0

For the master node to passwordless-ly ssh into the slaves, the master needs to distribute its ssh key to the slaves. Copying key using ssh-copy-id asks for the user password. If there are hundreds of nodes in the system, it may not be a good idea to execute ssh-copy-id command manually for each node. It may be a good idea to run a shell script that runs iteratively through the host list and copies the key into each one of them. But such a script would require the password to be embedded in as plain test for ssh-copy-id to proceed. Will it be a good idea to provide the password in plain text in the script? Or is there a workaround for that?

2
  • 4
    Do you have any automation configured on the slaves like Puppet or Chef? Can you include the public key in your image? Is reimage out of the question? I would recommend against scripting passwords, but the answers to this problem are highly dependent on the specifics of your setup. In the end scripting the passwords isn't the worst thing that you could do. Just make sure file permissions are correct and you take measures to secure the data. It's not ideal, but if someone has access to root on the master, it wouldn't matter anyways. Jul 16, 2014 at 1:45
  • The script will run on the master node only, and password is needed only for the duration of ssh key distribution. So, keep it in secure place with appropriate permissions, then remove password info when finished. Note: recent openSSH releases also comme with a certificate-based authentication (simple CA, not x509 scheme), which may also be interesting to consider (see info in PROTOCOL.certkeys file in openssh package).
    – tonioc
    Jul 16, 2014 at 12:50

0

You must log in to answer this question.

Browse other questions tagged .