Passwordless SSH - Revision history

Bart at 20:30, 3 January 2022

2022-01-03T20:30:16Z

← Older revision		Revision as of 16:30, 3 January 2022
Line 98:		Line 98:

	hhhmmm...		hhhmmm...

			[[Category:Linux]]
			[[Category:ESXi]]
			[[Category:LinuxTools]]

Tinker at 21:03, 27 December 2021

2021-12-27T21:03:21Z

@@ Line 1: / Line 1: @@
 These instructions assume 2 ESXi servers: ESXi0 & ESXi1
@@ Line 78: / Line 89: @@
 *<code>cat ~/.ssh/id_rsa.pub {{!}} ssh root@ESXi0 'cat &gt;&gt; /etc/ssh/keys-root/authorized_keys'</code>
 *<code>ssh root@esxi0 "/sbin/auto-backup.sh"</code>
 === Bonus Thoughts... ===

Tinker: /* Linux to ESXi */

2021-12-27T20:56:46Z

Linux to ESXi

← Older revision		Revision as of 16:56, 27 December 2021
Line 73:		Line 73:

	=== Linux to ESXi ===		=== Linux to ESXi ===
	Assuming you've already created the directory structure in [[~~ESXi - Passwordless SSH~~#ESXi to ESXi{{!}}ESXi to ESXi]]		Assuming you've already created the directory structure in [[#ESXi to ESXi{{!}}ESXi to ESXi]]

	*<code>ssh-keygen -t rsa</code>		*<code>ssh-keygen -t rsa</code>

Tinker: /* ESXi to Linux */

2021-12-27T20:56:21Z

ESXi to Linux

← Older revision		Revision as of 16:56, 27 December 2021
Line 65:		Line 65:

	=== ESXi to Linux ===		=== ESXi to Linux ===
	Assuming you've already created your keyes using <code>ssh-keygen</code> in [[~~ESXi - Passwordless SSH~~#ESXi to ESXi{{!}}ESXi to ESXi]]		Assuming you've already created your keyes using <code>ssh-keygen</code> in [[#ESXi to ESXi{{!}}ESXi to ESXi]]

	*<code>cat /.ssh/id_rsa.pub {{!}} ssh USER@LINUXBOX 'cat >> ~/.ssh/authorized_keys'</code>		*<code>cat /.ssh/id_rsa.pub {{!}} ssh USER@LINUXBOX 'cat >> ~/.ssh/authorized_keys'</code>

Tinker: /* ESXi to Linux */

2021-12-27T20:55:31Z

ESXi to Linux

← Older revision		Revision as of 16:55, 27 December 2021
Line 65:		Line 65:

	=== ESXi to Linux ===		=== ESXi to Linux ===
	Assuming you've already created your keyes in [[ESXi - Passwordless SSH#ESXi to ESXi{{!}}ESXi to ESXi]]		Assuming you've already created your keyes using <code>ssh-keygen</code> in [[ESXi - Passwordless SSH#ESXi to ESXi{{!}}ESXi to ESXi]]

	*<code>cat /.ssh/id_rsa.pub {{!}} ssh USER@LINUXBOX 'cat >> ~/.ssh/authorized_keys'</code>		*<code>cat /.ssh/id_rsa.pub {{!}} ssh USER@LINUXBOX 'cat >> ~/.ssh/authorized_keys'</code>

Tinker: Created page with "These instructions assume 2 ESXi servers: ESXi0 & ESXi1 Both of these servers have a datastore named '''Admin''' for Administrative stuff and a Folder named '''Utilities''' for storing useful things. You will need '''SSH client''' enabled in the built-in firewall on your ESXi hosts. *Allowing SSH & SCP between ESXi Hosts SSH Client must be enabled in the ESXi firewall (for the outbound connection) [https://4sysops.com/archives/how-to-open-and-close-firewall-ports-..."

2021-12-27T20:53:22Z

Created page with "These instructions assume 2 ESXi servers: ESXi0 & ESXi1 Both of these servers have a datastore named '''Admin''' for Administrative stuff and a Folder named '''Utilities''' for storing useful things. You will need '''SSH client''' enabled in the built-in firewall on your ESXi hosts. *Allowing SSH & SCP between ESXi Hosts **SSH Client must be enabled in the ESXi firewall (for the outbound connection) **[https://4sysops.com/archives/how-to-open-and-close-firewall-ports-..."

New page

These instructions assume 2 ESXi servers: ESXi0 & ESXi1

Both of these servers have a datastore named '''Admin''' for Administrative stuff and a Folder named '''Utilities''' for storing useful things.

You will need '''SSH client''' enabled in the built-in firewall on your ESXi hosts.

*Allowing SSH & SCP between ESXi Hosts
**SSH Client must be enabled in the ESXi firewall (for the outbound connection)
**[https://4sysops.com/archives/how-to-open-and-close-firewall-ports-on-vmware-esxi-hosts/ How to Open and Close Firewall Ports on vmWare ESXi Hosts]

=== ESXi to ESXi ===
Source: [https://cormachogan.com/2016/04/13/ssh-esxi-hosts-without-providing-password/ How to SSH between ESXi 6.0U2 hosts without providing a password]

The following 2 sections are basically lists of Copy-Pasta commands for each server.

