4

I'm trying to configure a fi-ware cloud instance using Rex. What these instances (and probably other OpenStack-based systems) prove is a "identity file", a single private key that you can use to connect to them. I have been using variations of this:

user "root";
private_key "/home/jmerelo/.ssh/jj-iv.pem";
public_key "/home/one/public/key.dsa";
key_auth;


group fiware => "130.206.x.y";

desc "Install git";
task "git", group => "fiware", sub {
   install "git";
};

where the private key is the one provided by fi-ware, and the public key is, well, whatever I thought of, or nothing. If no public key is provided, error is

[2014-11-30 11:45:45] WARN - Error running task/batch: No public_key file defined. at /home/jmerelo/perl5/perlbrew/perls/perl-5.20.0/lib/site_perl/5.20.0/Rex/Task.pm line 621.
 at /home/jmerelo/perl5/perlbrew/perls/perl-5.20.0/lib/site_perl/5.20.0/Rex/TaskList/Base.pm line 273.

which is quite obviously true. But if I try other public keys, error is:

[2014-11-30 11:48:37] WARN - Error running task/batch: Wrong username/password or wrong key on 130.206.127.211. Or root is not permitted to login over SSH. at /home/jmerelo/perl5/perlbrew/perls/perl-5.20.0/lib/site_perl/5.20.0/Rex/TaskList/Base.pm line 273.

Using 

ssh -i ~/.ssh/jj-iv.pem root@130.206.x.y

connects correctly to the instance. So maybe the question is "Can Rex use a single private key to connect to a host?"

jjmerelo
  • 22,578
  • 8
  • 40
  • 86
  • 1
    Net::SSH2 (the SSH module used by default by Rex) may not support your key format. [Tell Rex](http://www.rexify.org/howtos/book/authentication.html) to use Net::OpenSSH instead. – salva Nov 30 '14 at 21:17
  • 1
    You can also convert the key to a format supported by Net::SSH2. See [this entry](http://security.stackexchange.com/questions/32768/converting-keys-between-openssl-and-openssh) for instance. – salva Nov 30 '14 at 21:34
  • @salva in fact, eventually the solution was in that page: you can generate a public key from a private key. However, I didn't find how changing the connection mode to a different module could help. – jjmerelo Dec 01 '14 at 06:51
  • Under the hood, Net::OpenSSH uses the `ssh` binary, so if you are able to connect from the command line, it is very likely you will also be able go connect using Net::OpenSSH – salva Dec 01 '14 at 07:32

1 Answers1

3

Finally, I generated a public key from the private key using, as suggested by the documentation, 

$ sshkey-gen -y -f /path/to/your/private.key >public.key

and then using that public.key in the Rexfile

Community
  • 1
  • 1
jjmerelo
  • 22,578
  • 8
  • 40
  • 86