Page 1 of 2 12 LastLast
Results 1 to 10 of 15

Thread: Passwordless SSH issue.

  1. #1
    Join Date
    Mar 2006
    Location
    London, England
    Beans
    26
    Distro
    Ubuntu 10.04 Lucid Lynx

    Passwordless SSH issue.

    I'm trying to setup a passwordles SSH system, which has Ubuntu workstations, bringing files, on each boot, from a central Ubuntu server, this process has to be with no user input, and occur before GDM Starts up.

    I have figured out how to setup the passwordles ssh i think, by following these instructions:

    ssh-keygen -t rsa 2048

    [this will create a ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub for the private and public keys, respectively ]

    now copy the ~/.ssh/id_rsa.pub to the remoate system where you want passwordless login

    scp ~/.ssh/id_rsa.pub root@192.168.0.247:/tm

    Now on the remote machine

    mkdir ~/.ssh
    chmod 700 ~/.ssh
    cp /tmp/id_rsa.pub ~/.ssh/authorized_keys
    chmod 600 ~/.ssh/authorized_keys
    now on the host machine try to login iin , it shold log you in woith outh a password
    You can append as many public keys usig the >> sign
    the problem i am having however is the ssh fingerprint

    If i follow the instructions above, the scp ~/.ssh/id_rsa.pub root@192.168.0.247:/tm command asks me to verify the fingerprint, and passwordless ssh authentication will work.

    the Ubuntu Workstations however, are being prebuilt however, and have the

    mkdir ~/.ssh
    chmod 700 ~/.ssh
    cp /tmp/id_rsa.pub ~/.ssh/authorized_keys
    chmod 600 ~/.ssh/authorized_keys
    Done as part of the build, which doesn't actually incorperate the server they will eventually SSH to.

    Whats happening, is the Pc's will boot, and get to the point they are trying to SSH into the server, and stop until i enter in Y to verify the finger print. At chich point they will then carry on copying the files down.

    this happens on first boot every time, and is a bit of a pain, as we will have to roll out these workstations to many remote sites.

    My question is, how, where, what do i do to have the fingerprint of the remote SSH server already on the workstations, so it doesn't need verifying on the first workstation boot?

    what file, needs to go where, with what permissions, for all to be happy, and the SSH occur unnoticed at boot time.

    It should be said, this will all be happening on a secure internal network, with no outside internet access, this is a fully private network.

  2. #2
    Join Date
    Nov 2006
    Location
    40.31996,-80.607213
    Beans
    Hidden!
    Distro
    Ubuntu

    Re: Passwordless SSH issue.

    The fingerprint should be automatically be added to .ssh/known_hosts
    "Security lies within the user of who runs the system. Think smart, live safe." - Dr Small
    Linux User #441960 | Wiki: DrSmall

  3. #3
    Join Date
    Mar 2007
    Location
    Denver, CO
    Beans
    7,716
    Distro
    Ubuntu Mate 16.04 Xenial Xerus

    Re: Passwordless SSH issue.

    You can bypass this fingerprint verification if you want -- its part of a security measure -- but you can turn it off.

    If you copy the the ssh_config (the system wide default option file for every client) to the user's .ssh directory (~/.ssh), you can customize this file on a per user basis. (Or you can simply edit the /etc/ssh_config file itself if you want it applicable to every user). Anyway edit the file and change this line:

    # StrictHostKeyChecking ask

    to

    StrictHostKeyChecking no

  4. #4
    Join Date
    Mar 2006
    Location
    London, England
    Beans
    26
    Distro
    Ubuntu 10.04 Lucid Lynx

    Re: Passwordless SSH issue.

    KevDog, i'll give that a go when i get back to the office. It sounds like it could work.
    If you can keep a smile on your face, while the whole world is crashing around you. You really don't understand how severe the problem is.

  5. #5
    Join Date
    Jan 2008
    Location
    /dev/null
    Beans
    2,793
    Distro
    Ubuntu 8.04 Hardy Heron

    Re: Passwordless SSH issue.

    Quote Originally Posted by fieldyweb View Post
    KevDog, i'll give that a go when i get back to the office. It sounds like it could work.
    why not just copy the server fingerprint into each workstations known_hosts? that would solve the strict checking issue

  6. #6
    Join Date
    Feb 2007
    Location
    New Jersey, USA
    Beans
    318

    Re: Passwordless SSH issue.

    Hey fieldyweb, have you tried tweaking the StrictHostKeyChecking option in /etc/ssh/ssh_config

    Check it out in 'man ssh_config'
    Disclaimer: All of my advice is guaranteed without exception to work. If you find my advice unsatisfactory, you didn't do it right.

  7. #7
    Join Date
    Jan 2007
    Location
    ~/PA/USA
    Beans
    1,986
    Distro
    Ubuntu

    Re: Passwordless SSH issue.

    Just a question, why are you using an encryption algorithm such as RSA and not the DSA for signatures? I just want to know what the benifits are.

  8. #8
    Join Date
    Feb 2007
    Location
    New Jersey, USA
    Beans
    318

    Re: Passwordless SSH issue.

    Quote Originally Posted by cdtech View Post
    Just a question, why are you using an encryption algorithm such as RSA and not the DSA for signatures? I just want to know what the benifits are.
    I think speed is in the favor of RSA.
    Disclaimer: All of my advice is guaranteed without exception to work. If you find my advice unsatisfactory, you didn't do it right.

  9. #9
    Join Date
    Mar 2007
    Location
    Denver, CO
    Beans
    7,716
    Distro
    Ubuntu Mate 16.04 Xenial Xerus

    Re: Passwordless SSH issue.

    Not aware dsa was necessarily slower than rsa? Is this in fact the case?

  10. #10
    Join Date
    Jan 2007
    Location
    ~/PA/USA
    Beans
    1,986
    Distro
    Ubuntu

    Re: Passwordless SSH issue.

    I believe that RSA is an encryption algorithm, whereas DSA is for signatures only and is not an encryption algorithm. Correct me if I'm wrong. I'm still learning about encryption myself.

Page 1 of 2 12 LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •