07-13-2009
ssh: require passphrase from some servers but not others
We have a number of linux clusters running Oracle. The clusters require that all member nodes have promptless/passwordless login through ssh (ie. the keys were created with null passphrases). We also have a management server that is not a member of any cluster but routinely connects to nodes of all clusters to perform maintenance activities, deploy scripts etc.
Currently, we have not added the management server's key to any of the authorized key files as unrestricted access to all cluster nodes is undesirable. Therefore, whenever the management node attempts to ssh into a cluster node, we are prompted for a password. Since some scripts make multiple secure calls to multiple nodes, we end up typing a lot of passwords...
I would like to enable some form of session-level passwordless login (through ssh-agent?), without removing promptless/passwordless login between nodes of a cluster and without granting unrestricted access to all nodes from the management server. Ideally, when executing a script that includes multiple secure calls to multiple nodes, we would only enter the password/passphrase once for each node.
Is this possible?
10 More Discussions You Might Find Interesting
1. UNIX for Advanced & Expert Users
Hello,
I want to use a shell-script to transfer data over sftp.
I donīt find a way to login in automatically.
I tried to send the password in a script like possible with
ftp
sftp user@server << cmd
password
cd /distant/directory
lcd /local/directoryget ssh_install
get ( or put) your... (2 Replies)
Discussion started by: olso
2 Replies
2. UNIX for Advanced & Expert Users
In which case could be better don't use a passphrase creating an authentication key for ssh comunications?
Thanks in advance. (1 Reply)
Discussion started by: Minguccio75
1 Replies
3. Solaris
Hello all,
Today we run ssh with keys on all our Solaris systems. But I wounder: Is it possible to add another authentication too. Like the os/system regular password so the users first need to enter the ssh phasssphrase and after that they need to enter the os/system password.
I need like... (3 Replies)
Discussion started by: jOOc
3 Replies
4. Shell Programming and Scripting
Below is a part of my shell script. Currently I have shared the public key of the client with the host, therefore I will not be prompted for the password.
The key that has been created on the client is also without a passphrase. If it is created with a passphrase, the code I have will not... (3 Replies)
Discussion started by: farahzaiba
3 Replies
5. OS X (Apple)
ssh passphrase permissions issues
I will try to be as thorough as possible, but keep in mind I am a designer, not a programmer... I do have linux mdadm experience and am reasonably comfortable behind the terminal, but I may need things to be spelled out for me. I am using 2 new-ish Macs with... (1 Reply)
Discussion started by: Ahab the Eskimo
1 Replies
6. Shell Programming and Scripting
I have 9 servers, on each server a script with common name is available.
I send a token file to all server from 1 particular server. so when a daemon job checks that token file is available then it triggers the script..
I want to know is there any command or script which I will run/execute on... (16 Replies)
Discussion started by: mirwasim
16 Replies
7. Solaris
Hi Folks,
I have setup a passwordless connection from my Linux ( source) machine toSolaris ( destination ) machine. I have added passphrase while creating the rsa key. Now problem is each time when i make a connection i have to give the passphrase to make connection. How to override this ?
I... (4 Replies)
Discussion started by: chidori
4 Replies
8. Shell Programming and Scripting
I would like to write a bash shell script which will connect to remote server using passphrase. (I have public-private infrastructure created, and as per instruction, I must not use password less ssh).
This particular script will be fired from cron.
Can you please advice how I can supply the... (2 Replies)
Discussion started by: atanubanerji
2 Replies
9. UNIX for Beginners Questions & Answers
Hi folks.
I'm pretty new to unix, while I'm learning a lot I'm finding bash scripting quite confusing. Im sure it's not really, my head just hasn't clicked with it.
Anyway, I need a script to loop the ip addresses stored in a file and run a "pgrep <process>" and return the pid or some... (2 Replies)
Discussion started by: MuntyScrunt
2 Replies
10. Shell Programming and Scripting
Hi,
I am trying to complete my bash script in order to find which SSH servers on LAN are still active with the ssh keys, but i am frozen at this step:
#!/bin/bash
# LAN SSH KEYS DISCOVERY SCRIPT
</etc/passwd \
grep /bin/bash |
cut -d: -f6 |
sudo xargs -i -- sh -c '
&& cat... (11 Replies)
Discussion started by: syrius
11 Replies
LEARN ABOUT SUSE
votequorum_overview
VOTEQUORUM_OVERVIEW(8) Corosync Cluster Engine Programmer's Manual VOTEQUORUM_OVERVIEW(8)
NAME
votequorum_overview - Votequorum Library Overview
OVERVIEW
The votequuorum library is delivered with the corosync project. It is the external interface to the vote-based quorum service. This service
is optionally loaded into all ndes in a corosync cluster to avoid split-brain situations. It does this by having a number of votes assigned
to each system in the cluster and ensuring that only when a majority of the votes are present, cluster operations are allowed to proceed.
The library provides a mechanism to:
* Query the quorum status
* Get a list of nodes known to the quorum service
* Receive notifications of quorum state changes
* Change the number of votes assigned to a node
* Change the number of expected votes for a cluster to be quorate
* Connect an additional quorum device to allow small clusters to remain quorate during node outages.
votequorum reads its configuration from the objdb. The following keys are read when it starts up:
* quorum.expected_votes
* quorum.votes
* quorum.quorumdev_poll
* quorum.disallowed
* quorum.two_node
Most of those values can be changed while corosync is running with the following exceptions: quorum.disallowed cannot be changed, and
two_node cannot be set on-the-fly, though it can be cleared. ie you can start with two nodes in the cluster and add a third without reboot-
ing all the nodes.
BUGS
This software is not yet production, so there may still be some bugs.
SEE ALSO
corosync-quorumtool(8), votequorum_initialize(3), votequorum_finalize(3), votequorum_fd_get(3), votequorum_dispatch(3), votequorum_con-
text_get(3), votequorum_context_set(3),
corosync Man Page 2009-01-26 VOTEQUORUM_OVERVIEW(8)