![[OpenSSH Logo]](http://static.thegeekstuff.com/wp-content/uploads/2008/05/openssh-300x99.gif "[OpenSSH Logo]")
You can login to a remote Linux server without entering password in 3 simple steps using ssky-keygen and ssh-copy-id as explained in this article.
ssh-keygen creates the public and private keys. ssh-copy-id copies the local-host’s public key to the remote-host’s authorized_keys file. ssh-copy-id also assigns proper permission to the remote-host’s home, ~/.ssh, and ~/.ssh/authorized_keys.
This article also explains 3 minor annoyances of using ssh-copy-id and how to use ssh-copy-id along with ssh-agent.
Step 1: Create public and private keys using ssh-key-gen on local-host
jsmith@local-host$ [Note: You are on local-host here] jsmith@local-host$ ssh-keygen Generating public/private rsa key pair. Enter file in which to save the key (/home/jsmith/.ssh/id_rsa):[Enter key] Enter passphrase (empty for no passphrase): [Press enter key] Enter same passphrase again: [Pess enter key] Your identification has been saved in /home/jsmith/.ssh/id_rsa. Your public key has been saved in /home/jsmith/.ssh/id_rsa.pub. The key fingerprint is: 33:b3:fe:af:95:95:18:11:31:d5:de:96:2f:f2:35:f9 jsmith@local-host
Step 2: Copy the public key to remote-host using ssh-copy-id
jsmith@local-host$ ssh-copy-id -i ~/.ssh/id_rsa.pub remote-host jsmith@remote-host's password: Now try logging into the machine, with "ssh 'remote-host'", and check in: .ssh/authorized_keys to make sure we haven't added extra keys that you weren't expecting.
Note: ssh-copy-id appends the keys to the remote-host’s .ssh/authorized_key.
Step 3: Login to remote-host without entering the password
jsmith@local-host$ ssh remote-host Last login: Sun Nov 16 17:22:33 2008 from 192.168.1.2 [Note: SSH did not ask for password.] jsmith@remote-host$ [Note: You are on remote-host here]
The above 3 simple steps should get the job done in most cases.
We also discussed earlier in detail about performing SSH and SCP from openSSH to openSSH without entering password.
If you are using SSH2, we discussed earlier about performing SSH and SCP without password from SSH2 to SSH2 , from OpenSSH to SSH2 and from SSH2 to OpenSSH.
Using ssh-copy-id along with the ssh-add/ssh-agent
When no value is passed for the option -i and If ~/.ssh/identity.pub is not available, ssh-copy-id will display the following error message.
jsmith@local-host$ ssh-copy-id -i remote-host /usr/bin/ssh-copy-id: ERROR: No identities found
If you have loaded keys to the ssh-agent using the ssh-add, then ssh-copy-id will get the keys from the ssh-agent to copy to the remote-host. i.e, it copies the keys provided by ssh-add -L command to the remote-host, when you don’t pass option -i to the ssh-copy-id.
jsmith@local-host$ ssh-agent $SHELL
jsmith@local-host$ ssh-add -L
The agent has no identities.
jsmith@local-host$ ssh-add
Identity added: /home/jsmith/.ssh/id_rsa (/home/jsmith/.ssh/id_rsa)
jsmith@local-host$ ssh-add -L
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAsJIEILxftj8aSxMa3d8t6JvM79DyBV
aHrtPhTYpq7kIEMUNzApnyxsHpH1tQ/Ow== /home/jsmith/.ssh/id_rsa
jsmith@local-host$ ssh-copy-id -i remote-host
jsmith@remote-host's password:
Now try logging into the machine, with "ssh 'remote-host'", and check in:
.ssh/authorized_keys
to make sure we haven't added extra keys that you weren't expecting.
[Note: This has added the key displayed by ssh-add -L]
Three Minor Annoyances of ssh-copy-id
Following are few minor annoyances of the ssh-copy-id.
- Default public key: ssh-copy-id uses ~/.ssh/identity.pub as the default public key file (i.e when no value is passed to option -i). Instead, I wish it uses id_dsa.pub, or id_rsa.pub, or identity.pub as default keys. i.e If any one of them exist, it should copy that to the remote-host. If two or three of them exist, it should copy identity.pub as default.
- The agent has no identities: When the ssh-agent is running and the ssh-add -L returns “The agent has no identities” (i.e no keys are added to the ssh-agent), the ssh-copy-id will still copy the message “The agent has no identities” to the remote-host’s authorized_keys entry.
