On Wed, Jul 06, 2005 at 05:31:37PM -0400, Stephen R Laniel wrote:
> On Wed, Jul 06, 2005 at 03:44:13PM -0400, linux starved wrote:
> > information. The following is basically what I want the script to do,
> > but I heard scp will not work with authentication. I also read about
> > rsync and tried to get the following one liner to work on the source
> > server
>
> To get scp working without prompting you for a password, do
> as follows:
>
> (Supposing that you're scp'ing files from machine A to
> machine B, and that your username is the same on both A and
> B.)
>
> 1) run 'ssh-keygen -t dsa' on machine A. This will generate
> an SSH key of the appropriate type. It will ask you if you
> want a passphrase; press enter to use a blank passphrase.
It's also possible (and more secure) to use a non-blank ssh passphrase in
automated jobs. The ssh-agent program makes this possible by maintaining
the descrypted key in memory, accessed through a named pipe or socket
which is identified in some environment variables. You need to enter
the passphrase (using ssh-add) one time after the machine (B?) boots up,
but thereafter automated connections can work.
The keychain package automates some of this, managing the ssh-agent.
>From keychain(1):
When keychain is run, it checks for a running ssh-agent,
otherwise it starts one. It saves the ssh-agent environment
variables to ~/.key- chain/${HOSTNAME}-sh, so that subsequent
logins and non-interactive shells such as cron jobs can source
the file and make passwordless ssh connections. In addition,
when keychain runs, it verifies that the key files specified on
the command-line are known to ssh-agent, otherwise it loads them,
prompting you for a password if necessary.
When ssh (used by scp) runs, it looks for these environment variables,
SSH_AUTH_SOCK and SSH_AGENT_PID, and uses them to authorize the connection.
One way to make these variables known to a script is to source them in a
wrapper script, which can then be run in a cron job. The rsnapshot package
uses rsync and ssh, and I use the following wrapper:
[EMAIL PROTECTED]:~ $ cat /usr/local/bin/rsnapshot
#!/bin/sh
source /home/ken/.keychain/sangay-sh
# for some reason I installed rsnapshot from tarball, not .deb ...
/usr/local/bin/rsnapshot.original $*
It took me a while to figure this out, and just figued I ought to pass
it along in the context of this thread.
Ken
> Accept any other defaults presented to you.
>
> 2) You will now have a directory ~/.ssh . In there will be
> two files (at least): id_dsa and id_dsa.pub. The latter is a
> public key, the former a private key.
>
> 3) Copy id_dsa.pub to machine B. To do so, type
>
> scp ~/.ssh/id_dsa.pub [machine B's name]:
>
> Note the trailing ':'.
>
> 4) Connect to machine B:
>
> ssh [machine B's name]
>
> 5) Put the contents of the public key (id_dsa.pub) in
> ~/.ssh/authorized_keys on machine B:
>
> cat ~/id_dsa.pub >> ~/.ssh/authorized_keys
>
> Note that ~/.ssh may not exist yet on machine B. If it
> doesn't, you'll get an error from that last command, and
> you'll need to create a new directory --
>
> mkdir ~/.ssh
>
> -- first.
>
> --
> Stephen R. Laniel
> [EMAIL PROTECTED]
> +(617) 308-5571
> http://laniels.org/
> PGP key: http://laniels.org/slaniel.key
--
Ken Irving, Research Analyst, [EMAIL PROTECTED], 907-474-6152
Water and Environmental Research Center
Institute of Northern Engineering
University of Alaska, Fairbanks
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
