Linux Notes: Configuring ssh2 for sftp, scp, rsync, etc.

  1. The information presented here is intended for educational use by qualified computer technologists.
  2. The information presented here is provided free of charge, as-is, with no warranty of any kind.
  • Introduction to SSH / SSH2 (caveat: nothing to do with SSL)
    • related utilities
    • public-key problems
    • private-key problems
  • ssh2 on CentOS-7.5 and higher (2019-09-23)
  • rsync on AlmaLinux-8 and higher (2026-08-15)
  • Links
Edit: 2026-08-15

SSH and SSH2

Modes

  1. In default out-of-the-box mode, these technologies encrypt your ssh-based connection to conceal everything including the connect password. Most interactive users using ssh client will not need to go beyond this mode. BTW, I doubt you will ever find telnet or ftp installed in modern Linux systems because passwords are sent unencrypted. However, Installing telnet and ftp clients is child's play. Installing their server counterparts (telnetd and ftpd) is easy but getting them to work properly requires changes to the software firewall via "firewall-cmd" and SELinux (and you are insane if you ever disable these two security modules)
     
  2. You can go one step further and deposit YOUR public key at a remote location so you will not need a password (the private-public key replaces the password associated with the account in the remote OS). This is a prerequisite for doing autonomous non-interactive (batch) transfers from programs like sftp and rsync. Initially the far-end administrator will provide you with a 24-hour temporary account and password which will only be used by you to setup the ssh or ssh2 accounts.
     
  3. If you like, you can encode a pass-phrase in your private key (this will foil an evil system admin on your client platform) but this is not allowed when setting up Secure Shell for use with autonomous non-interactive (batch) transfers.

Related Utilities

ssh2 on CentOS-7.5 and higher (2019-09-23)

# =============================================================================
# title  : ssh-help.txt
# author : Neil Rieck
# created: 2019-09-23
# edit   : 2019-09-23
# target : CentOS-7.5 to CentOS-7.5
# purpose:
# 1) Shell scripts containing a list of rsync, sftp and scp commands, when run
#    from cron, must never be presented with a password prompt.
# 2) This file describes steps to allow user-A on system-A to connect as
#    user-B on system-B without a password (authentication is now done by a
#    public-private key pair)
# 3) CAVEAT: you may need to modify "/etc/ssh/ssh_config" of the local client machine
#    as well as "/etc/ssh/sshd_config" of the remote server machine
# a) /etc/ssh/ssh_config
#    Uncomment these lines:
#       IdentityFile ~/.ssh/identity	# recommended for ssh2
#       IdentityFile ~/.ssh/id_rsa	# recommended for ssh2
# b) /etc/ssh/sshd_config
#    Uncomment these lines:
#       PubkeyAuthentication yes	# required
#       PermitRootLogin yes		# optional
#    Caveat: remember to restart sshd after changes here
# =============================================================================
#
#	STEP-01 (optional; only do once)
#
# 1) this next command will create two files:
#	.ssh2/id_rsa
#	.ssh2/id_rsa.pub
#
ssh-keygen
#
#	STEP-02 (recommended)
#
# 1) create a specific public-private key pair for use by root when 
#    connecting from kawc4n to kawc4m. Use one of these filename formats:
#	username_source_destination
#	username_on_source
# 2) In 2019 you might find DSA disabled so just use RSA where possible
# 3) when prompted, do not enter a passphrase
#
ssh-keygen -t rsa -b 1024 -f ~/.ssh/root_on_kawc4n
#
#       STEP-03 (configure client side)
#
cd .ssh						# drop down one level
cat id_rsa         >> identity			# copy private key into identity (a one-line payload)
cat root_on_kawc4n >> identity			# copy private key into identity
#
#	STEP-04 (copy public key(s) but do not use ssh-copy-id)
#
# 1) copy public key(s) to the remote site
#
ls -la
   drwx------.  2 root root  129 Sep 23 16:38 .
   dr-xr-x---. 19 root root 4096 Sep 23 16:38 ..
   -rw-------.  1 root root 1679 Sep 23 16:09 identity
   -rw-------.  1 root root 1679 Sep 23 14:00 id_rsa
   -rw-r--r--.  1 root root  393 Sep 23 14:00 id_rsa.pub
   -rw-r--r--.  1 root root  195 Sep 23 12:54 known_hosts
   -rw-------.  1 root root 1679 Sep 23 16:09 root_on_kawc4n
   -rw-------.  1 root root  393 Sep 23 12:38 root_on_kawc4n.pub
sftp root@kawc4m.on.bell.ca			# connect via sftp
put root_on_kawc4n.pub				# recommended push
put id_rsa.pub					# optional push
exit						# log out (drop back to kawc4n)
cd ..						# navigate back up one level
#
#	STEP-05 (config the remote end)
#
ssh root@kawc4m.on.bell.ca			# connect via ssh to server
ls -la *.pub					# view public key files
cat root_on_kawc4n.pub >> .ssh/authorized_keys	# copy public into here
cat id_rsa.pub         >> .ssh/authorized_keys	# copy public into here
rm *.pub                                        # delete public keys
exit						# log out (drop back to client)
#
#	STEP-6 (final test)
#
ssh root@kawc4m.on.bell.ca			# you should not see a password prompt
#
#	STEP-7 (debug; if something went wrong)
#
ssh root@kawc4m.on.bell.ca -v			# -v -vv -vvv for more debugging messages
#

