csshsetup.1 (2012 03)

c
csshsetup(1) csshsetup(1)
NAME
csshsetup - Simplifies configuring the Secure Shell public-key user authentication between systems. This
establishes a security domain for the cluster. csshsetup is part of the Distributed Systems Administration
Utilities (DSAU).
SYNOPSIS
csshsetup [-hvr][-k type]{-f hostfile | hostname}
DESCRIPTION
The csshsetup command simplifies the task of setting up ssh public-key authentication trust relationships
for a set of managed systems. The csshsetup command employs the round-robin key-exchange feature
that you must use in a Serviceguard cluster to establish an "any-member-to-any-member" ssh trust rela-
tionship. This allows tools like
cexec(1),
ccp(1), and cps(1) to be used cluster-wide or across a set
of systems with an ssh trust relationship.
csshsetup creates the user files necessary to configure public
key user authentication on a Secure Shell client.
Using the round-robin (
-r) option, sets up bi-directional authentication for all specified systems. For
example, if the hostlist contains the members of a cluster, the -r option lets any member connect using
ssh to any other member, including itself. The same is true for an arbitrary list of distributed systems.
Using -r greatly simplifies the manual steps required to generate and distribute the ssh keys.
When executed, it checks for public keys, and may prompt the user for the following information:
• The user’s password on the remote host. Users are prompted for the password for the specified
user account on the remote host because password authentication is the only authentication
available when the command is first executed.
• The ssh client may prompt for adding the key fingerprint of the remote host.
If csshsetup cannot find any public keys, the ssh-keygen command runs (the key is saved with an empty
passphrase). For additional information, see the ssh manpage.
Following these steps, the csshsetup command creates the following identification and authorization
directory and files:
• A directory called $HOME/.ssh for the user on the client ($HOME is the name of the user’s
home directory). All files created by the csshsetup command are located in this directory.
• The key-pair (private and public keys) files are:
• The $HOME/.ssh/id_rsa file contains the user’s private key. Only the user for which the key
was created can access this file. This file is stored on the local node.
• The $HOME/.ssh/id_rsa.pub file contains the user’s public key. The user file id_rsa.pub is
copied to the public key authentication on the server to which the user will connect. This file
is copied to all remote hosts where you want to set up an ssh trust.
• The authorized-key file is called $HOME/.ssh/authorized_keys2. It contains the names of
public keys for remote hosts from which the users can access their user accounts on the local
host. With keys exchanged in this manner, the remote user does not need a password to access
the local account. There is an authorized-key file on each host where you use ssh and with
which you have exchanged keys.
After creating all files, the csshsetup command distributes the user’s public key to the remote host using
the
ssh command. With the -r option, the command distributes and configures the user’s public key on
all specified hosts in a round-robin or n-squared fashion.
See the ssh manpage for more information about Secure Shell user authentication.
Options
-f hostfile Reads a list of remote hosts specified in the hostfile, one host per line.
If the remote host is in a different domain than the local host, you must specify the full domain
name.
If a hostname is supplied instead of a hostfile name,
csshsetup reads host names from stan-
dard input, typically the command line.
-h Displays help on
csshsetup command options.
HP-UX 11i Version 3: March 2012 − 1 − Hewlett-Packard Company 1