Next Previous Contents

9. Using Samba over SSH in a shell script

One useful thing that is quite easy to set up is the use of SSH public key authentication to allow your shell scripts to set up the ssh tunnel. This can mean that you can have a tunnel set up from a cron job or just that you won't need to type a password when you run your script manually.

Heres how to set up ssh public key authentication for your SSH tunnel to use. On linux_1 server type the following command at a prompt.

ssh-keygen -t dsa

ssh-keygen will then ask you some questions, You can usually stick to the default answers and as you want your scripts to get a login without a password use an empty passphrase (just push return)

Generating public/private dsa key pair.
Enter file in which to save the key (/home/currentUser/.ssh/id_dsa): 
Created directory '/home/currentUser/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/currentUser/.ssh/id_dsa.
Your public key has been saved in /home/currentUser/.ssh/id_dsa.pub.
The key fingerprint is:
key:fingerprint:displayed:here currentUser@somehost.co.uk

Now you should have a file /home/currentUser/.ssh/id_dsa.pub - this is your public key for this user. you can now upload this file to linux_2 server.

Next you should log in to linux_2 and su to the user who you want the ssh tunnel to use - for example sshtunnelusercould be created with their shell set to /bin/false - This would mean that if the user tried to get shell or scp access they would be instantly logged out again while ssh tunnels are able to stay alive without use of a shell.

So to add your id_dsa.pub file to the linux_2 sshtunneluser ssh settings, log in as root (or sshtunneluser if you haven't yet set their shell to /bin/false) , go to the directory /home/sshtunneluser/.ssh/ and in there add the file authorized_keys2 . In this file you should insert the text from id_dsa.pub that you uploaded from linux_1.

If the .ssh directory doesn't exist already you can either create it yourself or you can log in as sshtunneluser (set their shell to /bin/bash or something if you need to) and then just use ssh to connect to somewhere - ssh sshtunneluser@linux_2 this will create the default  /.ssh directory with the correct permissions for you.

Now you should make sure authorized_keys2 is chmod 600 otherwise ssh will ignore it.

Next try to ssh to sshtunneluser@linux_2 from linux_1 as user currentUser (or whichever user you ran ssh-keygen as) if all went well, you should see the log in and then either get a prompt if you used /bin/bash as your shell (or other) or you should see it log in and then log out immediately if you set the sshtunneluser to use /bin/false as their shell.

If this is working then you can now script the opening of your ssh tunnel to this server - remember you need to add a new line to authorized_key2 file on linux_2 for every user you want to be able to access without needing to have a password - so if you ran your shellscript as any user other than the one you generated an id_dsa.pub file for then you will be asked for a password.


Next Previous Contents