1

I'm a little bit confused about setting up a password-less login for multiple machines to begin with, but I think I could do it from scratch. The problem is I already have it set up for one machine and I don't want that to be blown away when I try to set it up for the other machine. Let's clarify:

  • Machine A: the machine I'm connecting from
  • Machine B: the machine I'm connecting to. Password required
  • Machine C: the machine I'm connecting to. Password-less ssh

I have read some tutorials on setting up password-less ssh to a certain site, but they usually start with "move id_rsa out of the way so it doesn't get blown away," but then at the end of the tutorial it's not moved back. If I had no help at all, here is what I would do:

  1. Log into B
  2. ssh-keygen -t rsa -f ~/id_rsa.other
  3. scp id_rsa.other.pub A:~/.ssh
  4. echo "Host A \n Identity File ~/.ssh/id_rsa.other" > ~/.ssh/config

(Note that I realize these commands may not be exactly correct, but this is just the idea).

What I'm not quite clear on is if I need to update the config for A, B, or both. I'm fairly certain to do a password-less login from A to B, it is A that needs the public key .. but I also suppose I need B to use the correct id_rsa file for that public key. Finally, I don't want the password-less login for C to be affected at all .. it's using id_rsa. Am I going wrong anywhere?

Improve this question

2 Answers 2

Reset to default
1

It sounds like you're connecting A to B or A to C, right? (not A to B and then B to C)

If so, then you ust need to copy your id_rsa.pub to B and also to C.

The modification of the ~/.ssh/config file you have in step 4 in your sequence is needed if you don't use the standard ~/.ssh/authorized_keys file.

Here's what I would do (after generating the id_rsa and id_rsa.pub)...

  1. Copy id_rsa.pub (using scp, using password prompt) to B and to C
  2. Log into B - mv id_rsa.pub ~/.ssh/authorized_keys
  3. Log into C - mv id_rsa.pub ~/.ssh/authorized_keys

The private key is kept on A. You can use the same private key/public key combination to connect to more than one machine.

If, for some reason, you have multiple public keys for the user on B or C, you can append them to the end of the authorized_keys file.

Improve this answer
5
  • Yes you're exactly right .. I think this is what I need to do, but C is already set up properly (it already has the public key it needs I think .. can't check for sure since it doesn't allow shell access, but I can scp to it at least). So I guess I really only need to do steps 1 and 2. I'll accept if this works.
    – Explosion Pills
    Mar 26, 2012 at 17:14
  • Here's the thing: the id_rsa.pub on A has a pass phrase that I don't want for B .. so I guess I can just generate another id_rsa.pub and just concatenate it. Does ssh-keygen let you do that automatically, or do I have to create a new key file and concatenate manually?
    – Explosion Pills
    Mar 26, 2012 at 18:39
  • The .pub is a public key file. The public key is meant to be spread around. It's really the private key on A that is protected by the pass phrase. You type in your pass phrase to verify that you are authorized to use the local private key. When A is negotiating the connection to B or C, it doesn't pass the pass phrase and, I assume, doesn't pass the private key but only receives the public key. Try running ssh -v B or ssh -vv B to see more information about the authentication negotiation.
    – Doug Harris
    Mar 26, 2012 at 19:01
  • More discussion of the pros and cons of multiple public keys in this question
    – Doug Harris
    Mar 26, 2012 at 19:03
  • Just a little hint from me because this got edited three minutes ago: instead of scp the pubkey you can just run ssh-copy-id B and the standard pubkey will be sent to B. If you need you can add the parameter -i <pubkey-file> if you have multiple keys.
    – noggerl
    Oct 16, 2013 at 21:23
-1

I have finally crafted a convenient way to setup password less ssh to multiple nodes. Have been using those scripts for a while and it has been flawless for me so far. Hoping that it will help someone save time. I believe that this mechanism can run under a few minuted for a few hundred nodes at once. It is based on expect & bash scripts. Take a look at it and let me know your feedback. Link to scripts - http://adhocshare.tk/linux/setting-password-less-ssh-across-nodes-cluster/

If you've used ssh-keygen & ssh-copy-id before, the whole idea in the scripts is to automate that task on all nodes at once using pdsh and a file containing hostnames. Almost everything is automated and will save you a ton of time. Let me know how that works for you. I will be more than glad to help you.

Improve this answer
1
  • 3
    You should post the code from there into this answer. That way if the website ever is no longer reachable, people will still be able to use the script.
    – hichris123
    Nov 12, 2016 at 21:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .