Difference between LVM and LVM2: Linux interview question explained

Post stating point-wise differences between LVM and LVM2 explained. This is one of the frequently asked questions for the Linux interview.

One of the frequently asked Linux interview questions is ‘what is the difference between LVM and LVM2?’ to which most of the candidate’s flanks. In this article, we will be discussing this question.

First of all, what is LVM? LVM is a logical volume manager. It is a widely used volume manager in Linux and Unix like VxVM (Veritas volume manager). As a sysadmin, you must be knowing all tasks which can be done in LVM but not a theoretical question like the difference between LVM and LVM2.

LVM and LVM2 are two different versions of LVM. Obviously, LVM2 being the latest. Their differences can be identified in terms of their functions, services offered, availability, etc. Let’s see one by one :

Availability :

LVM is available in most of the famous distributions like HPUX, Redhat, Suse, etc. LVM2 is available only kernel version 2.6.9 and above like RHEL4 and later. You can even build LVM modules as per your kernel (if its not available in your distributions). Setup information can be found here.

Compatibility :

LVM2 has backward compatibility with LVM. It has the same command modules and infrastructure like LVM with enhanced features. LVM being the previous version don’t have compatibility with LVM2 features.

Size limits :

Different size limits are increased in the new LVM2. The maximum file system/device size was capped to 2TB in LVM whereas its 16TB(32-bit CPU) & 8EB (64 bit CPU) in LVM2.

Max LV and PV were 255 in LVM. In LVM2 it has no limit (snippet from vgcreate manpage below).

 -l, --maxlogicalvolumes MaxLogicalVolumes
              Sets the maximum number of logical volumes allowed in this  vol-
              ume  group.  The setting can be changed with vgchange.  For vol-
              ume groups with metadata in lvm1 format, the limit  and  default
              value  is  255.   If  the metadata uses lvm2 format, the default
              value is 0 which removes this  restriction:  there  is  then  no
              limit.

 -p, --maxphysicalvolumes MaxPhysicalVolumes
              Sets  the  maximum number of physical volumes that can belong to
              this volume group.  The setting can be  changed  with  vgchange.
              For  volume  groups  with metadata in lvm1 format, the limit and
              default value is 255.  If the metadata  uses  lvm2  format,  the
              value  0  removes  this restriction: there is then no limit.

Extra features :

LVM2 is bundled with below extra features over LVM :

Volume mirroring support
Shared volume support with GFS
Transnational metadata for fast recovery
Cluster suite failover supported
Striped volume expansion

This sums up the difference between LVM and LVM2 versions. Write to us in comments if you have corrections/suggestions.

Recover forgotten root password in RHEL with screenshots

1 Reply

Learn how to recover forgotten root password in Linux RHEL. Step by step procedure to reset the root password by booting system in single-user mode.

There are many times when we set the root password too complex and later on forgot it. Many people used to work on consoles with no timeout values. In such cases, when they logged out of the console or reboot system, they most of the times forgot the root password to log in.

So it becomes extremely important to have one more account with root privileges on the system. Normally in corporate environments, they do keep such 2-3 accounts so that forgetting root password shouldn’t stop operations. But like in test environments or labs sometimes these practice is not followed and it becomes necessary to know how to recover forgotten root password.

A root password can not be recovered once forgotten! It can only be reset to new value! Now the question is if you don’t know the root password how will you reset it when you won’t able to login in the first place. The answer is the single-user mode!

Yes, to reset root password (when you forgot it) you need to boot the server into single-user mode. Why single user mode? Simple single user mode boots and present your root prompt without any requirement to log in! Simple eh? So resetting forgotten root password follows simple steps :

Edit boot kernel path with single-user mode parameter (GRUB)
Boot kernel into single user mode
Reset root password
Get into normal multi-user run-level

Lets see all these steps below with screenshots :

1. Edit boot kernel path

Restart server with the power button and halt the boot process by pressing any key when you see press any key to interrupt boot message on the console.

If you have installed more than one OS on your system, you will see more than one entries in the above screen. Use arrow keys to select (highlight) your kernel. If your bootloader is protected with password then press “p” you will be asked for a password if not then just press enter. After entering the password or pressing enter, you will be presented with the next screen:

Here, press the “e” key to edit the selected entry. You will be presented with a kernel line selection screen like below.

Select the kernel line and press “e” again to edit that entry. Now on new screen append letter S or single at end of the line so instruct the kernel to boot into single-user mode.

2. Boot kernel into single user mode

After typing above entry, press ‘enter’ key to save and you will back to the previous screen. Select kernel and press “b” to boot this edited kernel. That’s it! your server is booting in a single-user mode which will give you access to the system without the need of login.

Observe that, you haven’t asked for a password, and you are presented with root prompt!

3. Reset root password

Do I have to write anything for it? You have a root prompt already! go change your root password like you normally do.

# passwd root

Changing password for user root.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.

You can also check here that you are in single-user mode by checking run level with who command.

4. Get into multi user mode

You can do it by rebooting the system. But you need to go through all the above steps again and remove the single user mode entry you made previously. Or else the server will boot into again single-user mode.

Or you can simply type “init 3” to change your run-level from single to multi-user mode!

You have successfully reset the forgotten root password to a new one. Keep a new password in a safe place and don’t forget again! Since forgetting takes your almost 10-20 mins of downtime.

How to extend the file system online in LVM

Leave a reply

Learn how to extend the file system or logical volume in LVM under HPUX and Linux without any downtime. Grow your mount point capacity without impacting users.

“Extend file system” is of the common task every Linux Unix sysadmin face in his life. Insufficient capacity planning during deploying systems, un-foreseen grown data, improper data rotation techniques can lead to mount points reaching their capacity limits. A quick solution is to grow those mount point’s total size to get some breathing space till you finalize on final solution about data management.

Extending file system is actually extending related logical volume and then growing FS over it. There are few pre-requisite you should consider before attempting for file system extension.

Pre-requisite :

You have free PE available in the respective Volume group. (check using vgdisplay)
If not, you must have free disk/LUN which can be added to that VG
In case of old HPUX versions, online JFS must be installed (check using swlist)

How to do it :

Let’s start with the case: We have /data (/dev/vg01/lvol01) mount point of 1024MB in vg01 volume group which needs to be extended by 500MB.

Now, as per the pre-requisite, we should have free PE available in vg01. You can verify it by checking the “free PE” field in vgdisplay output. If it’s a non-zero number then you have some PE available to use. You need to calculate how much free space exists in VG. For that check “PE size” in vgdisplay output, multiply it with the number of PEs, the resulting number is MBs you have free in VG. You can extend your file system by this many MB sizes.

Suppose, you don’t have free PE in vg01 then you need to add a new disk or LUN to system. Once detected, you need to add it vg01 using vgextend command. Once your vg01 is extended with new disk/LUN, you will see free PE in vgdisplay output.

For quick reference –

# vgextend <vg_name> <pv_name>

Now you verified and confirmed, you have 500MB free in VG. Proceed to extend the logical volume of /data mount point i.e. /dev/vg01/lvol01 using lvextend command.

# lvextend -L 1524 /dev/vg01/lvol1
Logical volume "/dev/vg01/lvol1" has been successfully extended.
Volume Group configuration for /dev/vg01 has been saved in /etc/lvmconf/vg01.conf

Existing 1024+500Mb hence 1524 in command.

Now your logical volume is extended to the desired size. Still, you won’t be able to see this space growth in mount point size. You need to extend the file system as well for that.

In HPUX, you can use fsadm command (size to be specified in KB) like below :

# fsadm -b 1560576 /data

In RHEL6 you can use resize2fs command like :

root@kerneltalks # resize2fs /dev/vg01/lvol01
resize2fs 1.43-WIP (20-Jun-2013)
Filesystem at /dev/vg01/lvol01 is mounted on /data; on-line resizing required
old_desc_blocks = 320, new_desc_blocks = 384
The filesystem on /dev/vg01/lvol01 is now 1610612736 blocks long.

Here, it will grow with maximum size of lvol hence size is not specified.

