If you need to set up passwordless authentication to your Isilon system, then this post is going to help you. Implementing secure cryptographic keys streamlines administrative workflows while aligning with modern enterprise security frameworks.
In this post, I will explain how to configure RSA key authentication, which allows you to log in to any Unix or Dell Isilon / PowerScale system without a password. As documented in recent Dell Technologies storage administration guidelines, enabling SSH key-based authentication provides secure, streamlined administrative access across OneFS clusters.
The underlying kernel of EMC Isilon and modern Dell PowerScale platforms running OneFS is a Unix-based kernel. Hence, you can run standard Unix commands on it.
Setting up RSA authentication from a Unix server to Isilon follows standard public-key cryptography principles, similar to setting up access between two Unix servers.
In a later section, we will see the detailed steps, but first, let us understand how passwordless authentication works.
How Passwordless Login Works
In passwordless authentication, a client is able to SSH to a target system without using a traditional static password. To do so, you need to copy the RSA public key of the client and add it to the authorized_keys file of the target system.
In our scenario, the client is a Unix Server and the target system is your EMC Isilon or PowerScale cluster. Hence, we will create an RSA public key on the Unix Server and then add it to the authorized_keys file of the Isilon node.
Once you complete these steps, you can log in to Isilon from the Unix server effortlessly and securely without a password.
Configure Passwordless Authentication To Isilon From Unix Server
Below are the overall steps that we are going to follow to configure passwordless authentication to Isilon from the Unix server.
- First, create a public key in the Unix Server.
- Next, verify the home directory of the Isilon user.
- Create a .ssh directory and authorized_keys file inside it, if they do not exist.
- Copy the public key from the Unix server and paste it into the authorized_keys file of Isilon.
- Finally, verify the passwordless login from the Unix Server to Isilon.
Step 1. On the Unix server, create the RSA public key
Run the below command on the Unix server to create the RSA public key.
server# ssh-keygen -t rsa
You will get a similar output as below.
Follow the text prompts to complete the RSA public key creation process. Just press enter if you want default values.
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
6f:88:45:20:a3:b6:f1:00:d5:e9:3a:69:f2:63:d5:87
root@server#
The above steps complete the RSA public key creation process. You can view the RSA public key using the command below.
server# cat /root/.ssh/id_rsa.pub
Step 2. Verify the home directory of Isilon User
The authorized_keys file exists in the home directory of a user. Hence, first, find the home directory path of the Isilon user using the command below.
isilon1-01# isi auth users view root
Note that for the root account, the home directory is /root. However, if you have any other account, the home directory may be /ifs/home/<user>.
Step 3. Create .ssh directory if it does not exist in Isilon
Once you have the home directory location, verify if the .ssh directory exists. If you do not find a .ssh directory, you need to create one.
isilon1-01# mkdir /root/.ssh
Step 4. Copy the RSA public key to Isilon
Finally, copy the public key created in Step 1.
Note that Isilon has multiple nodes, and if you want passwordless authentication for all nodes, you have to copy the RSA public key to all individual nodes in the cluster.
Now, once you have copied the RSA public key, use the following command to paste it into the authorized_keys file on Isilon.
cat > /root/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAvoP1X2mikthSbxyd6W39wjt6Gdj+gn96sYY9fVLFFympCS2ouerq/LkT+zHz18ppzb7gpPnhfDrze8G78tpvXIkaC2FVdmCCPysaJg/WyNj0/mkmocijqT+w5tRThZboBwR4PAvg+jgTHUvc2OIobHJh6d0Br5npcybj8uKXUqm0a0tNAILWxBgKRs2ghz8VqyBuXJizCes5B1aXFJdxzKTN425hWigUWgNrcbipY6NeCA0/wv67hYgBxG3XXq0G7KZIlFha6GSrzqTzv17OMb+lhp0AFjNtUZzjp+2mTr3ZgeOS71psAvis1mtHq1DZ2EL1yROXgEX0/YBte5YA4Q== root@nis.nasadmin.org
Press enter once and Control + C to save the file.
Now, you have completed the necessary steps to configure a passwordless login to Isilon from the Unix server.
If you want to log in to each node of the cluster without using a password, connect to every other node and repeat the directory creation and key copying steps.
Step 5. Verify Passwordless Login To Isilon
To verify that the process was successful, log in to the Unix server and run the command below.
server# ssh isilon1-01
If it does not prompt you for a password, the verification is successful.
Now, you should be able to SSH directly to any node in the cluster from the Unix server without entering credentials.
Watch a live demo of all the steps in the video below and Subscribe to the channel to get notifications.
