Difference between revisions of "Passwordless SSH"

From The TinkerNet Wiki
Jump to navigation Jump to search
 
(12 intermediate revisions by the same user not shown)
Line 1: Line 1:
 +
<span style="background-color: rgb(153, 204, 0); color: rgb(0, 0, 255);" data-mce-style="background-color: #99cc00; color: #0000ff;">'''<big>Now on Wiki.NerdMage.Ca</big>'''</span>
 +
 
These instructions assume 2 ESXi servers:  ESXi0 & ESXi1
 
These instructions assume 2 ESXi servers:  ESXi0 & ESXi1
  
Line 5: Line 7:
 
You will need '''SSH client''' enabled in the built-in firewall on your ESXi hosts.
 
You will need '''SSH client''' enabled in the built-in firewall on your ESXi hosts.
  
−
* Allowing SSH & SCP between ESXi Hosts
+
*Allowing SSH & SCP between ESXi Hosts
−
** SSH Client must be enabled in the ESXi firewall (for the outbound connection)
+
**SSH Client must be enabled in the ESXi firewall (for the outbound connection)
−
** [https://4sysops.com/archives/how-to-open-and-close-firewall-ports-on-vmware-esxi-hosts/ How to Open and Close Firewall Ports on vmWare ESXi Hosts]
+
**[https://4sysops.com/archives/how-to-open-and-close-firewall-ports-on-vmware-esxi-hosts/ How to Open and Close Firewall Ports on vmWare ESXi Hosts]
  
 
===ESXi to ESXi===
 
===ESXi to ESXi===
Line 31: Line 33:
 
  mkdir /.ssh
 
  mkdir /.ssh
 
  cp /vmfs/volumes/Admin/Utilities/ssl/ESXi1/keys/* /.ssh
 
  cp /vmfs/volumes/Admin/Utilities/ssl/ESXi1/keys/* /.ssh
−
 
−
*<code>/sbin/auto-backup.sh</code>
 
  
 
====ESXi1====
 
====ESXi1====
Line 53: Line 53:
 
  mkdir /.ssh
 
  mkdir /.ssh
 
  cp /vmfs/volumes/Admin/Utilities/ssl/ESXi0/keys/* /.ssh
 
  cp /vmfs/volumes/Admin/Utilities/ssl/ESXi0/keys/* /.ssh
−
 
−
*<code>/sbin/auto-backup.sh</code>
 
  
 
====On Both Servers====
 
====On Both Servers====
Line 68: Line 66:
  
 
*<code>/etc/init.d/SSH restart</code>
 
*<code>/etc/init.d/SSH restart</code>
 +
*<code>/sbin/auto-backup.sh</code>
  
 
At this point, you should be able to SSH from one to the other without needing to enter a password.
 
At this point, you should be able to SSH from one to the other without needing to enter a password.
  
−
===ESXi to Linux===
+
====Troubleshooting SSH on ESXi====
 +
If you get "ssh: connect to host WHATEVER port 22: Connection timed out" when trying to SSH from an ESXi host, double check the configuration of '''SSH Client''' in the servers '''Firewall Rules'''.
 +
 
 +
=== ESXi to Linux ===
 
Assuming you've already created your keyes in [[ESXi - Passwordless SSH#ESXi to ESXi|ESXi to ESXi]]
 
Assuming you've already created your keyes in [[ESXi - Passwordless SSH#ESXi to ESXi|ESXi to ESXi]]
  
Line 80: Line 82:
 
*<code>ssh USER@LINUXBOX 'mkdir ~/.ssh'</code>
 
*<code>ssh USER@LINUXBOX 'mkdir ~/.ssh'</code>
  
−
===<span style="color:#c0392b">Linux to ESXi</span>===
+
===Linux to ESXi===
 
Assuming you've already created the directory structure in [[ESXi - Passwordless SSH#ESXi to ESXi|ESXi to ESXi]]
 
Assuming you've already created the directory structure in [[ESXi - Passwordless SSH#ESXi to ESXi|ESXi to ESXi]]
  
 
*<code>ssh-keygen -t rsa</code>
 
*<code>ssh-keygen -t rsa</code>
 
*<code>cat ~/.ssh/id_rsa.pub | ssh root@ESXi0 'cat >> /etc/ssh/keys-root/authorized_keys'</code>
 
*<code>cat ~/.ssh/id_rsa.pub | ssh root@ESXi0 'cat >> /etc/ssh/keys-root/authorized_keys'</code>
−
*<code>ssh root@esxi0 "cp /.ssh/* /vmfs/volumes/Admin/Utilities/ssl/ESXi1/keys"</code>
 
 
*<code>ssh root@esxi0 "/sbin/auto-backup.sh"</code>
 
*<code>ssh root@esxi0 "/sbin/auto-backup.sh"</code>
  
Line 98: Line 99:
  
 
===Bonus Thoughts...===
 
===Bonus Thoughts...===
−
I can't see any reason these instructions couldn't be used to provide passwordless SSH to a remote ESXi server with a weird port number for SSH...
+
I can't see any reason these instructions couldn't be used to provide passwordless SSH to a remote ESXi server with a weird port number for SSH... ''('''HINT:'''  Works just fine...)''
  
