sftp login without password

[S.S.]

Hi,

I want to establish the connection from one server to another server without password.

I have searched the google and have found the following procedure but this procedure is not worked out.

PASSWORDLESS SSH LOGIN AND SCP FOR NORMAL USER


Here we want to do SSH login and SCP form server A to Server B

Server A side
• Login with user id and password
• Create a directory named .ssh
• Run the command for generating the public key $ssh-keygen –t dsa –f .ssh/id_dsa
• This command will generate id_dsa file under .ssh
• In server B create directory .ssh user home directory.
• Copy id_dsa file from server A to this directory
• $cat id_dsa >.ssh/authorized_keys
• Change permission of authorized_keys permission to 700.
• Now try scp from server A to B first time it will ask connecting presently select yes.


Kindly help me what needs to be done in the above steps.

Thank you!

[James R. Ferguson · Accepted solution]

Hi:

Setup and use public keys among your servers.

These two links should provide you the information you need to easily do this:

http://sial.org/howto/openssh/publickey-auth/

http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1254688

The 'known_hosts' file contains the public host keys for all known hosts. The per-user version is maintained automatically. Thus, whenever you connect from an unknown host, its key is added to the per-user file if you choose to acknowledge the fingerprint. If you don't, the connection can still be made, but you will be prompted the next time as if you had never connected.

The manpages for 'sshd' and 'ssh' offer more information.

Regards!

...JRF...

[S.N.S]

Hi SS,
As per my understanding, you will only be asked once - after this authentication, you wouldn't need to enter the password...

Please select 'yes', then carry on...

Let the forum know if you have get any issues..

HTH
SNS

[Vijaykumar_1]

The steps are perfect, and you should be able to login without any password.

Once the public key of a server gets updated to the authorized keys,it wont request again..unless you delete the entry in /home/user-id/.ssh/known_hosts file.

[Steven Schweda]

> [...] this procedure is not worked out.

Not a useful problem description.

Sometimes it can be helpful to show exactly
what you did, and exactly what happened when
you did it.

There are also many, many old threads in this
forum (and others) on this topic. Did you
look at any of them?

> [...] server A to Server B [...]

Not a very useful description of these
systems.

uname -a
ssh -V

The HP Secure Shell products come with much
documentation. Did you look at any of it?

[Jim Walls]

There is at least one error in the procedure you describe!

[â ¢ Copy id_dsa file from server A to this directory]

id_dsa is the PRIVATE key and should not be copied anywhere!

It is Server A's PUBLIC key that gets copied to Server B.

â ¢ Copy id_dsa.pub file from server A
â ¢ cat id_dsa.pub >> .ssh/authorized_keys

Note also the ">>" to APPEND to authorized_keys... otherwise you will wipe out any other keys already therein!

Make sure that the home directory does not have group or world write permissions... should be at least 755 and the .ssh directory should be no more than 700.

[Jim Walls]

Also...

When you run ssh-keygen it generates TWO files... e.g. id_dsa (the private key) and id_dsa.pub (the public key).

This can be the same for any user... including the target user on Server B.

So, when you copy the public key over... make sure you do NOT put it into the target user's .ssh directory. Put it in /tmp or somewhere else... otherwise you may overwrite the target user's own, previously generated, public key file!

The public key can be freely copied about because it is useless to anyone unless they have the private key.

[Bill Hassell]

The procedure has a couple of errors. First, don't create the .ssh directory. ssh-keygen will do this for you automatically.

After ssh-keygen is finished, there will be a private and public file (key) in the .ssh directory. Be sure to check the permission for .ssh (should be 700) and the 2 keys (must be 600, never 7-anything).

While you can copy the public file, don't put it in .ssh. In fact, if you know how to handle long lines in vi, simply cat the public key file and copy-paste the contents into the .ssh/authorized_keys file. If authorized_keys does not exist, create it as a new file. Make sure the key has exactly 3 parts on *ONE* line. The parts are:

ssh-dss oneLongLineWithNOspaces source-comments-like-date-and-hostname

If you ftp the public key file to the remote system, be sure to store it in /tmp, then remember to delete it after the authorized_keys file has been updated. Always append (as mentioned above) to authorized_keys, and make sure the file is 600 permission. Also make sure that $HOME for this user is 755 or 750 and owned by the user.

Here is a partial example:

ssh-dss AAAAB3NzaC1kc3MAAAEBANoipziH5FRgwBLPyS... root@bh2-11.11 dsa

Lines that do not conform are silently ignored.

Now test the result with ssh and if you are asked for a password, the public key is not correct and you'll need to use ssh -VVV remote-server and post the results.

[S.S.]

Hi Experts,

First of all thank you very much. It is working now.

According to your advices, i have successfully established the password-less login b/w two hp-ux servers where as i was unable to establish the password-less login b/w hp-ux and Linux Systems.

May i know the procedure is same?

Thank you in advance.

[Jim Walls]

Yes, it is essentially the same.

[S.S.]

Thank you experts for helping me. I have successfully established the password-less login from unix and Linux systems.

Can you please help me how can we run the scripts without password by without generating ssh keys.

[Bill Hassell]

> Can you please help me how can we run the scripts without password by without generating ssh keys.

Once you have setup ssh/sftp capability with a public key, you simply run the script:

ssh remote_system name_of_script

You can run any command remotely:

ssh remote_system date
ssh remote_system ls /tmp