El objetivo de esta entrada es permitir las conexiones SSH desde un NAS Synology a otro haciendo uso de certificados, es decir, sin necesidad de introducir contraseñas lo que permite, por ejemplo, automatizar tareas de sincronización con rsync. Se hará referencia a SYNO-CLIENT para referirse al Synology que actuará como cliente, es decir, la Synology que establecerá la conexión. Y se usará SYNO-SERVER para referirse al Synology que actuará de servidor, es decir, que recibirá las conexiones entrantes.
De forma esquemática:
1
SYNOLOGY CLIENTE (SYNO-CLIENT) ---> SYNOLOGY SERVIDOR (SYNO-SERVER)
Crear llave en SYNO-CLIENT 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
SYNO-CLIENT> ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
5a:5f:17:e9:29:53:65:fb:0d:4a:ca:08:c2:d6:d6:3e root@SYNO-CLIENT
The key's randomart image is:
+--[ RSA 2048]----+
| o|
| . . +.|
| + o . =. |
| . o o o o + +o|
| + E o * + o|
| . . . + + |
| o |
| |
| |
+-----------------+
SYNO-CLIENT>
Permitir conexiones SSH con llaves en SYNO-SERVER Descomentar las siguientes líneas de /etc/ssh/sshd_config en SYNO-SERVER:
1
2
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
Añadir la llave de SYNO-CLIENT en SYNO-SERVER Obtener la clave pública de SYNO-CLIENT 1
2
SYNO-CLIENT> cat /root/.ssh/id_rsa.pub
ssh-rsa AAAAB3NC1azyc2EAAAADAQABAAABAQCgJwEaOpyiI3RLm6udOLiC9wsp5SttM/vNhmEysnoQL7JEeB1NQYPC197iL5IBqs8DYknhOmZlCCkjrzrLUQdnBLfKTcwh3VurCQsM92DQjZ7ffhecm9d+wt3oBHz/7r05TDVvLB+6DFIIWtJ1p6vT9lOLe8LhH/rru/16T+hgsHrKUPeiJh+wKY/ZELHezJpcGvuiEQkJTlM7gIb49TyfxLdv/oOgJDHp3U0O/t5Pw8ZxkNkao4CowGoT/WSfffdH0kzfNmXYt5uDHLUxcuNIPCBScdjoOFdTKZ6G/+XfVpKnMO87zwMApu8/w9OE9u653qVWJK51QtsTvpRP32Et root@SYNO-CLIENT
Añadir la clave pública de SYNO-CLIENT a SYNO-SERVER 1
SYNO-SERVER> echo "ssh-rsa AAAAB3NC1azyc2EAAAADAQABAAABAQCgJwEaOpyiI3RLm6udOLiC9wsp5SttM/vNhmEysnoQL7JEeB1NQYPC197iL5IBqs8DYknhOmZlCCkjrzrLUQdnBLfKTcwh3VurCQsM92DQjZ7ffhecm9d+wt3oBHz/7r05TDVvLB+6DFIIWtJ1p6vT9lOLe8LhH/rru/16T+hgsHrKUPeiJh+wKY/ZELHezJpcGvuiEQkJTlM7gIb49TyfxLdv/oOgJDHp3U0O/t5Pw8ZxkNkao4CowGoT/WSfffdH0kzfNmXYt5uDHLUxcuNIPCBScdjoOFdTKZ6G/+XfVpKnMO87zwMApu8/w9OE9u653qVWJK51QtsTvpRP32Et root@SYNO-CLIENT" >> /root/.ssh/authorized_keys
Verificar 1
2
3
4
5
6
7
8
9
10
11
12
13
SYNO-CLIENT> ssh root@172.26.0.180
The authenticity of host '172.26.0.180 (172.26.0.180)' can't be established.
ECDSA key fingerprint is de:35:35:09:54:af:2a:18:f3:ce:7a:c1:3d:5b:f8:23.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.26.0.180' (ECDSA) to the list of known hosts.
BusyBox v1.16.1 (2014-07-12 05:39:20 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
SYNO-SERVER> exit
Connection to 172.26.0.180 closed.
SYNO-CLIENT>
Entradas de interés 