2

I am writing a tutorial on setting up Ceph the hard way, shell all the way.

I am not happy with the number of ssh commands it takes to connect to a remote host as root, create new user, then scp keys over... there must be a smarter, simpler way - especially on Ubuntu.

Here is the exact problem: local user FOO that has access to remote server with user ROOT needs to setup keys (and possibly the user as well) for user CEPH. Repeat n times with n remote hosts.

Any clever one-liners I am missing?

current steps:

scp -i digitalocean id_rsa.pub storage-1:/root
ssh -i digitalocean storage-1
useradd ceph
mkdir ~ceph/.ssh
cat id_rsa.pub >> ~ceph/.ssh/authorized_keys
chmod 700 ~ceph/.ssh
chmod 600 ~ceph/.ssh/authorized_keys 
chown ceph:ceph ~ceph/.ssh/authorized_keys 
chown ceph:ceph ~ceph/.ssh/
rm id_rsa.pub
0xF2
  • 3,154
  • What prevents you from doing all that in one SSH command? Or saving all that to a script, scp'ing that to the server (one command) and launching it with ssh (second command)? What commands do you run atm? – muru Apr 03 '15 at 23:26
  • Since it is a tutorial, I would still have to have the user read, type-up the script, which is a sequence of mkdir/chown/chmod/scp/chown/chmod. I can detail the actual steps once I am back home. – 0xF2 Apr 04 '15 at 16:33
  • You could edit your question, you know. – muru Apr 05 '15 at 18:19
  • ssh-copy-id looks promising, after the user is setup. http://linux.die.net/man/1/ssh-copy-id – 0xF2 Apr 14 '15 at 16:11

4 Answers4

3

Part of your problem lies in the creation of .ssh. What I'd do use use ssh-keygen, which will create it if doesn't exist and set permissions properly (and, of course, create a key pair for the user).

$ scp -i digitalocean id_rsa.pub storage-1:/tmp
$ ssh digitalocean storage-1 '
adduser --gecos "" --disabled-password  ceph
echo | sudo -u ceph ssh-keygen  -N "" -f ~ceph/.ssh/id_rsa 
sudo -u cp /tmp/id_rsa.pub ~ceph/.ssh/authorized_keys
'

Notes:

  • use adduser instead of useradd - it creates a skeleton home directory, from /etc/skel.
  • --gecos "" and --disabled-password are used to avoid prompting. If you don't mind prompts for name and password, you skip these options.
  • ssh-keygen can create .ssh with the right permissions
  • Again, -N "" and -f ~ceph/.ssh/id_rsa are used to avoid prompts. You can skip these if you don't mind prompts for the key location (for which the default is fine) and if you wish to set a passphrase.
  • Neither .ssh nor .ssh/authorized_keys need to have 700 as the mode. As long as only the owner can write to them, it's fine (755 for .ssh and 644 for .ssh/authorized_keys is just fine).
muru
  • 197,895
  • 55
  • 485
  • 740
1

Because this is Digital Ocean, the problem can be addressed by setting userdata as part of the initial cloud instance bootup - the following will create a ceph user, put it in the sudoers group, and configure the SSH keys required to provide log in.

#cloud-config
users:
  - name: ceph
    groups: sudo
    shell: /bin/bash
    sudo: ['ALL=(ALL) NOPASSWD:ALL']
    ssh-authorized-keys:
      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDf0q4PyG0doiBQYV7OlOxbRjle026hJPBWD+eKHWuVXIpAiQlSElEBqQn0pOqNJZ3IBCvSLnrdZTUph4czNC4885AArS9NkyM7lK27Oo8RV888jWc8hsx4CD2uNfkuHL+NI5xPB/QT3Um2Zi7GRkIwIgNPN5uqUtXvjgA+i1CS0Ku4ld8vndXvr504jV9BMQoZrXEST3YlriOb8Wf7hYqphVMpF3b+8df96Pxsj0+iZqayS9wFcL8ITPApHi0yVwS8TjxEtI3FDpCbf7Y/DmTGOv49+AWBkFhS2ZwwGTX65L61PDlTSAzL+rPFmHaQBHnsli8U9N6E4XHDEOjbSMRX f2@digitalocean

I still believe there should be a smart way to do this not involving the cloud fabric.

0xF2
  • 3,154
0

I found a more generic solution by modifying the answer to this question to accomplish this while logging in as another user:

 cat ~/.ssh/id_rsa.pub | ssh root@storage-1 'useradd ceph; umask 0077; mkdir -p ~ceph/.ssh; cat >> ~ceph/.ssh/authorized_keys && echo "Key copied"'
Community
  • 1
0xF2
  • 3,154
0

You can use ssh-copy-id to transfer your SSH key to a remote host.

Example:

mallard@steamroller:~$ ssh-copy-id mallard@puter
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'mallard@puter'"
and check to make sure that only the key(s) you wanted were added.

It automatically creates directories (such as .ssh) and sets them to the correct permissions.

Matthew Smith
  • 206
  • 2
  • 8
  • Yep. The issue in this case is that the user on the target machine that the key needs adding to is not there yet... found a one-line solution modifying someone else's clever shell-fu with a nice stdout redirect, below. – 0xF2 Aug 28 '16 at 15:23