rsync on AlmaLinux-8 and higher (2026-08-15)

Notes: 
# local machine : local
# local OS      : Linux Mint-22.3 
# local user    : root
# remote machine: neilrieck.net
# remote OS     : AlmaLinux-8.10
# remote user   : janitor
# ========================================================================
# legend:
#   <enter>  = hit the Enter key
#   <escape> = hit the Escape key
#   <:>      = hit the colon key
#   <i>      = hit the "i" key
# ========================================================================
# 1) OPTIONAL: generate a new public-private key pair (if you do not already have one)
[root@local ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
[... verbage ensues ...]
# 2) use ssh to install your public key in the destination account
[root@local ~]ssh-copy-id -n janitor@neilrieck.net	# -n does a dry run
[... verbage ensues ...]
[root@local ~]ssh-copy-id    janitor@neilrieck.net	# MAGIC happens here
[... verbage ensues ...]
# 3) ensure you can connect to the remote system without a password
[root@local ~]ssh janitor@neilrieck.net
# 4) on the remote system, drop a file named janitor into folder "/etc/sudoers.d"
#    caveat:	1) you must use editor "visudo" (not vi or vim)
#		2) if you do not know how to use this editor, talk to a nerd
[janitor@neilrieck.net]sudo visudo /etc/sudoers.d/janitor
# now enter insert mode by hitting the <i> key then enter the following line
janitor ALL=(ALL) NOPASSWD: /usr/bin/rsync
# now exit insert mode by hitting the <escape> key
# now enter command mode by hitting the <:> key
# now write file the exit the editor by hitting: <w><q><enter>
# now leave this remote system then fall back to the original local system
exit
# 5) now do several backup commands:
#    rsync switches:	-a (archive)
#			-X (preserve meta-data including SELinux stuff)
#			-v (verbose)
#			-z (compress for transfer)
#			-P (show progress)
rsync -aXvzP -rsync="sudo rsync" janitor@neilrieck.net:/etc	/backup
rsync -aXvzP -rsync="sudo rsync" janitor@neilrieck.net:/root	/backup
rsync -aXvzP -rsync="sudo rsync" janitor@neilrieck.net:/home	/backup
rsync -aXvzP -rsync="sudo rsync" janitor@neilrieck.net:/var/www	/backup
# =====================================================================
# if you are ever prompted for a password, then you have made a mistake

Links

Back to Home
Neil Rieck
Waterloo, Ontario, Canada.