07-13-2009
ssh: require passphrase from some servers but not others
We have a number of linux clusters running Oracle. The clusters require that all member nodes have promptless/passwordless login through ssh (ie. the keys were created with null passphrases). We also have a management server that is not a member of any cluster but routinely connects to nodes of all clusters to perform maintenance activities, deploy scripts etc.
Currently, we have not added the management server's key to any of the authorized key files as unrestricted access to all cluster nodes is undesirable. Therefore, whenever the management node attempts to ssh into a cluster node, we are prompted for a password. Since some scripts make multiple secure calls to multiple nodes, we end up typing a lot of passwords...
I would like to enable some form of session-level passwordless login (through ssh-agent?), without removing promptless/passwordless login between nodes of a cluster and without granting unrestricted access to all nodes from the management server. Ideally, when executing a script that includes multiple secure calls to multiple nodes, we would only enter the password/passphrase once for each node.
Is this possible?
10 More Discussions You Might Find Interesting
1. UNIX for Advanced & Expert Users
Hello,
I want to use a shell-script to transfer data over sftp.
I donīt find a way to login in automatically.
I tried to send the password in a script like possible with
ftp
sftp user@server << cmd
password
cd /distant/directory
lcd /local/directoryget ssh_install
get ( or put) your... (2 Replies)
Discussion started by: olso
2 Replies
2. UNIX for Advanced & Expert Users
In which case could be better don't use a passphrase creating an authentication key for ssh comunications?
Thanks in advance. (1 Reply)
Discussion started by: Minguccio75
1 Replies
3. Solaris
Hello all,
Today we run ssh with keys on all our Solaris systems. But I wounder: Is it possible to add another authentication too. Like the os/system regular password so the users first need to enter the ssh phasssphrase and after that they need to enter the os/system password.
I need like... (3 Replies)
Discussion started by: jOOc
3 Replies
4. Shell Programming and Scripting
Below is a part of my shell script. Currently I have shared the public key of the client with the host, therefore I will not be prompted for the password.
The key that has been created on the client is also without a passphrase. If it is created with a passphrase, the code I have will not... (3 Replies)
Discussion started by: farahzaiba
3 Replies
5. OS X (Apple)
ssh passphrase permissions issues
I will try to be as thorough as possible, but keep in mind I am a designer, not a programmer... I do have linux mdadm experience and am reasonably comfortable behind the terminal, but I may need things to be spelled out for me. I am using 2 new-ish Macs with... (1 Reply)
Discussion started by: Ahab the Eskimo
1 Replies
6. Shell Programming and Scripting
I have 9 servers, on each server a script with common name is available.
I send a token file to all server from 1 particular server. so when a daemon job checks that token file is available then it triggers the script..
I want to know is there any command or script which I will run/execute on... (16 Replies)
Discussion started by: mirwasim
16 Replies
7. Solaris
Hi Folks,
I have setup a passwordless connection from my Linux ( source) machine toSolaris ( destination ) machine. I have added passphrase while creating the rsa key. Now problem is each time when i make a connection i have to give the passphrase to make connection. How to override this ?
I... (4 Replies)
Discussion started by: chidori
4 Replies
8. Shell Programming and Scripting
I would like to write a bash shell script which will connect to remote server using passphrase. (I have public-private infrastructure created, and as per instruction, I must not use password less ssh).
This particular script will be fired from cron.
Can you please advice how I can supply the... (2 Replies)
Discussion started by: atanubanerji
2 Replies
9. UNIX for Beginners Questions & Answers
Hi folks.
I'm pretty new to unix, while I'm learning a lot I'm finding bash scripting quite confusing. Im sure it's not really, my head just hasn't clicked with it.
Anyway, I need a script to loop the ip addresses stored in a file and run a "pgrep <process>" and return the pid or some... (2 Replies)
Discussion started by: MuntyScrunt
2 Replies
10. Shell Programming and Scripting
Hi,
I am trying to complete my bash script in order to find which SSH servers on LAN are still active with the ssh keys, but i am frozen at this step:
#!/bin/bash
# LAN SSH KEYS DISCOVERY SCRIPT
</etc/passwd \
grep /bin/bash |
cut -d: -f6 |
sudo xargs -i -- sh -c '
&& cat... (11 Replies)
Discussion started by: syrius
11 Replies
LEARN ABOUT DEBIAN
ssh-keysign
SSH-KEYSIGN(8) BSD System Manager's Manual SSH-KEYSIGN(8)
NAME
ssh-keysign -- ssh helper program for host-based authentication
SYNOPSIS
ssh-keysign
DESCRIPTION
ssh-keysign is used by ssh(1) to access the local host keys and generate the digital signature required during host-based authentication with
SSH protocol version 2.
ssh-keysign is disabled by default and can only be enabled in the global client configuration file /etc/ssh/ssh_config by setting
EnableSSHKeysign to ``yes''.
ssh-keysign is not intended to be invoked by the user, but from ssh(1). See ssh(1) and sshd(8) for more information about host-based authen-
tication.
FILES
/etc/ssh/ssh_config
Controls whether ssh-keysign is enabled.
/etc/ssh/ssh_host_dsa_key
/etc/ssh/ssh_host_ecdsa_key
/etc/ssh/ssh_host_rsa_key
These files contain the private parts of the host keys used to generate the digital signature. They should be owned by root, read-
able only by root, and not accessible to others. Since they are readable only by root, ssh-keysign must be set-uid root if host-
based authentication is used.
/etc/ssh/ssh_host_dsa_key-cert.pub
/etc/ssh/ssh_host_ecdsa_key-cert.pub
/etc/ssh/ssh_host_rsa_key-cert.pub
If these files exist they are assumed to contain public certificate information corresponding with the private keys above.
SEE ALSO
ssh(1), ssh-keygen(1), ssh_config(5), sshd(8)
HISTORY
ssh-keysign first appeared in OpenBSD 3.2.
AUTHORS
Markus Friedl <markus@openbsd.org>
BSD
August 31, 2010 BSD