijacked, but
it is much better to instead use ssh(1)'s ProxyCommand and -W option, to bounce through remote servers while always doing direct end-to-end
authentication. This way the middle hop(s) don't get access to your ssh-agent(1). A web search for 'ssh proxycommand nc' should prove
enlightening (N.B. the modern approach is to use the -W option, rather than nc(1)).
SEE ALSO
ssh(1), ssh-agent(1), sshd(8)
BSD
June 17, 2010 BSD