- Duplicate entry in authorized_keys: I wish ssh-copy-id validates duplicate entry on the remote-host’s authorized_keys. If you execute ssh-copy-id multiple times on the local-host, it will keep appending the same key on the remote-host’s authorized_keys file without checking for duplicates. Even with duplicate entries everything works as expected. But, I would like to have my authorized_keys file clutter free.
If you like this article, please bookmark it on Delicious and Stumble it.
Linux provides several powerful administrative tools and utilities which will help you to manage your systems effectively. If you don’t know what these tools are and how to use them, you could be spending lot of time trying to perform even the basic administrative tasks. The focus of this course is to help you understand system administration tools, which will help you to become an effective Linux system administrator.Get the Linux Sysadmin Course Now!
If you enjoyed this article, you might also like..
|
|
|
|
My name is Ramesh Natarajan. I will be posting instruction guides, how-to, troubleshooting tips and tricks on Linux, database, hardware, security and web. My focus is to write articles that will either teach you or help you resolve a problem. Read more about
{ 40 comments… read them below or add one }
nice article…
i used to use this ssh-keygen for generating the keys, and copy the keys using scp. But this ssh-copy-id is new…
users feel great about this, when your environment needs to use more than one servers frequently
Hi, I’ve also never heard about ssh-copy-id, great thing. You can also use the “keychain” tool.
Nice article Ramesh.
hi,
Thats strange, i follow all these steps and others step founded in google.
None is worked, ssh still asking me for password.
I use Centos and FC9
@Sathiya,
Yeah, lot of people overlook ssh-copy-id, as you can still copy the keys manually.
@mk_michael,
I believe you are talking about the keychain tool that is mentioned in gentoo.org. I have not used this before. Thanks for bringing this to our attention. I’ll check it out.
@Jadu Saikia,
Thanks for your comments. I appreciate it.
@domainnameyahoo,
You may want to run the ssh in debug mode to identify what could be the problem. Please refer to section 4 in the 5 Basic Linux SSH Client Commands on how to debug ssh client connection.
Geeks,
If ssh-copy-id command not found on your system please use the following method.
#scp ~/.ssh/id_rsa.pub user@remotehost:/home/user/
This will ask you the password of the user you have mentioned
#cat id_rsa.pub >> /home/user/.ssh/authorized_keys
that’s it, you have done it.
when I execute the command
ssh-copy-id -i ~/.ssh/id_rsa.pub ip.ip.ip.ip
I get the following error.
root@ip.ip.ip.ip’s password:
stdin: is not a tty
Please advice
Thanks
Please try with one of the following:
ssh-copy-id -i -t ~/.ssh/id_rsa.pub ip.ip.ip.ip
ssh-copy-id -i -q ~/.ssh/id_rsa.pub ip.ip.ip.ip
ssh-copy-id -i -T ~/.ssh/id_rsa.pub ip.ip.ip.ip
else, use another method,
#scp ~/.ssh/id_rsa.pub user@remotehost:/home/user/
This will ask you the password of the user you have mentioned
#cat id_rsa.pub >> /home/user/.ssh/authorized_keys
Thanks,
Jai
when i tried ssh-copy-id ~/.ssh/id_rsa.pub jaliu@beeeater. i.e user@remote-host. i got an error; ssh: Could not resolve hostname /home/bayeni/.ssh/id_rsa.pub: Name or service not known. please what do i do
I’ve done this before, but wanted a quick reference check. I’d not come across ssh-copy-id. Thanks!
One small typo:
Note: ssh-copy-id appends the keys to the remote-host’s .ssh/authorized_key.
should read
Note: ssh-copy-id appends the keys to the remote-host’s .ssh/authorized_keys.
Notice authorized_key*s* . Thanks for the article!
Verry good post
THanks or this 
i’m french and i’m looking for scp script in order to backup my data everyday 
@hams2
I found this tutorial about doing backups securely with ssh
http://troy.jdmz.net/rsync/index.html
Thank you, it’s good tutorial
Very good instructions. Thank-you.
Thanks, for your help…..
Very nice tutorial! keep it up guys!
I’m a bit confused. It seems you can add your public key to the remote host and grant yourself access. This seems like no security at all. What am I missing?
@Anonymous
You won’t be able to add your public key on a server where you don’t have a valid login/password combination.
And just to add my own geek stuff :
To get a password-less connection from local user1 to remote user2, copy the user1 public key(id_rsa.pub) to the remote user2 “authorized_keys” file using a pipe over ssh:
$ cat /home/user1/.ssh/id_rsa.pub |ssh root@remote_server ‘cat >> /home/user2/.ssh/authorized_keys’
This would do the same job as ssh-copy-id without the 2 out of 3 “weak” points revealed by rameesh.
Geek stuff strikes again. Keep up the great articles.
Neat. This was easy to set up on one of my computers. On the other one, it was a bit more stubborn. For the benefit of someone else who’s bit by it, sshd will not accept an authorized_keys file if either directory ~/.ssh or ~ are writable by Group or Others. The difficult system was PCBSD, in which every user also has their own group and their directory is writable to that group.
Doesn’t work for me. It gives me “Agent admitted failure to sign using the key.” message when I try to log in without password.
+1 Very helpful and very simple
very good
Nice tutorial, adequate security really doesn’t get any easier than this..you gotta love Unix/Linux!
Thanks a lot bro…………
It was very very helpful for me………………..
DO NOT FOLLOW THIS RECIPE NAIVELY – it is very dangerous, since a key with no passphrase is the moral equivalent of dumping your password in a file in the clear. Anyone who gets even momentary access to your private key TOTALLY OWNS any accounts where you’ve installed the public part.
The only way you should use an unencrypted key (no passphrase) is if you can guarantee total and eternal security of the private part. This might be possible, but is highly unlikely. That said, there are just two responsible ways to use keys:
– encrypt the key by providing a passphrase when you generate it. this may seem strange, since to use it, you’ll need to provide the passphrase, which is presumably harder than a password. and *that* is why ssh-agent exists: it lets you supply the passphrase once, not every time. (you can have ssh-agent timeout the passphrase after a fixed time, or keep it as long as its running.)
- constrain the key wherever it’s installed, so that it can only perform some limited function. for instance, if the key’s purpose is to permit something unattended like a backup, use openssh’s “command=” syntax so that the key can only be used for that, not to get a shell or tunnel through firewalls. (“man sshd” to see the syntax for the .authorized_keys file – constraining a key to particular client machines is also a good idea, etc.)
Does typing only ssh-keygen generates keys or shall we should also mention the key type , i mean rsa……….. because when i entered ssh-keygen its asking for the keytype with -t option
Please point out very obviously in the original post that step 1 may have been done already and if so only step 2 may be needed!
There’s a step still missing. I’ve done all the steps and I’m still prompted to enter a password… I believe there is a KEON change that needs to happen as well. Also, the public key is using the short name for the host, but you need to use the full qualified name to ssh, scp, or sftp. So,… how do we get the ssh-keygen to allow for use to type in a server name….
The tutorial works for me if I do it as root but that creates a security hole. When a create a user ‘user_ssh’ and follow the intructions, it seems to work but when I do
an ‘ssh hostname’ it asks me for:
Enter passphrase for key ‘/home/user_rsync/.ssh/id_rsa’:
Why does it not work ad a regular user?
Update: OK I got it to work by adding quotes on the “ssh” statement. See my cron below:
———————
#!/bin/sh
# the line below works for root
#rsync -av –progress –stats –exclude “*.LCK” -e ssh user_rsync@remotehost:/home/www/ /home/www
# the line below works for none root user
rsync -av –progress –stats –exclude “*.LCK” -e “ssh -i /home/user_rsync/.ssh/id_rsa.pub user_rsync@remotehost:/home/www/” /home/www
One thing that worries me now is that before when the user was root the report creared only show and overall of totals when no files were transfered but now that I am doing the rsync as a regular user the email I get has a list of all the files even if no files were transfer. I hope some one is reading this…………..
Please do note Patrick’s comment:
“sshd will NOT ACCEPT an authorized_keys file if either directory ~/.ssh or ~ are writable by Group or Others”
SSH would still ask for a password.
This solved my problem.
Remove a user from a group:
‘sudo gpasswd -d user-to-remove group’
Nice article. Easy to follow and understand.
when i used
jsmith@local-host$ ssh-copy-id -i ~/.ssh/id_rsa.pub remote-host
error no remote host.is it possible to create 2 host in single machine.please tell me the process.how to overcome that error.
Hi
I did the exact step but it still ask for the password.
Please tell me where i am going wrong.
Regards
Abyakta
Very Useful Steps. I just used and it worked quite well.. Thanks!
Finally you solved my problem! Thanks
I followed that three steps. but, knows hosts files does not exists in .ssh/ directory again it asks password from the user. what i have to do.
Thanks & Regards
Dhandayuthabani
I can make this work by typing the command into terminal, and by running the shell script it is inside, but it will not run through the remote control I’m using (to keep a media center mythtv backend from shutting down by sending a lock command) It lists a failed password
Any ideas?
Thanks