[one-users] Passwordless ssh between VM's?
biro lehel
lehel.biro at yahoo.com
Fri Mar 23 00:01:49 PDT 2012
Sorry, I missed a reference in the previous one. Completed below.
--- On Fri, 3/23/12, biro lehel <lehel.biro at yahoo.com> wrote:
From: biro lehel <lehel.biro at yahoo.com>
Subject: Re: [one-users] Passwordless ssh between VM's?
To: "Poul Kristensen" <bcc5226 at gmail.com>, "Olivier Sallou" <olivier.sallou at irisa.fr>
Cc: users at lists.opennebula.org
Date: Friday, March 23, 2012, 8:49 AM
Hello,
Thank you both Poul and Olivier for your answers. Poul, regarding my environment: it is small-scale experimental environment (up to ~10 VM's), NOT a production one. For experimental and test cases, should I go with the solution written by Olivier, or is it still more easier and convenient to use Kerberos? I would like to choose the most easily implementable solution here, since I'm a bit running out of time.
Regarding Olivier's solution.. as I understand, it's basically the same than the method for obtaining passwordless ssh between the physical nodes, described at [1]. My question is, what is the difference
(if any) between setting up pwdless ssh between the physical machines, and setting up pwdless ssh between the VM's? Also, Olivier, you have mentioned this:
>At boot
time you load the ssh key for a file set in CONTEXT
template, with a key
>dedicated per user. Or, still at boot time, you
trigger a server (you made) to get a SSH
>key from the VM ip.
I'm not exactly sure what these mean. Could you or anyone else please detail what to do to obtain these boot-time settings?
[1] http://opennebula.org/documentation:rel3.2:ssh_auth
Thank you,
Lehel.
--- On Thu, 3/22/12, Poul Kristensen <bcc5226 at gmail.com> wrote:
From: Poul Kristensen <bcc5226 at gmail.com>
Subject: Re: [one-users] Passwordless ssh between VM's?
To: users at lists.opennebula.org
Date: Thursday, March 22, 2012, 12:40 PM
Setup a Kerberos server and use tickets. You do not need to arrange private/public keys on every server (host/vm's).
2012/3/22 Olivier Sallou <olivier.sallou at irisa.fr>
Le 3/22/12 6:53 AM, biro lehel a écrit :
Hello everyone,
I'm looking for the most convenient setting to be able to
passwordlessly ssh between the VM's created by OpenNebula.
I've noticed that the settings which provide passwordless
ssh from the Front-end (or Hosts) into VM's do not deal
with this, the system is still asking for a password if I
want to ssh from VM into VM. So, did I do something wrong,
and in theory, the exact same steps would need to be
followed in case of VM's too, or is there some trick?
To enable password less communication between VMs you need top
create a SSH key for a user (root?) that will be in all you VMs.
You should also disable in ssh_config the know_hosts feature (or
redirect it to /dev/null).
For SSH there are multiple means. You create a VM with a SSH key
inside, the drawback is the SSH key is the same for all VMs e.g. all
users, this is not secure but for test only it would fit.
At boot time you load the ssh key for a file set in CONTEXT
template, with a key dedicated per user. Or, still at boot time, you
trigger a server (you made) to get a SSH key from the VM ip.
Olivier
Thank you,
Lehel.
_______________________________________________
Users mailing list
Users at lists.opennebula.org
http://lists.opennebula.org/listinfo.cgi/users-opennebula.org
--
Olivier Sallou
IRISA / University of Rennes 1
Campus de Beaulieu, 35000 RENNES - FRANCE
Tel: 02.99.84.71.95
gpg key id: 4096R/326D8438 (keyring.debian.org)
Key fingerprint = 5FB4 6F83 D3B9 5204 6335 D26D 78DC 68DB 326D 8438
_______________________________________________
Users mailing list
Users at lists.opennebula.org
http://lists.opennebula.org/listinfo.cgi/users-opennebula.org
-----Inline Attachment Follows-----
_______________________________________________
Users mailing list
Users at lists.opennebula.org
http://lists.opennebula.org/listinfo.cgi/users-opennebula.org
-----Inline Attachment Follows-----
_______________________________________________
Users mailing list
Users at lists.opennebula.org
http://lists.opennebula.org/listinfo.cgi/users-opennebula.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opennebula.org/pipermail/users-opennebula.org/attachments/20120323/7deaf323/attachment-0002.htm>
More information about the Users
mailing list