Setting up SSH Key securely for SCP/rsync to run without password

Question

This is how I am currently doing it:

# ssh-keygen -t dsa -b 1024 -f /root/localhost-rsnapshot-key

Enter passphrase (empty for no passphrase): [press enter here]
Enter same passphrase again: [press enter here]

# if [ ! -d ~/.ssh ]; then mkdir ~/.ssh ; chmod 700 ~/.ssh ; fi
# cd ~/.ssh/
# if [ ! -f config ]; then touch config ; chmod 600 config ; fi
# echo Host server2 >> config
# echo Hostname server2.domain.tld >> config
# echo IdentityFile /root/localhost-rsnapshot-key >> config

Now when I run rsnapshop like:

backup  [email protected]:/home/     localhost/server2/

I get the following:

rsnapshot hourly
reverse mapping checking getaddrinfo for server2-domain-tld.1-2-3-4 [1.2.3.4] failed - POSSIBLE BREAK-IN ATTEMPT!
[email protected]'s password:

Is there a way to make this run without a password?

Answer 1

You can run the command ssh-copy-id [email protected] from server1 to copy your identity file to the remote system and allow pubkey authentication. You may also need to make sure key-based authentication is enabled in your sshd config.

Answer 2

On server2, you need to add the generated public key to /root/.ssh/authorized_keys

Answer 3

Assuming you want to authenticate into a shell account named 'server2' on a host named 'server2', you need to add the contents of localhost-rsnapshot-key.pub generated on server1 to the server2:/home/server2/.ssh/authorized_keys file.

Answer 4

First off, please consider using rsa keys instead of dsa although I know this is unsolicited advice, rsa is more secure than dsa, unless of course you have a compelling reason to do so.

Let me start by saying I will do this using standart unix command like scp, cat, chmod, chown and such instead of using more esoteric commands, likes of ssh-copy-id. So that you can use it on pretty much any Unix flavor, not only Linux.

Getting these out of the way after running the ssh-keygen command, you have two files in your .ssh directory:

id_dsa
id_dsa.pub

# on the local machine which will connect the remote server without a password

cd ${HOME}/.ssh
scp id_dsa.pub ${REMOTE_SERVER}:${REMOTE_USER_HOME}/.ssh
# if this errors out, you might need to create the .ssh on the remote server
#


# on the remote machine which will accept incoming ssh connection without a password
chown ${REMOTE_USER} ${REMOTE_USER_HOME}  # this should already be set like this
chown ${REMOTE_USER} ${REMOTE_USER_HOME}/.ssh # if this exists, it should be this way

chmod 700 ${REMOTE_USER_HOME}
chmod 700 ${REMOTE_USER_HOME}/.ssh

cd ${REMOTE_USER_HOME}/.ssh
cat id_dsa.pub >> ./authorized_keys
chown ${REMOTE_USER} ./authorized_keys
chmod 600 ./authorized_keys

Now, you should be able to connect to the remote machine without a password.

hope this helps.

Answer 5

Though it's already explained up in above few answers, but if you looking for more details, you can refer to this article.

Password-Less Login