topic Re: setting up ssh keys in Operating System - HP-UX

setting up ssh keys

gr8 — Tue, 05 Jun 2007 01:11:11 GMT

hi
can any one tell me how to setup ssh keys among three servers?

Re: setting up ssh keys

Steven Schweda — Tue, 05 Jun 2007 01:56:12 GMT

A forum search for:

hp-ux ssh-keygen

should tell you more than you want to know.

Re: setting up ssh keys

Steven E. Protter — Tue, 05 Jun 2007 02:02:10 GMT

Shalom,

ssh-keygen -t dsa

All three servers.

Add them all to a single file called authorized_keys

distribute the file to the .ssh directory of all systems.

SEP

Re: setting up ssh keys

Doug O'Leary — Tue, 05 Jun 2007 05:36:51 GMT

Hey;

While accurate, the info above doesn't help with understanding how ssh works and, without that, when you run into problems, you will have a much harder time troubleshooting them.

O'Reilly has an absolutely outstanding book on secure shell very appropriately titled "SSH, The Secure Shell: The Definitive Guide", ISBN: 0-596-00011-1.

When you want to know what ssh can do for you and how to configure it, pick that book up. It's very much worth the cost.

Doug

Re: setting up ssh keys

Yogeeraj_1 — Tue, 05 Jun 2007 06:09:27 GMT

hi,

also have a look at the docs.

see attachment

hope this helps too!

kind regards
yogeeraj

Re: setting up ssh keys

Rasheed Tamton — Tue, 05 Jun 2007 06:31:25 GMT

SSH Key Authentication between two Servers:

[a]. Generate a pair of SSH keys on the client.

root@sdsaptsp2# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (//.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in //.ssh/id_rsa. Your public key has been saved in //.ssh/id_rsa.pub.The key fingerprint is: 05:26:98:a9:1f:c3:03:d1:b1:4e:35:e8:9b:f7:e3:89 root@sdsaptsp2

Note: Here passphrase is set as null. You can also use passphrase and it is good for security.

[b]. Copy the public key from the client to the server:

root@sdsaptsp2# scp /.ssh/id_rsa.pub sdsaptsp1:/var/tmp/
root@sdsaptsp1's password:
id_rsa.pub 100% 222 0.2KB/s 00:00

On the server [sdsaptsp1], append the newly obtained key to the ~/.ssh/authorized_keys file, which stores SSH public keys:

root@sdsaptsp1# cat /var/tmp/id_rsa.pub >> /.ssh/authorized_keys

[c]. Modify the permissions of the authorized_keys file

root@sdsaptsp2# chmod 600 ~/.ssh/authorized_keys

At the client, try and login to the server:

root@sdsaptsp2# ssh sdsaptsp1
Sun Microsystems Inc. SunOS 5.9 Generic Patch January 2007
You have mail.
root@sdsaptsp1#

Do the same on the other servers.

Hope it helps.

Re: setting up ssh keys

PeterWolfe — Wed, 06 Jun 2007 09:32:30 GMT

gr8,

You didn't say what version of HP-UX
you were using but if it's 11iV2 Dec 05
or later, there is a nice utility:
/opt/dsau/bin/csshsetup
that helps automate the steps required to
configure password-less ssh access across
N systems. You simply do:

csshsetup -f

where contains the name of the
N systems, one per line. That would set up
the user with a one-way ssh trust from the current system to the N others. If
you add the -r flag, the key exchange is
bi-directional across all the servers so you could ssh from any server to any other server in the list. One of the standard
uses here is setting up ssh in a Serviceguard cluster for example. Works just
fine for groups of standalone systems as well.

Re: setting up ssh keys

gr8 — Tue, 12 Jun 2007 05:03:02 GMT

Hi all
i tried creating authorized_keys but iam facing loging in probelms with one user

Re: setting up ssh keys

Steven Schweda — Tue, 12 Jun 2007 06:06:26 GMT

> i tried creating authorized_keys

Do you think that this explains what you did?

> but iam facing loging in probelms with one
> user

Do you think that this explains your problem?

It might help to explain, exactly, what you
have done.

It might also help if you show the output
from an "ssh" command which includes the "-v"
option (for example: "ssh -v host_name").

If you have a problem with only one user, and
it works for other users, you could compare
the "ssh -v [...]" output for the problem
user with that for a non-problem user.

Re: setting up ssh keys

Geoff Wild — Tue, 12 Jun 2007 07:46:02 GMT

As the userid you want to use, cd ~USER
mkdir .ssh
chmod 700 .ssh
cd .ssh
ssh-keygen -t rsa -f id_rsa

That will create id_rsa and id_rsa.pub

Add the contents of id_rsa.pub to the ~USER/.ssh/authorized_keys file on a remote host (you may have to create the file if not there already).

Then, as that USER, you should be able to ssh without being prompted for a password.

Example, list contents of my home dir on svr1020 - executed from svr1120:

gwild@svr1120 [ /home/gwild ]
# ssh svr1020 ls
mirror-root
test_dbi.pl
test_mail.pl

NOTE: This will not work if the /home/USER permissions are higher then 755 - that is, 775 will not work.

Rgds...Geoff

Re: setting up ssh keys

gr8 — Fri, 15 Jun 2007 03:19:59 GMT

Hi
i have problem with only one user .who is having home directory on a deffrent file system.(all others are at /export/home).

i compared output of ssh -v commands. ifound that for the problem user ssh publickey authentication is not taking place but unfortunately there is no error messages for that
tail of ssh -v ouput shows something like this

debug1: authentications that can continue: publickey,password,keyboard-interacti
ve
debug1: next auth method to try is publickey
debug1: try privkey: /home/xxxx/.ssh/identity
debug1: try privkey: /home/xxxx/.ssh/id_rsa
debug1: try pubkey: /home/xxxx/.ssh/id_dsa
debug1: authentications that can continue: publickey,password,keyboard-interacti
ve
debug1: next auth method to try is keyboard-interactive

Re: setting up ssh keys

Steven Schweda — Fri, 15 Jun 2007 09:35:26 GMT

So, is there a "/home/xxxx/.ssh/identity"
for this user? What's in it? "ls -l"?

> [...] you could compare [...]

Can we assume that this is where the good
user's "ssh -v" output diverges from that of
the bad user?

> tail of ssh -v ouput shows something like this

Yeah, we wouldn't want to see the whole
thing for a good user and for a bad user, and
we certainly wouldn't want to see it before
you changed all the details.

Re: setting up ssh keys

Geoff Wild — Fri, 15 Jun 2007 09:40:55 GMT

Did you check the permissions of their home directory? Has to be 755.

Rgds...Geoff

Re: setting up ssh keys

gr8 — Fri, 20 Jul 2007 01:42:10 GMT

It was the home directory permission issue.
it was not the standard home directory for this user . maded required permission changes tested -- ok .thanks for your help