CLI cookbook: setting up SSH key authentication for UNIX environment users

This topic describes adding public-key authentication for a UNIX environment user, thus allowing the Delphix server to connect to your UNIX Environments without an explicit password. This method uses the Delphix CLI in order to set up the environment user and gather SSH keys.

UNIX host environments (and Oracle cluster environments) can have users configured to use SSH-key-based authentication instead of the traditional password authentication method.

Prerequisites

• You must be able to log into the remote host (or all hosts of an Oracle cluster) and have write access to the ~/.ssh/authorized_keys file within the desired user's home directory.

Option 1: system key

Within Delphix, there is a per-system SSH public key that can be placed into the ~/.ssh/authorized_keys file of the remote user. Once this has been done, the Delphix environment user can be configured to use the private key instead of an explicit password. Note that it is also possible to configure an environment to use this system key in the Delphix Management application by navigating to Manage > Environments and selecting Public Key as the Login Type for the environment. For details, see Managing Environments.

1. Get the current system public key:

   CODE

   delphix> system get sshPublicKey
       ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAse1M7uJX44lVPBljhnxB6MZUTx8VF6cupaVATg120lQonIqx29lP+Mwp0AWh7C983IDoYDo+AY7RXpcFP9nKksiJnGSGiK6wo9RIiqSnF1x/VXNkTt2/67RVofoiui4W5fuxD4hOIvoTr47Bg1hh9L6nhP0tnUvS/rusHFJ+ogxGHm46mwNlgUJUGmLTNao+W0YU693HRLukEch01t4k6olVGaC0eLjYlgBf0Z5XiIcBX6ZWqVHAhwMinVjAvmfQhirAgCI7gYrd5/PwNl/DC8xyhWuxd2jgA7sSPeRqWY0JHt/xcmdpIaPxTwtxQLKTnPxrFrQd+l4uf6LKxr5g7w== root@delphix

2. Add this key (starting with ssh-rsa) to the remote user's ~/.ssh/authorized_keysfile. You will need to get access to this file using an alternate authentication mechanism (such as logging in as the user with a password or logging in as an administrator). Depending on the target OS, you may need to do the following:

   1. If the directory does not exist:

      CODE

      $ mkdir ~/.ssh

   2. If creating the file or directory as an administrator:

      CODE

      # chown -R <username> <home>/.ssh

   3. If required by the host SSH configuration, ensure the directory is not world-readable:

      CODE

      $ chmod 600 ~/.ssh/authorized_keys
      $ chmod 755 ~

3. Create or edit an environment user:

   CODE

   delphix> environment user create

4. Set the user environment and name:

   CODE

   delphix environment user create *> set environment=environment1
   delphix environment user create *> set name=username

5. Set the user credential type to SystemKeyCredential:

   CODE

   delphix environment user create *> set credential.type=SystemKeyCredential

6. Commit the results:

   CODE

   delphix environment user create *> commit

Option 2: Per-environment key pair

Each environment user can also be configured to use an SSH key pair provided via the CLI or API.

1. Add the public key to the remote user's ~/.ssh/authorized_keysfile. You will need to get access to this file using an alternate authentication mechanism (such as logging in as the user with a password or logging in as an administrator). Depending on the target OS, you may need to do the following:

   1. If the directory does not exist:

      CODE

      $ mkdir ~/.ssh

   2. If creating the file or directory as an administrator:

      CODE

      # chown -R <username> <home>/.ssh

   3. If required by the host SSH configuration, ensure the directory is not world-readable:

      CODE

      $ chmod 600 ~/.ssh/authorized_keys
      $ chmod 755 ~

2. Create or edit an environment user:

   CODE

   delphix> environment user create

3. Set the user environment and name:

   CODE

   delphix environment user create *> set environment=environment1
   delphix environment user create *> set name=username

4. Set the user credential type to KeyPairCredential:

   CODE

   delphix environment user create *> set credential.type=KeyPairCredential

5. Set the private and public keys:

   CODE

   delphix environment user create *> set credential.privateKey="----BEGIN ..."
   delphix environment user create *> set credential.publicKey="ssh-rsa AA..."

   (these example values were trimmed for brevity)

6. Commit the results:

   CODE

   delphix environment user create *> commit