Considerations for configuring ssh password-less logon in CentOS

This article describes the precautions for configuring ssh password-less logon in CentOS.

Prerequisites: use root to log on and modify the configuration file:/Etc/ssh/sshd_configRemove the comments of the three rows, as shown below:

Then restart the ssh service: service sshd restart. Finally exit root,All of the following operations are performed under the hadoop User:.

The host information is as follows:

For example, the current login user is hadoop and the host name is slave. hadoop. The network with the master. hadoop host is smooth.

If RSA verification is not configured, you need to enter a password to connect to the host through ssh, as shown below:

For example, after executing ssh master. hadoop, the system will wait for the user to enter the logon password of the hadoop user on the master. hadoop host in the next line.

To avoid this situation, perform the following operations to enable the host to log on after automatic authentication during ssh connection.

First, execute the commandSsh-keygen-t dsaGenerate a key pair as follows:

 

For example, the key file is generated in the hidden directory. ssh in the main directory/home/hadoop according to the default method.Id_dsaAndId_dsa.pubThe latter is the public key, for example:

Based on the value of AuthorizedKeysFile in the configuration file/etc/ssh/sshd_config:. Ssh/authorized_keys, The public key must be imported to the file for verification, as shown below:

This is only one step away from success. By default, the new file permission of CentOS is-rw-r --, that is, you and group users can rewrite the file, which is considered unsafe. For example, because no authorized_keys file exists on my host, the default permission for this file is-rw-r because the file is created in the redirection output. Remove the w permission from the group. You can run the following command:Chmod 644 authorized_keys. All online materials are directChmod 600 authorized_keysThat is, the group and other users do not have the permission to read the file content. of course, this is the safest way, but the system only requires that all users except itself cannot change the file.

For example, slave. hadoop can use ssh without a password to log on to the local machine. So how can I log on to the Master. hadoop host without a password? Of course, the public key file id_dsa.pub is distributed to the master. hadoop host. For example:

For example, run the commandCat ~ /. Ssh/id_dsa.pub | ssh hadoop@master.hadoop 'cat-> ~ /. Ssh/authorized_keys'And enter the logon password of the hadoop user on the master. hadoop host to send the public key to master. hadoop and append it to the authorized_keys file.

For example, you can log on to the host master. hadoop using ssh without a password on the slave. hadoop host.