ssh key deployment

lmcilwain · 11-07-2006, 11:26 AM

Hello all,

I want to run a perl script that remotely checks other linux systems so that I can monitor certain things such as file sizes and some other things.

I want to use ssh keys so that I don't get halted by being asked for authentication when my script runs.

I googled around a few places for learning how to properly deploy these keys but I don't seem to be having any luck with it.

My setup us:

monitoring server generated a dsa and rsa key using the following:

ssh-keygen -t rsa1
ssh-keygen -t dsa

Both commands created the .pub key that I need to install on the authorized_keyhs file on the remote system.

I copy and pasted the content of the .pub key on the monitoring server into the authorized_keys file on the server to be monitor.

When I try to log into the remote server from the monitoring server, I get prompted for a password as if no key existed. When I change keys I get prompted for the passphrase use to generate the key.

Can anyone give me an idea of what Im doing wrong? I did also try copying the generated .pub files to the remote machines .ssh directory and I still didn't have any luck.

Thanks

Lotharster · 11-07-2006, 11:48 AM

You have to append the public key to the authorized_keys file of the _remote_machine_, and have the private key in your ~/.ssh folder on the local machine. If you did not use a passphrase when generating the key, you normally should not be asked for one (EDIT: leave the passphrase empty if you want to generate a key without passphrase). If you did not use the standard filename ("ssh_id" iirc), you must pass the path of the secret keyfile when executing ssh (read ssh manpage for the correct syntax).

Regards,
Lotharster

EDIT: authorized_keys, not hosts

lmcilwain · 11-07-2006, 01:04 PM

There isn't an authorized_hosts file on the remote machine, just an authorized_keys file. This file already has a key in it from another machine and that machine is working fine logging in without being prompted for a password.

I append the id_rsa.pub contents to then end of that file and then try to log in and it asks me for the password to log in. the id_rsa.pub and the id_ras files are located in the .ssh folder on the local machine. When I generated the key, I left all the defaults, and just specified a passphrases or in the case I created a new one without a passphrase and still not able to log in with any luck.

Mortus Canis · 11-07-2006, 03:57 PM

Try just having one key for each machine rather than both rsa and dsa. Also, is there a reason why you are using rsa1? Perhaps the server does not allow you to login using rsa1, only rsa2.

Lotharster · 11-08-2006, 07:51 AM

I was referring to the authorized_keys file (see edit).

You can also look at the logfiles to see if ssh reports some error. Or you pass the -v option to ssh (you can add more "v"s for more verbosity) and look if the debug messages give you some clue why the key login fails.

Regards,
Lotharster

lmcilwain · 11-08-2006, 09:40 AM

Ok I figured out what my issue was... Thanks for the option of using the -v option... I seem to always forget that exists...

My problem was that when I generated the keys, to copy them over, I used the more command to view the key. Then copy and pasted into the authorized_keys file on the remote machine. When I copied the key over it had lots of embbedded returns so depending on how wide my screen was it treated each line viewed as a separate line instead of one long line.

To fix this problem, I opened the file using vi and copy and pasted the entry that way on the remote machine, once I did that I was able to log into the remote machine without being prompted for a password.

chort · 11-08-2006, 10:49 AM

There's much easier way to append new public keys ($ is local prompt, > is remote system):

Code:

$ cd ~/.ssh
$ ssh-keygen -t dsa -f my.host
$ scp my.host.pub remote.host:
$ ssh remote.host
> if [ -d .ssh ]; then echo ".ssh directory exists" ; else echo "creating .ssh directory" ; mkdir .ssh ; fi
> chmod 700 .ssh
> mv my.host.pub .ssh/
> cd .ssh
> cat my.host.pub >> authorized_keys
> exit
$

The most important thing to remember is when you cat the public key make sure you use two '>'s and not just one! Double-check that you have it right before you send the command. Using only one '>' will overwrite the contents of authorized_keys and then you'll have to go round up all the public keys all over again. Using two '>'s appends the output of cat to the end of the authorized_keys file. No need for messy cut & paste and no need to worry about embedded line-endings.

§€NTiN€L · 12-02-2006, 10:52 PM

i've been following this thread. I am getting the following errors when trying this in fc5

Quote:

[farhad@zion ~]$ ssh -v farhad@remote_host
OpenSSH_4.3p2, OpenSSL 0.9.8a 11 Oct 2005
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to engsoc.org [134.117.69.26] port 22.
debug1: Connection established.
debug1: identity file /home/farhad/.ssh/identity type -1
debug1: identity file /home/farhad/.ssh/id_rsa type -1
debug1: identity file /home/farhad/.ssh/id_dsa type -1
debug1: Remote protocol version 1.99, remote software version OpenSSH_3.8.1p1 Debian-8.sarge.4
debug1: match: OpenSSH_3.8.1p1 Debian-8.sarge.4 pat OpenSSH_3.*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_4.3
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
The authenticity of host 'engsoc.org (134.117.69.26)' can't be established.
RSA key fingerprint is 8f:d3:20:95:9a:24:e1:97:87:f2:79:a8:97:f2:bf:89.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/home/farhad/.ssh/known_hosts).
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /home/farhad/.ssh/identity
debug1: Trying private key: /home/farhad/.ssh/id_rsa
debug1: Trying private key: /home/farhad/.ssh/id_dsa
debug1: Next authentication method: keyboard-interactive

after this it is prompting for a password again.

sysconfig · 12-04-2006, 07:19 AM

Hi,

Kindly follow the steps mentioend at: http://forums.linuxwebadmin.info/ind...opic,65.0.html

Thanks,