In RHEL7, for XFS filesystem :

# xfs_growfs /data -D size

where size is in system block (depends on your config). If you don’t specify size (-D) then it grows to the maximum available size of lvol. So in our case, we don’t need to specify size. Check all xfs commands here.

Final check :

You are done! Check mount point new size in bdf (HPUX) or df -h (Linux) output. Note that we haven’t stopped access to apps/users to the mount point in question. This means the entire operation was done online without any downtime or impacting users.

Logs under /var/stm/logs/os in HPUX

Leave a reply

Your /var mount point is getting full? You need to check /var/stm/logs/os directory for old logs. Lots of space can be saved by zipping or purging them.

Ever wondered why /var/stm/logs/os is taking up huge space in /var mount point of HPUX? In this post, we will see details about logs under this directory and how to handle them.

Most of the time you get /var getting full alerts from your monitoring system or you observe /var is filling up. This is normal behavior since most of the logs reside in /var and if some logs are growing fast they cause /var filling up fast. As a first troubleshooting step, you need to check huge size files and directories in /var.

Many times you see one of the culprit is /var/stm/logs/os directory. If you see inside this directory you will see something like below :

# ls -lrt /var/stm/logs/os
total 6986016
-rw-r--r--   1 root       root        512656 Apr 10  2008 log1.raw
-rw-r--r--   1 root       root        512656 Apr 10  2008 log2.raw
-rw-r--r--   1 root       root        512656 Apr 10  2008 log3.raw
-rw-r--r--   1 root       root        512656 Apr 11  2008 log4.raw
-rw-r--r--   1 root       root        512656 Apr 11  2008 log5.raw
-rw-r--r--   1 root       root        512656 Apr 11  2008 log6.raw
-rw-r--r--   1 root       root        512656 Apr 11  2008 log7.raw
----- ouput clipped -----

There are lots of raw log files taking up huge space collectively.

What are these logs under /var/stm/logs/os :

Your next question will be what are these files? what is the purpose of these files on the server?

These are raw files that are being logged and used by STM i.e. support tool manager. Those are logs collected by STM which has information about your hardware issues. By the above output, you can see those are rotated when one log file crosses a certain file size. While rotating they are sequentially numbered. This numbering makes it easy when it comes to managing those logs.

How to read these logs :

You can read these logs using log viewer by STM. Goto CSTM console using command cstm –

# /usr/sbin/cstm
Running Command File (https://z5.kerneltalks.com/usr/sbin/stm/ui/config/.stmrc).

-- Information --
Support Tools Manager

Version A.59.05

Product Number B4708AA

(C) Copyright Hewlett Packard Co. 1995-2007
All Rights Reserved

Use of this program is subject to the licensing restrictions described
in "Help-->On Version".  HP shall not be liable for any damages resulting
from misuse or unauthorized use of this program.

cstm>

Then run ru and select logtool utility.

cstm>ru
-- Run Utility --
Select Utility
    1 MOutil
    2 logtool
Enter selection or cancel to quit : 2

-- Logtool Utility --
To View a Summary of Events in a Raw Log

  1. Select a raw (unformatted) log file.  (File Menu -> "Select Raw")
     The current log file ends in ".cur", e.g. "log1.raw.cur".
     You do not have to switch logs.

  2. View the summary of the selected log file. (View Menu -> "Raw Summary")

To Format a Raw Log

  1. Set the format filter for the types of entries you want to see.
     (Filters Menu -> "Format").  To see all entries, skip this step.

  2. Format the raw log file. (File Menu -> "Format Raw")

  3. Display the formatted file. (View Menu -> "Formatted Log")

  4. To further narrow the entries displayed, set a display filter.
     (Filters Menu -> "Display" -> "Formatted")

For more information, use the on-line help (Help Menu -> "General help").

Logtool Utility>

With give information on console you can view, format raw log files.

Should I purge or zip /var/stm/logs/os logs ?

Now you know what are these files and you observe there are too many of them which are too old to keep. In such a scenario, you have got two options:

Zip them: For few months old files. Maybe 1-2 months old. How to zip files.
Purge them: For very old logs like 6 or more months old.

