Passwordless SSH Deployment Guide#

The following instructions are for configuring a user account to use passwordless SSH when IdM is used. The instructions can be performed on any user accessible system (User or Compute) after the user account and home directory have been created.

This guide can be incorporated into new user accounts process and only needs to be executed once by the user.

Prerequisites#

This guide is written for a Red Hat Enterprise Linux 8 based operating system which is operating within a cluster of systems and the following are the prerequisites:

References#

Information on Passwordless SSH when using IdM/FreeIPA account management:
https://freeipa.readthedocs.io/en/latest/workshop/10-ssh-key-management.html

A portion of these instructions are based on the following documentation:
https://kifarunix.com/add-freeipa-user-accounts-via-cli-or-web-interface/

Deployment Scripts#

An example bash script of the instructions has been provided: deploy-passwordless-ssh.sh

Deployment Steps#

Important

Instructions are to be executed by the user from their NFS mounted home directory.

Important

“PubkeyAuthentication” must be enabled in /etc/ssh/sshd_config for passwordless SSH to operate. Deploying the IdM Client will enable this feature.

Important

Passwordless SSH can only be configured after the user logs in for the first time and changes their password.

Important

In order for the Slurm job scheduler to work correctly, passwordless ssh must use empty passphrases.

  1. Generate public/private RSA key pair:

ssh-keygen -t rsa -b 4096 -N "" -f ~/.ssh/id_rsa

  1. Copy Public key to Authorized Keys:

cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

  1. Disable Strict Host Key Checking:

cat >> ~/.ssh/config <<EOL
StrictHostKeyChecking no
EOL

  1. Ensure proper permissions on files:

chmod 644 ~/.ssh/authorized_keys
chmod 644 ~/.ssh/config
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub
touch     ~/.ssh/known_hosts
chmod 644 ~/.ssh/known_hosts
chmod 700 ~/.ssh

  1. Upload Public Key to IdM / FreeIPA

ipa user-mod ${USER} --sshpubkey="$(cat ~/.ssh/id_rsa.pub)"