 
& since SCP runs over SSH...
 
& since SCP runs over SSH...

Latest revision as of 15:58, 27 December 2021

Now on Wiki.NerdMage.Ca

These instructions assume 2 ESXi servers: ESXi0 & ESXi1

Both of these servers have a datastore named Admin for Administrative stuff and a Folder named Utilities for storing useful things.

You will need SSH client enabled in the built-in firewall on your ESXi hosts.

ESXi to ESXi

Source: How to SSH between ESXi 6.0U2 hosts without providing a password

The following 2 sections are basically lists of Copy-Pasta commands for each server.

ESXi0

  • If it doesn't exist yet, create the Utilities folder:
    • mkdir /vmfs/volumes/Admin/Utilities
  • mkdir /vmfs/volumes/Admin/Utilities/ssl
  • mkdir /vmfs/volumes/Admin/Utilities/ssl/ESXi1
  • mkdir /vmfs/volumes/Admin/Utilities/ssl/ESXi1/keys
  • mkdir /.ssh
  • cd /.ssh
  • /usr/lib/vmware/openssh/bin/ssh-keygen -t rsa -b 4096
    • Just accept the defaults
  • cat id_rsa.pub | ssh root@ESXi1 'cat >> /etc/ssh/keys-root/authorized_keys'
  • cp /.ssh/* /vmfs/volumes/Admin/Utilities/ssl/ESXi1/keys
  • vi /etc/rc.local.d/local.sh
mkdir /.ssh
cp /vmfs/volumes/Admin/Utilities/ssl/ESXi1/keys/* /.ssh

ESXi1

  • If it doesn't exist yet, create the Utilities folder:
    • mkdir /vmfs/volumes/Admin/Utilities
  • mkdir /vmfs/volumes/Admin/Utilities/ssl
  • mkdir /vmfs/volumes/Admin/Utilities/ssl/ESXi0
  • mkdir /vmfs/volumes/Admin/Utilities/ssl/ESXi0/keys
  • mkdir /.ssh
  • cd /.ssh
  • /usr/lib/vmware/openssh/bin/ssh-keygen -t rsa -b 4096
    • Just accept the defaults
  • cat id_rsa.pub | ssh root@ESXi0 'cat >> /etc/ssh/keys-root/authorized_keys'
  • cp /.ssh/* /vmfs/volumes/Admin/Utilities/ssl/ESXi0/keys
  • vi /etc/rc.local.d/local.sh
mkdir /.ssh
cp /vmfs/volumes/Admin/Utilities/ssl/ESXi0/keys/* /.ssh

On Both Servers

  • chmod +t /etc/ssh/keys-root/authorized_keys
  • vi /etc/ssh/sshd_config
  • (Ensure the following items are in the file)
PermitRootLogin yes
UsePAM yes
# only use PAM challenge-response (keyboard-interactive)
PasswordAuthentication no
  • /etc/init.d/SSH restart
  • /sbin/auto-backup.sh

At this point, you should be able to SSH from one to the other without needing to enter a password.

Troubleshooting SSH on ESXi

If you get "ssh: connect to host WHATEVER port 22: Connection timed out" when trying to SSH from an ESXi host, double check the configuration of SSH Client in the servers Firewall Rules.

ESXi to Linux

Assuming you've already created your keyes in ESXi to ESXi

  • cat /.ssh/id_rsa.pub | ssh USER@LINUXBOX 'cat >> ~/.ssh/authorized_keys'

It is possible that ~/.ssh does not yet exist on the target machine. If so, you'll need to create it:

  • ssh USER@LINUXBOX 'mkdir ~/.ssh'

Linux to ESXi

Assuming you've already created the directory structure in ESXi to ESXi

  • ssh-keygen -t rsa
  • cat ~/.ssh/id_rsa.pub | ssh root@ESXi0 'cat >> /etc/ssh/keys-root/authorized_keys'
  • ssh root@esxi0 "/sbin/auto-backup.sh"

Linux to Linux

  • ssh-keygen -t rsa
  • cat ~/.ssh/id_rsa.pub | ssh USER@OTHERLINUXBOX 'cat >> ~/.ssh/authorized_keys'

It is possible that ~/.ssh does not yet exist on the target machine. If so, you'll need to create it:

  • ssh USER@OTHERLINUXBOX 'mkdir ~/.ssh'

Bonus Thoughts...

I can't see any reason these instructions couldn't be used to provide passwordless SSH to a remote ESXi server with a weird port number for SSH... (HINT: Works just fine...)

& since SCP runs over SSH...

Could be used for automatically copying backups to/from an offsite server...

hhhmmm...

Retrieved from ‘https://wiki.tinkernet.ca/index.php?title=Passwordless_SSH&oldid=1731’