Make a note that those logs are read by STM as well so if you purge or zip them, STM won’t be able to use them.

So be sure you check logs using logtool utility explained above and decide to purge, zip, or keep it. Normally, if you are not facing any hardware issues with the server currently then you should zip/purge according to the time frame I suggested above.

# ls -lrt /var/stm/logs/os
total 2463008
-rw-r--r--   1 root       root         65910 Apr 10  2008 log1.raw.gz
-rw-r--r--   1 root       root         57168 Apr 10  2008 log2.raw.gz
-rw-r--r--   1 root       root         53727 Apr 10  2008 log3.raw.gz
-rw-r--r--   1 root       root         40526 Apr 11  2008 log4.raw.gz
-rw-r--r--   1 root       root         39541 Apr 11  2008 log5.raw.gz
-rw-r--r--   1 root       root         37050 Apr 11  2008 log6.raw.gz
-rw-r--r--   1 root       root         37624 Apr 11  2008 log7.raw.gz

Match above output with previous and see how file size decreased after zipping which in turns saved my /var space.

Zipping of purging these logs will greatly free up space under /var mount point. This is one of the directories which we normally miss or ignore while cleaning up the mount point.

Alternatively, you can even configure logrotate utility which will take care of this zipping and purging of files automatically without human intervention.

Blog enhancements for better speed and cleaner looks

Leave a reply

KernelTalks implemented few blog enhancements for more speedy page loads and clean looks. Addition of CDN and Genesis premium themes to blog.

KernelTalks happy to share new technology enhancement implemented in the blog. Oct 2016 when KernelTalks was moved from Blogger to self-hosted WordPress. Also, it acquired custom domain name kerneltalks.com over previous one kerneltalks.blogspot.com In the past few months, blog traffic has grown to well extent which calls for good specifications.

To cater to growing traffic, KT implemented paid CDN (KeyCDN) for faster page delivery. Now, KT serves pages faster than before with the GTmetrix speed score as A (95%).

Apart from CDN, we also make a purchase of Genesis Framework which is a well famous product of Studiopress. This framework is a very neat and clean parent theme code for WordPress themes. This helps us avoiding code bloat which comes with free themes making then sluggish.

Currently, KernelTalks runs Magazine pro premium Genesis child theme giving it a much cleaner and well-organized look. It’s also a good theme for SEO which will help KT to rank higher in Google results!

That’s all technology updates running behind KernelTalks! Keep surfing and have a happy shell!

How to learn, practice HPUX online

Leave a reply

HPUX is HP’s own Unix operating system which runs on HP hardware only. In this post, know if you can learn or practice HPUX online.

Many of our readers asked this question “How do learn HPUX online?”, “How to practice HPUX online?”, “Are there HPUX online test servers?”. So I thought of writing this post which discussed over if its possible to learn HPUX online by sitting at your home.

In today’s open source world, there is very small amount of space being owned by proprietary kernel’s like HPUX by HP, AIX by IBM, Solaris by Sun etc. Being proprietary, these UNIX variants needs specific hardware to run on. Most of then dont even have emulator’s platform existing and dont run on vmware either. In such scenario, it becomes mandatory to have a licensed hardware to learn those technologies.

HPUX kernel supports only Itanium (IA) and PA-RISC architectures. This is the reason this OS cant run on VMware VM. IA and PA-RISC are very expensive hardware to own for a normal learner. PA-RISC being legacy hardware you might get it cheap in re-sell but again to find someone willing to sell this hardware is another treasure hunt quest!

Own HP Hardware:

One way to learn or practice HPUX is to buy HP hardware. You can purchase it directly from HP or its resellers. But since its expensive 99% of learners won’t opt for this option. Another way is to buy old hardware at a cheap price provided you found it up for sale!

Online HPUX servers:

HP used to run a program named “HP test drive”. Under this program, HP was offering free HPUX test machines (remote non-root access). But this program is shut down and no more available.

