To allow access across Unix hosts without entering a password, infx uses SSH with public keys for authentication. Being able to access the host without a password is essential to remote administration of that host through infx.
Using SSH, you first generate a key, which has a private part and a public part. You set up the remote host with your public key. Then, when you login, SSH uses the keys to authenticate, without the need to enter a password.
The first time you connect using SSH, it generates a key for that host. The key will be re-compared every time you connect to that host. This prevents another host from "masquerading" as that host, but means the key needs to be regenerated when the host details change. For example, host name or IP address changes require the keys to be regenerated.
Once the host is known, and the key has been sent, you can access that server using SSH without a password.
To maintain security you must keep the private key, private. SSH will not use the file if the file permissions are incorrect.
infx provides services that help you manage the ssh keys. You generate the public and private keys on the host you want to remote manage from. You send the public key to the remote host you want to be able to manage.
key generation
This command will generate a private and public key pair:
demo1b@bobii:/home/informix> infx keygen
Generating public/private rsa key pair.
Your identification has been saved in id_rsa.
Your public key has been saved in id_rsa.pub.
The key fingerprint is:
f9:5c:41:8a:dc:de:82:f1:d8:fb:c6:17:5f:fe:6d:d6 informix@bobii
The key's randomart image is:
+--[ RSA 2048]----+
| . |
| . o o |
| + o . |
| O . . |
| S = o |
| o + . .|
| +. +o|
| .o . E|
| ... o+|
+-----------------+
By default, infx generates the key using rsa, and stores the pair in the files id_rsa and id_rsa.pub.
key sending
You send the public key to each remote host you want to manage.
demo1b@bobii:/home/informix> infx keysend dest=mamvps03
informix@mamvps03's password:
completed: keysend
When you initially send the key, you have to specify the password. Future access to this host will not require a password.
You can change the port ssh runs on from 22, to say 62999:
Add this line to /etc/ssh/sshd_config.
Port 62999
Restart sshd.
root@server1# /etc/init.d/sshd restart
Stopping sshd: [ OK ]
Starting sshd: [ OK ]
root@server1#
Repeat the change on server2, then set up your ssh config, so you don't have to specify the port number on the command line.
root@server2# touch $HOME/.ssh/config
root@server2# chmod 600 $HOME/.ssh/config
Add these lines to $HOME/.ssh/config, on server1
Host server2
Port 62999
Now all ssh commands, including rsync and scp, will default to the correct port number.
Check the ssh documentation for other options you can add here, such as compression for slow links.