I am often having difficulties to set up password-less ssh connection on my clusters.
So I wrote a script, I thought it was working on ubuntu 14.04. I tried it today on a ubuntu 15 cluster, and it didn't work.
I am not really sure then if it ever worked on ubuntu 14.4 :-/
It is based on this page : http://mah.everybody.org/docs/ssh
I put the code on this github : https://github.com/romainjouin/formation_spark/blob/master/ubuntu_excange_ssh_keys.sh
the idea is to call the script, passing as first parameter the user#ip where we want to set up a password less ssh connection.
Can someone have a look to the github script : is there an obvious thing I am missing ?
Furthermore, before launching the script I :
Change /etc/ssh/sshd_config to uncomment
AuthorizedKeysFile %h/.ssh/authorized_keys
ant then do :
$/etc/init.d/ssh restart
EDIT
The code seems to work fine, but I was missing the authorisation on the home directory to make it work (home dir was 777 instead of 700).
The code seems to work fine, but I was missing the authorisation on the home directory to make it work (home dir was 777 instead of 700). – Romain Jouin
suppose you ssh remote-user#remote-host frequently, first
ssh-copy-id -i ~/.ssh/id_rsa.pub remote-host
then, edit you ~/.ssh/config file
cat ~./ssh/config
Host foobar
HostName remote-host-ip
Port 22
User remote-user
IdentityFile ~/.ssh/id_rsa
now you can ssh like this
ssh foobar
Related
I need to restrict access to 1 of my linux servers . so i added to my "authorized_keys" file before the key :
no-pty ssh-rsa ..............
I disabled the password access to this machine from couple of ip's
In the seconds server that running ansible i need to success "Deploying" to the restricted server .
i need to know how i can permit couple of commands :
rsync
scp
Also i would like to disable the option to run commands to the restricted server like that :
ssh ***.***.***.*** | bash "date"
So once i'll run the ansible playbook i will be able to rsync / scp files to the restricted server
how can i do that ?
Thanks a lot ! Amit
I have this linux machine with ssh server installed, I can access the server using username="ubuntu". ssh server blocks clients that try to connect using "root" username.
So connection can be made by:
ssh -i mykey ubuntu#myserver
I can get files that belong to "ubuntu" using :
scp -i mykey ubuntu#myserver:<file location> ./
However, what I really want is to get files that belong to "root" username, (Note: I can't access the server with username "root" for obvious security reasons).
so is there a way to do download files that are under "root" username?
I was thinking to do some magic in the server side that enables me to do that.(I don't know how :) )
if this help: I have root access and also I can create files on my server side. but I'm not allowed to change the file permission under the root(if someone get hold of these files I'll be fired)
You can try monster like this
ssh ubuntu#myhost 'sudo cat /path/to/file | uuencode' | uudecode > path/to/local
You should have uuencode and uudecode on coresponding hosts.
Or if file is text you can skip uuencode part
ps: see related topic
You could do it the other way around.
Log into the the pc with the file you want with
ssh ubuntu#myserver
Then gain superuser privileges
sudu su
and then copy the files you want
scp /the_file_you_want ubuntu#myhost:/the_location_and_filename_you_want
Some other ways you can find here
https://unix.stackexchange.com/questions/106480/how-to-copy-files-from-one-machine-to-another-using-ssh
enable ssh on your machine
(if fedora) (for ubuntu you can find command on google easily)
service sshd on
From your local machine
ssh -i ubuntu#myserver
change to root
su
enter password
and copy files using scp
scp somefile.extension randomuser#localmachine:/some/path/
I hope it helps
For work, I have to connect to dozens of Linux machines via SSH (to perform maintenance, monitor the system, install software, etc).
I have a small arsenal of scripts that help me do some of these tasks, and these are located in a folder on my Mac in /Users/me/bin. I want to be able to run these scripts on the remote Linux machine, but for several reasons I do not want these scripts permanently located on these machines (e.g., other people also connect to these remote machines, and it would be unwise to let them execute these files).
So, is possible to share scripts across an SSH connection for the lifetime of the session only?