There are some institutes or learning centers which offer online HPUX server’s access for practice on a paid basis. You need to google around for such institutes locally in your area.

HP himself offers an “HP performance center” program in which you can test hand on HP objects. Contact the local HP representative for more details.

Online courses :

Obviously this is always an open option. Learning centers offering HPUX courses locally in your area. HP also offers the HPUX learning module under its eLearning program.

Online study material :

There are many online course material for certification book materials available for HPUX. To start with, if you are a beginner, I will recommend book by Ashghar Ghori which is best to start with. It’s available to purchase from many websites like Amazon, Flipkart, etc. HP also provides study material which comes with their online courses.

Apart from this, HP official ITRC forum for HPUX is the best place to get your queries regarding HPUX resolved. Also, you can go through online blogs, videos, etc to learn HPUX. Obviously you can subscribe to this website which also publishes articles on HPUX frequently!

Conclusion :

If you are ready to spend a good amount of money on learning HPUX, go ahead with HP online courses and training materials. For a low budget, you need to search for local institutes offering HPUX courses.

Let us know in comments if you know any good online HPUX resources.

HPUX: Add persistent device names in VG

Leave a reply

Know command to add persistent device names in the existing volume group in HPUX. Also, learn how to match legacy devices with persistent device names.

Newer HPUX like v3 introduced persistent device names (DSF disk special files). These are more convenient and user-friendly names than ctd format (Controller, target, device) names. CTD format are called legacy DSF and newer are persistent.

Persistent DSF takes care of native multipathing. In the case of multipathing, for the same disk, there are different ctd exists and hence different legacy names. But, there will be only one persistent device name per disk no matter how many ctd paths exist for that same disk. You can see this in the device file names mapping below.

For example, the legacy disk file name is /dev/dsk/c0t1d0 whereas persistent disk file name will be /dev/disk/disk1. A system with persistent device names does have legacy names in kernel too. Persistent to legacy names can be mapped using ioscan command like below :

# ioscan -m dsf
Persistent DSF             Legacy DSF(s) 
======================================== 
/dev/rdisk/disk1           /dev/rdsk/c1t0d0 
/dev/rdisk/disk2           /dev/rdsk/c4t0d0 
/dev/rdisk/disk3           /dev/rdsk/c2t0d1 
                           /dev/rdsk/c2t0d2 
/dev/rdisk/disk4           /dev/rdsk/c3t0d1 
                           /dev/rdsk/c3t0d2

In the above output, you can see the persistent device name on left and its related legacy name is on right. You can see multipathing is being taken care of by persistent device files. Since there is only one persistent name but many legacy device names for the same disk.

Adding persistent devices in VG :

For example, if you have created a volume group on a system with legacy device files. Now, you want to add persistent device files to VG. Then you can do it by using vgextend command with all persistent disk paths. But this method will be hectic since you need to search persistent names for all existing legacy devices in VG and accordingly add them in VG.

HPUX v3 has a special command vgdsf which will do this task for you. You just need to provide VG name and this command will add all persistent devices in VG and removes legacy devices out.

# vgdsf -c /dev/vg01

Converting legacy DSFs to persistent DSFs in VG /dev/vg01
Persistent DSF /dev/disk/disk3 added to VG /dev/vg01
Persistent DSF /dev/disk/disk4 added to VG /dev/vg01
Legacy DSF /dev/dsk/c2t0d1 removed from VG /dev/vg01
Legacy DSF /dev/dsk/c2t0d2 removed from VG /dev/vg01
Legacy DSF /dev/dsk/c3t0d1 removed from VG /dev/vg01
Legacy DSF /dev/dsk/c3t0d2 removed from VG /dev/vg01

In the above output you can see first it adds persistent dsf to VG and then removes legacy dsf from VG. You can verify if VG contains only persistent devices using vgdisplay command or examining /etc/lvmtab file.

How to check and test APA in HPUX

Leave a reply

A how-to guide for checking and testing APA configurations in HPUX. Auto Port Aggregation is used for NIC redundancy which is similar to NIC teaming in Linux.

