ssh connection without password

[holdahl]

I'm trying to use ssh between some aix machines without having to enter password. (trying to run script that is copying some files from one machine to others in a cron job)

It works for some machines, but having problems with one machines that is part of a hacmp cluster.

Is the ip address of a machine used when creating ssh keys, or is only the hostname used?

Is it possible to create ssh keys for a machine that has more than one ip address?

-holdahl

 

[mrn]

This is what I do.

On all nodes in the Cluster edit /etc/ssh/shosts.equiv so that all other nodes in the cluster are trusted.
Self and other nodes.

E.g. if you have two nodes node1 and node2. On the node2 server you would edit /etc/ssh/shosts.equiv and add in node1


On the first node in the cluster e.g. node 0 (Master node) create a root user ssh key

As the root user do the following:
cd
ssh-keygen -t dsa
<enter>
<enter>
<enter>

cat id_dsa.pub grab all of the key info

e.g. ssh-dss AAAABBBBBCCCCC.....

Copy the key to all the other nodes in the cluster using the following process:

vi /etc/ssh/authorized_keys/root

add the following line to the end of the file (all on one line):

from="<hostname_of_master_node0.*" <SSH Public Key from step above>

e.g.
from="master_hostname.*" ssh-dss AAAABBBBBCCCCC.....

On all nodes apart from the Master 0 node allow root to run commands


cd /etc/ssh
cp sshd_config sshd_config.orig
vi sshd_config , comment out the line starting with this :
PermitRootLogin forced-commands-only
and make sure
PasswordAuthentication no
kill -9 $(cat /etc/ssh/sshd.pid)

Test that root@<master node> can run eg ssh <other node> lsvg against all other nodes.

test with

ssh node1 lsvg



Mike

"Whenever I dwell for any length of time on my own shortcomings, they gradually begin to seem mild, harmless, rather engaging little things, not at all like the staring defects in other people's characters."

 

[khalidaaa]

Never tried Mike's comment above (interesting to do though!)

The way i do it is following this link:

http://www.tek-tips.com/viewthread.cfm?qid=1207338&page=1

I advise you once you are done with the ssh passwordless (using either of the above ways), try dsh! it's soo much fun!

http://www.tek-tips.com/viewthread.cfm?qid=1385815&page=4

Regards,
Khalid