I have a couple of ideas on how to do this, but I don't know if any of them will work. Firstly, if SSH allows file mounting, I could automatically mount me#mymac:/Users/me/bin to me#linux:/remote_bin when I connect to the remote Linux box, and set my PATH variable to "$PATH:/remote_bin". Secondly, I could set up port forwarding in the connection string (e.g., ssh me#linux -R 9999:127.0.0.1:<SMBPORT|ETC> and every time I connect mount the share and set the $PATH variable.
EDIT: I've come up with a semi-solution. On the linux machine, edit /etc/ssh/sshd_config to add the following subsystem: Subsystem shareduserbinary sudo su -l -c "/bin/mount -t cifs -o port=9999,username=me,nounix,sec=ntlmssp //127.0.0.1/exported_bin /mnt/remote_bin" && bash -l -i -s. When connecting to the remote machine, set up a reverse port forward and invoke the subsystem. E.g.: ssh -R 9999:127.0.0.1:445 -s shareduserbinary me#linux.
EDIT 2: You can make the solution above cleaner, by removing the -l from the sudo command and changing the path from /mnt/remote_bin to $HOME/rbin.
Interesting question. Perhaps you can add a command to ~/.bash_login (assuming you are using bash) to copy the scripts from a remote host (such as your mac) when you login, then add a command to ~/.bash_logout to delete the scripts when you logout. But, as bmargulies points out, it would be a good idea to go a step further and make sure that nobody else has permissions to read or execute the scripts.
You can use OpenSSH's LocalCommand to upload the files (using e.g. scp or rsync) when initiating an SSH session (see man ssh_config and this):
Host server1 server2 [...]
PermitLocalCommand yes
LocalCommand scp -q /Users/bin/me/* %h:temp_bin/
and use .bash_logout or an EXIT-trap that you specify in your .bashrc to delete the contents of the directory on logout.
I am new to linux and am having trouble doing this.
I need to download files and this is currently what I do to access the file.
SSH into server A.
From server A, SSH to server B
After logging into server B, run the following command:
sudo -i -u testuser
I enter a password and then I have the privileges I need.
How would I replicate this with WinSCP? I can login to the server following the guide here:
https://superuser.com/questions/303486/sftp-over-double-server-hop
But I cannot download the files because I don't have permissions. How do I execute that sudo command and enter a password in the login process using WinSCP? Or an alternative program (that runs on OSX). My ultimate goal is to download a file form the(double remote) computer to my local computer.
You need to combine two "advanced" features of WinSCP.
Tunneling: That's what the Super User question you have referred to deals with:
SFTP over double server hop
Sudo: There's another Super User question that deals with this:
How to change user in WinSCP?
It is basically covered in WinSCP FAQ How do I change user after login (e.g. su root)?
This is a tricky part.
You can use the solution you've already found, just use:
ssh -o ProxyCommand='ssh myfirsthop nc -w 10 %h %p' testuser#mydestination
I connected 3 data nodes(in all these data nodes pass-wordless is working fine) in my cluster which are working fine but when i try to connect another data node pass-wordless ssh not working in fourth data node.
IP address of first three data nodes:
172.20.93.192(name node)
172.20.94.189(data node)
172.20.94.145(data node)
172.20.94.193(data node)
now my fourth data node's IP address is 172.20.95.6 where password-less is not working.
I am generating keys with
ssh-keygen -t rsa
I am doing the same process for the fourth data node as above three data nodes but it is not working. Why? what may be the reason?
I had a very similar problem today with CentOS servers. The problem turned out that the /root folder had wrong permissions. In fact, the /var/log/secure log file showed this error:
Sep 3 09:10:40 nec05 sshd[21858]: Authentication refused: bad ownership or modes for directory /root
This is what it wrongly was:
[root#nec05 ~]# ls -ld /root
drwxrwxrwx. 32 root root 4096 Sep 3 09:54 /root
Using chmod fixed it:
[root#nec05 ~]# chmod 550 /root
[root#nec05 ~]# ls -ld /root
dr-xr-x---. 32 root root 4096 Sep 3 09:54 /root
After that, passwordless login worked on this particular server.