APA stands for Auto Port aggregation. It is software i.e. operating system level configuration which offers NIC (Network Interface Card also referred to as LAN card) redundancy. Under APA in HPUX, two NICs are configured together as a single virtual card at OS level. For OS, it’s a single NIC it’s talking to. But physically there are 2 NIC handling requests on this virtual card. On the occasion of hardware failure of anyone physical card, another physical card service OS (through virtual card) without hampering operations.

Complete guide : How to configure APA in HPUX

Normally, physical NICs are numbered as lan0, lan1, lan2, and so on. APA in HPUX terms new virtual cards as lan900, lan901, and so on. The current list of lan cards on the system can be obtained using the below command :

# ioscan -fnClan
Class     I  H/W Path    Driver S/W State   H/W Type     Description
=====================================================================
lan       0  2/0/0/1/0   igelan   CLAIMED     INTERFACE    HP PCI-X 1000Base-T Built-in
lan       1  2/0/4/1/0   iether   CLAIMED     INTERFACE    HP A7012-60601 PCI/PCI-X 1000Base-T Dual-port Adapter
lan       2  2/0/4/1/1   iether   CLAIMED     INTERFACE    HP A7012-60601 PCI/PCI-X 1000Base-T Dual-port Adapter
lan       3  2/0/6/1/0   iether   CLAIMED     INTERFACE    HP A7012-60601 PCI/PCI-X 1000Base-T Dual-port Adapter

In the above output, you can see, the second column which shows lan number. So we have 4 lan cards numbering lan0 to lan3 here. But in this output, you won’t be able to see APA interfaces i.e. virtual NIC.

For checking APA interfaces you need to use lanscan command.

# lanscan -q
2
3
900
901   0  1
902
903
904

Here you can see lan0 and lan 1 combined together forms lan901 interface which is APA card. Since those are used in APA, you don’t see them as separate entries like lan2 and lan3. This way you can trace physical NIC and their respective virtual or APA interfaces.

Testing APA:

To test APA means to check if your network connectivity via APA interface is uninterrupted in case of one of the physical NIC failure.

You can test this by removing one of the NIC physically from the system board. But this is not recommended since abruptly removing cards from the board also invites un-foreseen hardware issues. So, to test APA we have to emulate NIC failure or shuts NIC down without touching hardware.

This can be achieved by resetting NIC using lanadmin command. Resetting NIC makes card unavailable/un-operational for few seconds. This time is enough for us to test APA in HPUX.

Complete test can be carried out in below order:

Identify IP defined on lan901 (our APA interface)
Keep continuous ping on for this IP
Reset lan0
Observe ping
Once lan0 comes back up reset lan1
Observe ping
Make sure both lan0 and lan1 are back online.

To reset lan you can use below command :

# lanadmin -r 0

To check if lan being reset is online or offline in APA

# lanscan -q
2
3
900
901   1   <<<< missing 0 means lan0 is offline

Repeat above command till lan901 shows 0 and 1 both interfaces.

During this test, you may observe one or two ping loss. This is due to APA shifting loads to the only available interface. This ping loss won’t hamper the operating environment because its far less than timeout values defined in software/tools used on OS. Hence redundancy is maintained in case of NIC failure.

Above test will fail i.e. you will completely lose ping to IP in the below scenarios :

Your APA configuration is erroneous
One or both lan interfaces are not configured properly at the network level (VLAN configurations)

How to rename logical volume in Linux and HPUX

2 Replies

Learn how to rename logical volume in Linux or Unix. Understand what happens in the background when you change the logical volume name of existing LVOL.

LVM i.e. logical volume manager is one of the widely used volume managers in Linux and Unix. A logical volume is a portion of the volume group which can be mounted on a mount point. Once mounted, space belonging to that logical volume is available for use to end-user.

In this post, we are going to see step by step how to rename logical volume. In Linux, lvrename is a direct command which does this stuff for you. But first, we will see how it works in the background so that you know the flow and you can rename LV even without lvrename command.

