Question

我正在为OpenShift项目使用rhc cli工具。我遇到了默认rhc ssh密钥的问题。

在任何ssh相关操作（setup，app-create等等）上，如果不存在，rhc会创建~/.ssh/id_rsa密钥。我不喜欢这种行为，我希望它能使用像~/.ssh/OpenShift-SSH-Keys/my_id_rsa这样的东西。

因为在rhc设置期间，它没有问我从哪个位置加载密钥。因此，我也查看了~/.openshift/express.conf，我只看到了ssl的配置;不是ssh。

所以我在互联网上找到了以下配置行添加到~/.openshift/express.conf：

ssh_key_file='~/.ssh/OpenShift-SSH-Keys/my_id_rsa'

我添加了它并修改了我的~/.ssh/config文件：

# Openshift *.rhcloud.com ssh-key config
Host *.rhcloud.com
         IdentityFile ~/.ssh/OpenShift-SSH-Keys/my_id_rsa
         IdentitiesOnly yes
         VerifyHostKeyDNS yes
         StrictHostKeyChecking no
         PasswordAuthentication no
         UserKnownHostsFile ~/.ssh/known_hosts

要完成我设置我的帐户：

rhc setup --config ~/.openshift/express.conf -l myusername@gmail.com

此命令行的输出：

OpenShift Client Tools (RHC) Setup Wizard

This wizard will help you upload your SSH keys, set your application namespace, and check that other programs like Git are
properly installed.

If you have your own OpenShift server, you can specify it now. Just hit enter to use the server for OpenShift Online:
openshift.redhat.com.
Enter the server hostname: |openshift.redhat.com| 

You can add more servers later using 'rhc server'.

Using myusername@gmail.com to login to openshift.redhat.com
RSA 1024 bit CA certificates are loaded due to old openssl compatibility
Password: ************************

OpenShift can create and store a token on disk which allows to you to access the server without using your password. The
key is stored in your home directory and should be kept secret.  You can delete the key at any time by running 'rhc
logout'.
Generate a token now? (yes|no) yes
Generating an authorization token for this client ... RSA 1024 bit CA certificates are loaded due to old openssl compatibility
lasts 29 days

Saving configuration to /Users/theuser/.openshift/express.conf ... done

No SSH keys were found. We will generate a pair of keys for you.

    Created: /Users/theuser/.ssh/id_rsa.pub

Your public SSH key must be uploaded to the OpenShift server to access code.  Upload now? (yes|no) no

You can upload your public SSH key at a later time using the 'rhc sshkey' command

Checking for git ... found git version 2.5.0

Checking common problems .. done

Checking for a domain ... mydomainz1955

Checking for applications ... found 1

  myapp http://myapp-mydomainz1955.rhcloud.com/

  You are using 2 of 3 total gears
  The following gear sizes are available to you: small

Your client tools are now configured.

正如您在命令行的输出中看到的那样：No SSH keys were found. We will generate a pair of keys for you.虽然我在~/.openshift/express.conf中指定我已经生成了ssh密钥，但rhc setup没有将它们考虑在内或者没有找到它们。

所以根据你们的说法，是否有可能以某种方式为rhc设置期间的ssh密钥加载指定不同的位置？

注意：我知道如何添加额外的ssh密钥，但我想停止rhc创建/使用~/.ssh/id_rsa

Answer 1

据我所知，您只希望rhc不使用默认的ssh密钥。所以这里是你如何创建一个单独的密钥并配置rhc来使用它而不是默认密钥。

要点是：

您选择no在rhc setup
您可以使用rhc sshkey add
您将ssh配置为使用该域的不同密钥在原始示例中列出

这是否涵盖您的顾虑？

[crackit@koTapaH ~]$ mkdir /home/crackit/my_key_location
[crackit@koTapaH ~]$ ssh-keygen 
Generating public/private rsa key pair.
Enter file in which to save the key (/home/crackit/.ssh/id_rsa): /home/crackit/my_key_location/key.rsa
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/crackit/my_key_location/key.rsa.
Your public key has been saved in /home/crackit/my_key_location/key.rsa.pub.
The key fingerprint is:
c5:20:15:fb:17:96:86:8f:88:28:18:17:2a:b8:eb:51 crackit@koTapaH
The key's randomart image is:
+--[ RSA 2048]----+
|  .   ..+.       |
|.. .   . + . .   |
|= .     . + =    |
|.=   . . + = .   |
|o .E. . S o o    |
| ...       .     |
|..               |
|. .              |
| .               |
+-----------------+
[crackit@koTapaH ~]$ rhc setup
OpenShift Client Tools (RHC) Setup Wizard

This wizard will help you upload your SSH keys, set your application namespace,
and check that other programs like Git are properly installed.

