Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am installing 20 servers.

On each, with a specific user I created a dsa key.

I did cat key.pub from each server onto ~/.ssh/authorized_keys of the first server

I verified all servers can log in without password to the first server.

Using puppet, I copied the .ssh/authorized_key from the first server to all the other servers.

Permissions are the same, 600

I can't log in automatically; it still works from the servers to the first - but not to any other. I log in as the user, ssh to the other servers - and it asks me for password.

I restarted sshd service, but to no avail. /etc/ssh/sshd_config is the same on the first server and all the others.

This is RHEL6.

Any ideas? Did I do something wrong?

This is the puppet file; it works now -- i had the root as 775

file {"/home/user":
    owner   => user,
    group   => user,
    ensure  => directory,
    mode    => 755,
}

file {"/home/user/.ssh":
    owner   => user,
    group   => user,
    ensure  => directory,
    mode    => 700,
}

file {"/home/user/.ssh/authorized_keys":
    owner   => user,
    group   => user,
    ensure  => file,
    mode    => 600,
    source => "puppet://puppet/files/user_sshkeys.txt";
}
share|improve this question
1  
What do the logs say on the servers where you can't log in? Is the authorized_key file owned by the right owner? Are the permissions on the .ssh directory correct as well as those on the file? –  Jenny D Jul 21 '12 at 9:12

3 Answers 3

up vote 2 down vote accepted

The permissions of the ~/.ssh directory should be 700. The permissions of the ~/.ssh/authorized_keys file should be 600. You probably want to limit write permission on the user's home directory to the user.

chmod go-w ~/
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Instead of using cat, try the ssh-copy-id command, as it takes care of these permissions.

Can you show us what your Puppet file directives look like? This can probably be corrected there.

share|improve this answer
    
added the relevant puppet manifest to the original question. It works now! thanks! –  mik Jul 23 '12 at 18:28

What you are trying to setup is called "Host Based Authentication". Do web search for this and you will find what you need. It's an advanced SSH topic, that is easy to do, once you have done it.

share|improve this answer

Puppet (as I write this, version 3.1.1) has a type called ssh_authorized_key. Using this you can simply push your key out to your machine(s) and it will take care of permissions and such for you.

Here is what I have in my config:

ssh_authorized_key { 'root pub key':
    ensure  => present,
    key     => "yourkeyhere",
    name    => "name@server",
    user    => "user",
    type    => "ssh-rsa",

You can view the relevant documentation here.

Otherwise there are modules that have been written by others that do much the same thing but give some additional options since there are a few limitations with what the ssh_authorized_key type does.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.