LV renaming procedure follows below flow :

Stop all user/app access to related mount point (on which lvol is mounted) using fuser
Un-mount LV using umount
Rename device names of lvol using mv
Mount LV using mount
Edit /etc/fstab entry related to this lvol using vi

Let’s see an example where we are renaming /dev/vg01/lvol1 which is mounted on /data to /dev/vg01/lvol_one. See the below output for the above-mentioned steps (HPUX console).

# bdf /data
/dev/vg01/lvol1 524288 49360 471256 9% /data
# fuser -cku /data
/data:   223412c(user1)
# umount /data
# mv /dev/vg01/lvol1 /dev/vg01/lvol_one
# mv /dev/vg01/rlvol1 /dev/vg01/rlvol_one
# mount /data
# bdf /data
/dev/vg01/lvol_one    524288    49360   471256  9%   /data

In the above output, you can see how we renamed logical volume just by renaming its device files.

In Linux, we have a single command lvrename which do all the above steps in the background for you. You just need to provide it with old and new lvol names along with the volume group where this lvol belongs. So, the above scenario will have below command –

# lvrename vg01 lvol1 lvol_one
  Renamed "lvol1" to "lvol_one" in volume group "vg01"

You can see in the output that single command renamed lvol1 to lvol_one! This command also supports below option :

-t For test
-v Verbose mode
-f Forceful operation
-d debug

How to establish passwordless ssh between two servers

Leave a reply

Step by step guide for establishing passwordless ssh between two Unix or Linux servers. Authenticate securely using public and private keys.

If you are working in an infra where there are hundreds of Linux or Unix servers running, then you must be having big-time while managing them. To deal with such a large number of servers, passwordless ssh becomes a must-do practice. Once you can achieve remote execution of scripts, commands, sync files via SCP, etc tasks with passwordless ssh very easily.

Passwordless ssh is not compromising on security. You will be using a pair of user-generated keys for authentication so your security is not compromised. It’s totally secured, the only thing is you are being authenticated already saved keys rather than a human entered password. This removes the dependency of entering a password and hence automatize the whole process non-interactively.

Also read : Run commands on multiple linux servers from Windows machine in one go

Update :

This is a very short and handy process to set up passwordless SSH between two servers.

kerneltalks1 : the server we are going to configure passwordless SSH from

kerneltalks2 : the server to which we need password less SSH

shrikant : the user ID for which password-less SSH needed from kerneltalks1 to kerneltalks2

On kernetalks1 (First server)

Generate SSH key using ssh-keygen command. Make sure you are logged in with user shrikant (your user for which password less ssh is needed)

[shrikant@kerneltalks1 ~]$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/shrikant/.ssh/id_rsa):
Created directory 'https://z5.kerneltalks.com/home/shrikant/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/shrikant/.ssh/id_rsa.
Your public key has been saved in /home/shrikant/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:VO+kDv6iXtglzlIeC9OslZK14jKSVoPJKMNevMS/pp8 shrikant@kerneltalks1
The key's randomart image is:
+---[RSA 2048]----+
|          .      |
|         . .     |
|        o   o    |
|.ooo   * o +     |
|+.+=o * S o .    |
|o.oooo / B       |
| .+.o.= O .      |
| . . +oo..       |
|   .+Eo. ..      |
+----[SHA256]-----+

Now, you need to copy this generated key to target server i.e. kerneltalks2. Copy key using ssh-copy-id command.

[shrikant@kerneltalks1 ~]$ ssh-copy-id kerneltalks2
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/shrikant/.ssh/i                                                                                        d_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out                                                                                         any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted n                                                                                        ow it is to install the new keys
shrikant@kerneltalks2's password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'kerneltalks2'"
and check to make sure that only the key(s) you wanted were added.

And that’s it. You have configured password-less SSH by just 2 commands from one server. You can test it out by doing simply ssh and it should not ask you for any password!

[shrikant@kerneltalks1 ~]$ ssh kerneltalks2
[shrikant@kerneltalks2 ~]$ hostname
kerneltalks2
[shrikant@kerneltalks2 ~]$ id
uid=1001(shrikant) gid=1002(shrikant) groups=1002(shrikant) context=unconfined_u                                                                                        :unconfined_r:unconfined_t:s0-s0:c0.c1023
[shrikant@kerneltalks2 ~]$ exit
logout
Connection to kerneltalks2 closed.