==== ESXi0 ====

*If it doesn't exist yet, create the Utilities folder:
**<code>mkdir /vmfs/volumes/Admin/Utilities</code>
*<code>mkdir /vmfs/volumes/Admin/Utilities/ssl</code>
*<code>mkdir /vmfs/volumes/Admin/Utilities/ssl/ESXi1</code>
*<code>mkdir /vmfs/volumes/Admin/Utilities/ssl/ESXi1/keys</code>
*<code>mkdir /.ssh</code>
*<code>cd /.ssh</code>
*<code>/usr/lib/vmware/openssh/bin/ssh-keygen -t rsa -b 4096</code>
**'''Just accept the defaults'''
*<code>cat id_rsa.pub {{!}} ssh root@ESXi1 'cat >> /etc/ssh/keys-root/authorized_keys'</code>
*<code>cp /.ssh/* /vmfs/volumes/Admin/Utilities/ssl/ESXi1/keys</code>
*<code>vi /etc/rc.local.d/local.sh</code>
mkdir /.ssh
cp /vmfs/volumes/Admin/Utilities/ssl/ESXi1/keys/* /.ssh

==== ESXi1 ====

*If it doesn't exist yet, create the Utilities folder:
**<code>mkdir /vmfs/volumes/Admin/Utilities</code>
*<code>mkdir /vmfs/volumes/Admin/Utilities/ssl</code>
*<code>mkdir /vmfs/volumes/Admin/Utilities/ssl/ESXi0</code>
*<code>mkdir /vmfs/volumes/Admin/Utilities/ssl/ESXi0/keys</code>
*<code>mkdir /.ssh</code>
*<code>cd /.ssh</code>
*<code>/usr/lib/vmware/openssh/bin/ssh-keygen -t rsa -b 4096</code>
**'''Just accept the defaults'''
*<code>cat id_rsa.pub {{!}} ssh root@ESXi0 'cat >> /etc/ssh/keys-root/authorized_keys'</code>
*<code>cp /.ssh/* /vmfs/volumes/Admin/Utilities/ssl/ESXi0/keys</code>
*<code>vi /etc/rc.local.d/local.sh</code>
mkdir /.ssh
cp /vmfs/volumes/Admin/Utilities/ssl/ESXi0/keys/* /.ssh

==== On Both Servers ====

*<code>chmod +t /etc/ssh/keys-root/authorized_keys</code>
*<code>vi /etc/ssh/sshd_config</code>
*(Ensure the following items are in the file)
PermitRootLogin yes
UsePAM yes
# only use PAM challenge-response (keyboard-interactive)
PasswordAuthentication no
*<code>/etc/init.d/SSH restart</code>
*<code>/sbin/auto-backup.sh</code>
At this point, you should be able to SSH from one to the other without needing to enter a password.

==== Troubleshooting SSH on ESXi ====
If you get "ssh: connect to host WHATEVER port 22: Connection timed out" when trying to SSH from an ESXi host, double check the configuration of '''SSH Client''' in the servers '''Firewall Rules'''.

=== ESXi to Linux ===
Assuming you've already created your keyes in [[ESXi - Passwordless SSH#ESXi to ESXi{{!}}ESXi to ESXi]]

*<code>cat /.ssh/id_rsa.pub {{!}} ssh USER@LINUXBOX 'cat >> ~/.ssh/authorized_keys'</code>
It is possible that <code>~/.ssh</code> does not yet exist on the target machine. If so, you'll need to create it:

*<code>ssh USER@LINUXBOX 'mkdir ~/.ssh'</code>

=== Linux to ESXi ===
Assuming you've already created the directory structure in [[ESXi - Passwordless SSH#ESXi to ESXi{{!}}ESXi to ESXi]]

*<code>ssh-keygen -t rsa</code>
*<code>cat ~/.ssh/id_rsa.pub {{!}} ssh root@ESXi0 'cat >> /etc/ssh/keys-root/authorized_keys'</code>
*<code>ssh root@esxi0 "/sbin/auto-backup.sh"</code>

=== Linux to Linux ===

*<code>ssh-keygen -t rsa</code>
*<code>cat ~/.ssh/id_rsa.pub {{!}} ssh USER@OTHERLINUXBOX 'cat >> ~/.ssh/authorized_keys'</code>
It is possible that <code>~/.ssh</code> does not yet exist on the target machine. If so, you'll need to create it:

*<code>ssh USER@OTHERLINUXBOX 'mkdir ~/.ssh'</code>

=== Bonus Thoughts... ===
I can't see any reason these instructions couldn't be used to provide passwordless SSH to a remote ESXi server with a weird port number for SSH... ''('''HINT:''' Works just fine...)''

& since SCP runs over SSH...

Could be used for automatically copying backups to/from an offsite server...

hhhmmm...