More information would be required to get the "real" cause. However here it goes two of the most common problems I have found and not related to the key configuration itself (taking into account that you use Linux :)):
SSHD in the remote machine is configured in restricted mode for "root" and you are trying to ssh as root. SOLUTION: Copy /etc/ssh/sshd.conf from one of the working machines to the faulty and restart ssh server.
Home folder of the user used for remote login has invalid permissions. Many default configurations for SSH Daemons contain restrictions about the permissions of the user home folder for security purposes. SOLUTION: Compare with working nodes and fix. (Sometimes you would see a warning/error log in /var/log/messages.
If you follow the process to integrate the keys from the scratch and review the permissions for all the files involved you should face no issues.
Please answer back with sshd.conf file as well as the logs from a remote login with -v (ssh -v IPADDR) for a better analysis.
I went through the same errors recently. All my file permissions are set up correctly but still ssh asks for password. Finally I figured out it is due to one missing at /etc/ssh/sshd_config: you shoud add "AuthorizedKeysFile %h/.ssh/authorized_keys", so that sshd will look for the publickey file at your home dir.
After doing this the problem is gone.
You would have to more elaborate your problem i.e. whether you are using the same private-public key pair for all servers.
Secondly you must try ssh with -v flag it will give you some hint like which private key it is using for authentication, what is the cause of authentication failure.
Thirdly Verify the permission of .ssh/authorized_keys at server end. It should not have write permission to group or other users.
You can simply use
ssh-keygen -f # to generate ssh key pair.
ssh-copy-id # #to copy public key in the server's authorized key.
troubleshoot checklist:
example: Machine A passwordless login to B
turn off selinux on B
FOR BOTH A&B: make sure correct permission for .ssh(700) and .ssh/authorized_keys (600)
check on B: /etc/ssh/sshd_config: PubkeyAuthentication yes
check firewall on B
check the log /var/log/secure
if you've renamed id_rsa/id_rsa.pub to example id_rsa_b/id_rsa_b.pub, you should do ssh -i .ssh/id_rsa_b user#MachineB
refer
I am going to explain with example:
Suppose there are two server server1(192.168.43.21) and server2(192.168.43.33).If you want password less ssh between server1 and server2 where user is admin then follow below steps-
To install run command: yum install openssh-server openssh-clients
To create ssh key run command : ssh-keygen -t rsa on server1 and server2
SELINUX disable at : vim /etc/selinux/conifg
SELIINUX=disabled
After changing SELINUX need to reboot.
Add user to AllowUsers ,AllowGroups and PermitEmptyPasswords on at :
vim /etc/ssh/sshd_config
AllowUsers admin
AllowGroups admin
After update restart sshd: systemctl restart sshd
Go to home directory of admin user : cd ~
Go to ssh folder : cd .ssh and copy id_rsa.pub key from server1 and paste it into server server2 authorized.key file of .ssh folder.
note: Instead of manually copy we can use:
From server2 use command: `ssh-copy-id admin#serve1`
From server1 use command: `ssh-copy-id admin#server2`
Now try ssh from server1 to server2 and server2 to server1
From server1 command: `ssh admin#server2`
From server2 command: `ssh admin#server1`
If not working then check firewall user use command:
To check status of firewall run command: firewall-cmd --state
If it is running then check ssh port is added or not using below command:
firewall-cmd --list-all
If port is not added then need need to add to desired zone.
If firewall is not mandatory to active in that cat you can stop firewall and
mask it using below command:
systemctl stop firewalld
systemctl disable firewalld
systemctl mask --now firewalld
Please check if selinux is disabled.
In my case, worked after selinux disabled.
Method in linux is to generate encrypted key (either with rsa or dsa ) for that user , save that key in authorized key , assign rights to that folder and file in it.
1: Generate key with command
ssh-keygen –t dsa –P '' –f ~/.ssh/id_dsa
Your public key has been saved in /home/username_of_pc/.ssh/id_dsa.pub
2:Add that key in authorized key.
Cat ~/.ssh/id_dsa.pub >> ~/.ssh/authorized_keys
Set permissions for folder where it’s saved.
if you need it on another server then simply copy it to other machine.
3:Check ssh by simply typing
ssh localhost
It should not ask for password and only display last login time , then it’s setup correctly. Remember not to use root for ssh.