Linux: SSH keys

[GT1999]

Does anyone know how to setup two servers to be able to have ssh keys from each other setup as trusted between the two?

This would be so they can scp backup files (.tar) between each other.

Thanks in advance if anyone can be of ANY help. 🙂

 

[kamper]

man ssh-keygen should tell you what you need to know. I think the -t option is the only one you need.

There's also the question of whether or not you want to leave the private key unencrypted on the client machine. If not, then you'll have to look into using ssh-agent to supply the keys to your scripts.

 

[GT1999]

This is just for the public keys from what I understand, not private. I'll use the man page and get back to here if I'm still unsuccessful.

 

[kamper]

A public key is pretty useless without a corresponding private key 😉

 

[silverpig]

copy the key into ~.ssh/known_hosts

edit: kamper was right... it's authorized_keys. I was about to type it but had a brain fart.

 

[kamper]

Hmm, I might not have read your last post correctly. I thought you meant that you only wanted to deal with the public keys, but now I'm thinking that you meant that you thought that the man page only dealt with public keys.

Here's a slightly more complete description of the process so that you know how to look at it:
-on the client:
-run ssh-keygen -t rsa
-answer the questions and it'll make ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub
-id_rsa is the private key. Permissions will already be set properly but (especially if you used a blank passphrase) it must never be readable by anyone but you
-id_rsa.pub is the corresponding public key
-copy it to the server and append it to ~/.ssh/authorized_keys (on a new line). Doesn't matter who can read it, as long as only you can write it.

Now, when you ssh from the client to the server (or sftp or scp), it should just go without any prompting, unless you chose a non-blank passphrase, in which case you'll be prompted for it every time. The reason you want this is that root on the client machine can always read your private key so, if that's not you, you'll want it encrypted. To make that work with scripts, you start ssh-agent and tell it the passphrase. It then runs in the background and puts a pipe in /tmp that ssh/sftp/scp talk to to get the private key while running from within the script. So root can still grab your key via the pipe, but only so long as you have ssh-agent running.

 

[GT1999]

Thank you kamper! I've posted on google groups also without too much luck, but your reply was very informative.

Thanks!