Dec 282006
 

Sponsored Link

Secure Shell is a program to log into another computer over a network, to execute commands in a remote machine, and to move files from one machine to another. It provides strong authentication and secure communications over unsecure channels. It is intended as a replacement for telnet, rlogin, rsh, and rcp. For SSH2, there is a replacement for FTP: sftp.This might be useful if you are trying to connect everytime to your server remotely.

A Trust relationship can be established for users on multiple servers running OpenSSH to allow a password free ssh session. This is sometime important when you want to run scripts or commands remotely.

Let's assume ServerA and ServerB both run the ssh daemons.

To allow ServerA to SSH to ServerB without password, please try the following:

# ssh-keygen -t rsa

Note: User here is root

This generates two files id_rsa.pub and id_rsa

Now, this needs to be copied to the authorized_keys file on ServerB

# scp id_rsa.pub ServerB:~/.ssh/authorized_keys

Enter password when prompted.

Note: If the ServerB is already having a trust relationship with more that one hosts already then the above will wipe the contents and write this key alone. In which case, copy the file to the remote server as something like ServerA_rsa.pub and then append the contents to authorized_keys as follows. This will allow the existing authroized_keys from being wiped off.

# scp id_rsa.pub ServerB:~/.ssh/ServerA_rsa.pub

# cat ServerA_rsa.pub >> authorized_keys

Thats it. Test if you are able to do a ssh from ServerA without a password:

# ssh serverB uname -a

This will run the command "uname -a" on ServerB and returns the result on ServerA.

The same procedure has to be followed in the reverse to allow ServerB to talk back to ServerA without any password.

And, if there is anyone other server to be added to the existing list follow the same procedure ensuring the key is appended to the remote servers authorized_keys file and not by overwriting it.

Sponsored Link

 Posted by at 8:30 am

  8 Responses to “SSH your Debian servers without password”

  1. scp and cat of your ID is obsolete since ssh-copy-id exists.

  2. This article is a little bit of a simplification of what one can/should do while using SSH. For example, generally speaking, using DSA keys over RSA is recommended (security reasons). As always, there are pros and cons. However, generally speaking, DSA is a better choice. Also, this article fails to mention that once a “key phrase” (referred to as ‘password’ here) is entered, your idea of ‘passwordless’ log on flies out the window in a jiffy. You can go with kludges like “ssh-agent” to manage your key phrases but the bottom line is, we all want a passwordless authentication. Well, then let’s say it: press ENTER when prompted for a password while generating a key and let’s spare those who search for the answers on how to do this any further investigations.

    If one is really paranoid about having one’s keys without a key phrase, then, you can protect it (to an extent) on the remote site by specifying what host a particular key can be accepted from via authorized_keys file. But this is a discussion for a later time.

  3. The only problem with this is that this only works until you logout and then you have to restart the agent and put in the passphrase…it’s still cool though.

  4. Tim this is not a problem since pam-ssh is available. So with your KDM/GDM/XDM login you can give the ssh-agent the passphrase – call it single-sign-on.

  5. Nice, I follow your post and it work, but u forgot to add that in place of password you have to use the passphrase… I’m intrest in accessing the ssh-server like rsh without any type of autentification..

  6. Ok… I figured out, u need to run ssh-agent and ssh-add to use this like I whant. I’t works but it dependes of the ssh-agent and that ok for me…
    Thanx.

  7. Hi,
    I am trying to connect from a UNIX machine to a Windows SSH server without a password entry.
    I tried the steps above but I have no luck in doing it.
    Any suggestions?

  8. #!/usr/bin/expect -f

    if { [llength $argv] < 3 } {
    send "Usage: ssh2 \n”
    exit;
    }

    set host [lrange $argv 0 0]
    set user [lrange $argv 1 1]
    set pass [lrange $argv 2 2]
    set supass [lrange $argv 3 3]

    set timeout -1

    spawn ssh $user@$host
    match_max 100000

    expect {
    “*yes/no*” {
    send — “yes\r”
    exp_continue
    }
    “*?assword:*” {
    send — “$pass\r”
    }
    }
    interact

 Leave a Reply

(required)

(required)

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>