If you have your own OpenShift server, you can specify it now. Just hit enter to
use the server for OpenShift Online: openshift.redhat.com.
Enter the server hostname: |openshift.redhat.com| 

You can add more servers later using 'rhc server'.

Login to openshift.redhat.com: 
Login to openshift.redhat.com: asdfgg@example.com
Password: *************

OpenShift can create and store a token on disk which allows to you to access the
server without using your password. The key is stored in your home directory and
should be kept secret.  You can delete the key at any time by running 'rhc
logout'.
Generate a token now? (yes|no) yes
Generating an authorization token for this client ... lasts about 1 month

Saving configuration to /home/crackit/.openshift/express.conf ... done

No SSH keys were found. We will generate a pair of keys for you.

    Created: /home/crackit/.ssh/id_rsa.pub

Your public SSH key must be uploaded to the OpenShift server to access code.
Upload now? (yes|no)
no

You can upload your public SSH key at a later time using the 'rhc sshkey'
command

Checking for git ... found git version 2.1.0

Checking common problems .. done

Checking for a domain ... foobar

Checking for applications ... found 2

  jenkins http://jenkins-foobar.rhcloud.com/
  tmp     http://tmp-foobar.rhcloud.com/

  You are using 2 of 3 total gears
  The following gear sizes are available to you: small, medium

Your client tools are now configured.

[crackit@koTapaH ~]$ rhc sshkey add mykey my_key_location/key.rsa.pub 
RESULT:
SSH key my_key_location/key.rsa.pub has been added as 'mykey'

[crackit@koTapaH ~]$ vi .ssh/config
<.. do your modifications here ..>

[crackit@koTapaH ~]$ rhc ssh tmp
Connecting to 550000a0e0b8cdca4c000040@tmp-foobar.rhcloud.com ...

    *********************************************************************

    You are accessing a service that is for use only by authorized users.
    If you do not have authorization, discontinue use at once.
    Any use of the services is subject to the applicable terms of the
    agreement which can be found at:
    https://www.openshift.com/legal

    *********************************************************************

    Welcome to OpenShift shell

    This shell will assist you in managing OpenShift applications.

    !!! IMPORTANT !!! IMPORTANT !!! IMPORTANT !!!
    Shell access is quite powerful and it is possible for you to
    accidentally damage your application.  Proceed with care!
    If worse comes to worst, destroy your application with "rhc app delete"
    and recreate it
    !!! IMPORTANT !!! IMPORTANT !!! IMPORTANT !!!

    Type "help" for more info.


[tmp-foobar.rhcloud.com 550000a0e0b8cdca4c000040]\> exit
exit
Connection to tmp-foobar.rhcloud.com closed.
[crackit@koTapaH ~]$

更新：我没有注意到密钥已生成。但我确信在rhc setup期间生成的密钥实际上并未使用。首先，因为默认位置的密钥永远不会添加到openshift。你可以在下面看到一个快速证据。另一种看法是rhc sshkeys list。

另一件事是，如果您已经在默认位置使用了密钥，那么就不会生成任何密钥（在这种情况下，您仍然选择no来不上传它们）。但它实际上是rhc中的一个小错误IMO，即生成ssh密钥而不询问用户。这可能是一个非常罕见的用例 - 您没有默认密钥，并且您想要使用非标准位置的密钥（这不是您在标准位置拥有密钥的用例，只需要＆＃39 ; t想要使用它）但仍然IMO不应该生成用户没有请求的东西。所以我在这里向您展示我只使用了我想要的自定义键：

[crackit@koTapaH ~]$ rm -rf .ssh/id_rsa*
[crackit@koTapaH ~]$ rhc ssh tmp
Connecting to 550000a0e0b8cdca4c000040@tmp-foobar.rhcloud.com ...
<...>
    Type "help" for more info.


[tmp-foobar.rhcloud.com 550000a0e0b8cdca4c000040]\> exit
exit
Connection to tmp-foobar.rhcloud.com closed.
[crackit@koTapaH ~]$ ls .ssh/
config  known_hosts
[crackit@koTapaH ~]$

更新2 当然，令牌无法帮助您使用ssh：

[crackit@koTapaH ~]$ rm -rf my_key_location
[crackit@koTapaH ~]$ rhc ssh tmp
Connecting to 550000a0e0b8cdca4c000040@tmp-foobar.rhcloud.com ...
no such identity: /home/crackit/my_key_location/key.rsa: No such file or directory
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

SSH密钥用于ssh。令牌用于API请求。这些是不同的用例。 rhc使用下面的ssh可执行文件，因此使用自定义键意味着编辑~/.ssh/config以将默认密钥设置为其他位置或为不同主机设置不同的密钥。 rhc setup处理不好。但是，一旦你获得了密钥，你就不必再运行rhc setup了。

如何在rhc设置期间为ssh密钥加载指定不同的位置？

1 个答案: