SSH-Keys
SSH - Keys
This is meant to be a step-by-step guide for getting password-less login to work as for example required by the Torque scheduling system.
* Generate your SSH - Key on a machine at the observatory:
ssh-keygen -t dsa (press return at the questions) ssh-keygen -t rsa (press return at the questions)
* Copy public key to authorized_keys:
cd ~/.ssh cat *.pub >> authorized_keys
* On an observatory computer:
cd ~/.ssh scp *.pub machine.you.want.to.login:~/.ssh/
* On all machines external to the observatory you want to log onto (e.g., pulsar):
ssh machine.you.want.to.login mkdir .ssh cd .ssh cat ../*.pub >> authorized_keys
* Alternatively, the following command is equivalent to the manual copying above
ssh-copy-id -i ~/.ssh/*.pub user@machine.you.want.to.login
* NOTE: your private key has to be unreadable for other users. You can check this via
hans@blub:~> ls -al ~/.ssh drwx------ 2 hans remeis 4096 2011-02-17 22:28 . drwxr-xr-x 66 hans remeis 12288 2011-05-19 10:52 .. -rw------- 1 hans remeis 787 2010-10-19 16:47 authorized_keys -rw------- 1 hans remeis 1743 2010-10-18 08:34 id_rsa -rw-r--r-- 1 hans remeis 393 2010-10-18 08:34 id_rsa.pub -rw-r--r-- 1 hans remeis 50952 2011-05-17 17:18 known_hosts
* If the permission are not set correctly, they can be changed by
chmod 700 ~/.ssh chmod 600 ~/.ssh/id_rsa chmod 600 ~/.ssh/authorized_keys
Quick-'n'-dirty way
Script to log in from a@A to b@B without typing passwords, type this into a@A terminal at location ~/:
ssh-keygen -t rsa ssh b@B mkdir -p .ssh (not necessary if exists) cat .ssh/id_rsa.pub | ssh b@B 'cat >> .ssh/authorized_keys'
SSH aliases
A very helpful thing is creating aliases for the ssh access. This is done by following lines of code:
* Create ssh aliases to just type > machine instead of > username@machine.sternwarte.uni-erlangen.de: * Add this to your .ssh/config file (create if not present)
Host nickname
User username
HostName machine.sternwarte.uni-erlangen.de
(IdentityFile ~/.ssh/id_rsa)
sshfs
If you work at the observatory via the internet and are tired of scp-ing all your stuff over to your local computer or want to speed up opening things like pdf files by using your local resources, there is a very nice solution: you can mount the folder you work in at the remote computer on your local computer via sshfs (you may need to install that program on your machine first with apt-get install sshfs).
sshfs user@machine.you.want.to.login:/folder/you/want/to/access /path/on/your/local/machine
/path/on/your/local/machine needs to be an existing directory, best an empty one. Be careful, everything you change in this directory will also change on the server.
Unmount again via
fusermount -u /path/on/your/local/machine
VPN via SSH
If you are in a restrictive network that blocks SSH and VPN tunnels, but you need to get to the Remeis cluster or the University network, here is what you can do:
To open an individual SSH session via port 80:
ssh -p80 user@carina.sternwarte.uni-erlangen.de
To set up an SSH-based VPN tunnel:
Note that, as for 'normal' VPN, you will need to have root privileges, i.e., you'll probably only be able to use the VPN tunnel from your personal machine. First make sure that password-less login via SSH keys works (see above) and sshuttle is installed or install it (apt-get install sshuttle). Then open a tunnel with the command
sshuttle -r user@carina.sternwarte.uni-erlangen.de:80 0.0.0.0/0 -vv
You will be prompted to enter your local sudo password. This command only seems to work if your login shell at Remeis is bash. For tcsh, you'll likely see an error message like
P=python2: Command not found. P: Undefined variable c : fatal: server died with error
although python is installed on carina. If you see this error try
sshuttle -r user@carina.sternwarte.uni-erlangen.de:80 0.0.0.0/0 -vv --python=/usr/bin/python
You can avoid typing this command by setting up an (executable) script and call the script instead:
#!/bin/bash
if [ `whoami` != root ]; then
echo "NOT RUNNING UNDER ROOT"
echo "SUDOing now"
echo $0 $1 $2 $3 $4
sudo $0 $1 $2 $3 $4
exit
fi
/usr/sbin/sshuttle -r user@carina.sternwarte.uni-erlangen.de:80 0.0.0.0/0 -vv --python=/usr/bin/python