All the above processes can be chopped into smaller chunks and manual commands to understand what actually happens in the background. Follow the below manual setup to configure passwordless ssh access.

Lets see how to setup password less ssh between two servers:

Step 1:

Create your SSH key pair on the source machine. This is a machine from which you will be doing password less SSH to the destination machine.

Use below command :

$ ssh-keygen -t rsa

Generating public/private rsa key pair.
Enter file in which to save the key (/home/user4/.ssh/id_rsa):
Created directory 'https://z5.kerneltalks.com/home/user4/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user4/.ssh/id_rsa.
Your public key has been saved in /home/user4/.ssh/id_rsa.pub.
The key fingerprint is:
ad:1e:14:a5:cd:77:25:29:9f:75:ee:4f:a4:8f:f5:65 user4@server1
The key's randomart image is:
+--[ RSA 2048]----+
|          .   ...|
|         =  . .oo|
|        o o .o.+.|
|         o . .o o|
|        S .    + |
|       . .    . E|
|        o      *+|
|       . .    . +|
|        .        |
+-----------------+

Note that your key pair is id_rsa and id_rsa.pub files in shown directories. Your id_rsa is a private key that will reside on the source machine. id_rsa.pub is a public key that resides on the destination machine. When the SSH attempt is made from source to destination, protocol checks these both keys from source and destination. If they match then the connection will be established without asking a password.

Step 2:

Now, we need to copy id_rsa.pub key on the destination machine. It should be copied to the home directory of the intended user in the destination server. It should reside under ~/.ssh/ (i.e. home directory/.ssh/) and with name authorized_keys. You can copy the file using a shell or any other file transfer program.

If you are trying from source machine using ssh then use below commands:

$ ssh user4@10.10.4.12 "mkdir ~/.ssh"
The authenticity of host '10.10.4.12 (10.10.4.12)' can't be established.
RSA key fingerprint is 08:6c:51:09:9f:4c:69:34:84:ef:08:af:68:df:5e:24.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.10.4.12' (RSA) to the list of known hosts.
user4@10.10.4.12's password:
$ cat .ssh/id_rsa.pub | ssh user4@10.10.4.12 'cat >> .ssh/authorized_keys'
user4@10.10.4.12's password:
$ ssh user4@10.10.4.12 "chmod 700 .ssh; chmod 640 .ssh/authorized_keys"
user4@10.10.4.12's password:

Here, the first command creates .ssh directory on the destination machine. Second command copies id_rs.pub file’s content to destination machine under file ~/.ssh/authorized_keys and last command sets proper permissions.

Step 3:

You are done! Try SSH from source to destination and it will be through without password!

$ ssh user4@10.10.4.12
Last login: Tue Oct  6 21:59:00 2015 from 10.10.4.11
[user4@server2 ~]$

This method works for all Linux and Unix variants for SSH protocol. You can also configure it for different users on the source and destination. One machine can have more than one authorized key (one key for one source machine), that’s why we have concatenated id_rsa.pub content to authorized_keys file (not overwrite).

Drop us any suggestions/corrections you have in comments.

Kernel Talks

Unix, Linux, & Cloud!

Recover forgotten root password in RHEL with screenshots

1. Edit boot kernel path

2. Boot kernel into single user mode

3. Reset root password

4. Get into multi user mode

How to extend the file system online in LVM

Pre-requisite :

How to do it :

Final check :

Logs under /var/stm/logs/os in HPUX

What are these logs under /var/stm/logs/os :

How to read these logs :

Should I purge or zip /var/stm/logs/os logs ?

Blog enhancements for better speed and cleaner looks

How to learn, practice HPUX online

Own HP Hardware:

Online HPUX servers:

Online courses :

Online study material :

Conclusion :

HPUX: Add persistent device names in VG

Adding persistent devices in VG :

How to check and test APA in HPUX

Testing APA:

How to rename logical volume in Linux and HPUX