Translated from 日本語 • View original Good morning. This is the Miyashita of infrastructure.
This is the procedure for setting SSH when attaching or removing a server's virtual IP from a terminal.
This is an image of a place where IP is failed by hand inside MHA.
The way to perform root privileges over an SSH connection is to
・Enable public key authentication with root.
- Switch to root so that the logged-in user can sudo.
・Allow you to execute only specific commands with root.
There are three methods, but this time I would like to apply the third method, which does not change the security level that much.
It would have been nice if it was already in an environment where you could sudo, but since you can't sudo, you use forced-commands-only.
The working environment is as follows:
Connecting OS:SunOS test 5.10 Generic_147440-19 sun4v sparc sun4v
→ called a terminal
Connected to: Red Hat Enterprise Linux Server release 6.2 (Santiago)
→ call the server
Please note that Solaris is a terminal, which is rare these days, and it is an environment full of retro feeling.
(Terminal Settings)
- Create a public key for the user to log in. I will prepare two keys for each command.
[shell]# ssh-keygen -t rsa -N "" -f ~/.ssh/ipadd_command generating a public/private rsa key pair. The identifier was stored in /export/home/test/.ssh/ipadd_command. The public key has been stored in /export/home/test/.ssh/ipadd_command.pub. Key Fingerprint: 80:1e:4f:8b:2a:0d:22:fb:e2:c7:22:75:70:ef:db:a2 test@test
# ssh-keygen -t rsa -N "" -f ~/.ssh/ipdel_command generating a public/private rsa key pair. The identifier has been stored in /export/home/test/.ssh/ipdel_command. The public key has been stored in /export/home/test/.ssh/ipdel_command.pub. Key fingerprint: 06:fe:1a:41:fc:2a:02:96:ca:c2:bd:66:64:ed:f5:17 test@test[/shell]
Register commands to run on the server.
[shell]# vi ipadd_command.pub command="ip addr add 172.31.0.1/24 dev eth2 label eth2:1" [/shell] to the top.
[shell]# vi ipdel_command.pub command="ip addr del 172.31.0.1/24 dev eth2 label eth2:1" [/shell] to the top.
(Server Settings)
Change the settings so that you can SSH in as the root user and run commands.
[shell]# vi sshd_config #PermitRootLogin no PermitRootLogin forced-commands-only[/shell] to reflect the settings
[shell]# service sshd reload sshd: [ OK ][/shell]
Register the public key created on the terminal.
[shell]# vi ~/.ssh/authorized_keys[/shell] Add the key information that was added to the server with the command information you just added.
(If you don't have an authorized_keys file, please create a new one.)
The setup is now complete. Now let's connect from the terminal.
[shell]# ssh -i ~/.ssh/ipadd_command root@server1 The connection to server1 has been closed. [/shell]
Check the server's interface,
[shell]# ifconfig -a eth2:1 eth2:1 Link encap:Ethernet HWaddr F8:0F:41:FF:FF:FF inet addr:172.31.0.1 Bcast:0.0.0.0 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Memory:ded20000-ded40000 [/shell]
I got a solid IP address. Now remove the IP.
[shell]# ssh -i ~/.ssh/ipdel_command root@server1 connection to server1 has been closed. [/shell]
The server's interface is
[shell]# ifconfig -a eth2:1 eth2:1 Link encap:Ethernet HWaddr F8:0F:41:FF:FF:FF UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Memory:ded20000-ded40000 [/shell]
The IP was off as expected.
In an environment where there is a restriction that the root key authentication is not possible, and the commands to be executed are limited.
It's easy to do, so please give it a try.