SSH authentication using RSA for uid=0

[Bill_Ng]

All,

I'm trying to write a bash script to run from my management station to connect to the gateways via ssh. I would like to utilize the login without password prompting. I followed sk95890 - How to configure SSH authentication on Gaia OS using RSA key files , but the problem is that the user cannot type in any GAIA commands. I then tried changing the uid of the user to uid=0, but that broke the authentication piece of it and I have to type in passwords. Anyone know of a way this can be accomplished with uid=0 account?

I apologize in advance if this is a double post from the day before.

Thanks in advance,

Bill

[PhoneBoy]

Generally when you call ssh from a script, it's done in non-interactive mode, meaning you cannot interactively enter commands.

Can you share with us the relevant script fragment?

[Bill_Ng]

Hi Dameon,

I'm trying to use 'ssh -i /home/user1/.ssh/id_rsa 10.10.10.10 fw ver'.  user1 was created within the GAIA portal with uid=0.  The problem is that I can't get user1 to use the id_rsa file correctly to authenticate to the gateway.  It still prompts me for a password.  I noticed that when I created the rsa key it actually put it in /home/admin/.ssh.  If I changed the uid to 103 or something else I can use the id_rsa fine, but I can't fun the GAIA commands like 'fw ver, cphaprob stat' and others.

Hope that makes sense.  Let me know if you need more info.

Thanks

[PhoneBoy]

What error do you get with that SSH command?

I suspect the issue is that the environment variables aren't getting set correctly for this other user.

[Bill_Ng]

I'm not getting an error per se. It's still prompting me for password to sign when I run that command from my management station to the gateway.

[Bill_Ng]

More info.

I was able to get the default 'admin' to authenticate to the gateway with rsa key.  The shell for 'admin' is /etc/cli.sh.  I want to keep the admin in clish.  So I created an admin-like user from the portal named 'user1' and changed the shell for that account to /bin/bash.  I followed all the same steps I did with the default 'admin' account.  I noticed when 'ssh-keygen' for the user1 account it by default wants to write it to /home/admin/.ssh not /home/user1/.ssh.  I did change the location to /home/user1/.ssh/ and named the file user1_rsa.  It created user1_rsa and user1_rsa.pub. and at the end of the file it puts in admin@managementservername and not user1@managementservername.  

[JozkoMrkvicka]

just put content of rsa key from /home/admin/.ssh into ".ssh/authorized_keys" under user where you are running script and execute ssh like this:

ssh my_test_user@ip_address

On remote host you need to have created user "my_test_user", create hidden folder .ssh under /home/my_test_user/,  create file "authorized_keys" in that folder and put rsa key already generated.

[Maarten_Sjouw]

Then the other question is why would you want to run a SSH session from management to the GW? Why not use cprid to execute a script on the GW?

[JozkoMrkvicka]

yep, the best option.

more info (including script) here.

[Bill_Ng]

Hi Jozko,

Thanks.  That did the trick for SSH.  It works now with the other ID.

Hi Maarten/Jozko,

I never knew of or have used 'cprid_util'.  In looking at link it looks like it will do the trick as well if not better using SIC.  I'll start playing around with cprid_util as well.  I was a little leary in trying to make ssh work.

Thank you both so much for pointing me in the right direction.

Bill