I just implemented the passwordless SSH and it was fairly straightforward.
I mostly used the steps at
http://docs.hortonworks.com/HDPDocuments/Ambari-2.2.1.0/bk_Installing_HDP_AMB/content/_set_up_passwo... as first suggested by Artem in earlier thread. (I did a little short cut that made life a bit easier).
Here are the steps I did, with commentary on each.
Note: login to all hosts are as root.
On host of ambari
1. Create public and private keys
[ambarihost root]$ ssh-keygen
You will see the following. Note: for each prompt I hit enter (without entering anything). The result is that I will use the default filenames for the keys, and I will not require a password to open the private key file. (If you want to be more secure, enter a password when prompted).
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /Users/gkeys/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
+---[RSA 2048]----+
(rest of image not shown)
Note the location of the keys created.
id_rsa.pub is the ambari host's public key. It will need to be implemented on all hosts to be deployed in the cluster (see below)
id_rsa is the ambari host's private key. It will need to be uploaded when using the ambari wizard to deploy HDP
2. Write the public key into the authorized keystore (only needed if ambari server will host will be part of cluster -- usually not the case in production deployments but often so in dev environments)
[ambarihost root]$ cat ~/.ssh/d_rsa.pub >> ~/.ssh/authorized_keys
[Loop] On each host that will be part of the HDP cluster
3. create .ssh dir (if does not exist)
[targethost root]$ mkdir ~/.ssh
[End loop]
Back to the host of ambari
[Loop] Do for each host that will be part of your cluster
4. Remotely copy public key from ambari host to target host. This writes the public key to target's /root/.ssh/authorized_keys file, as with step (2) but remotely.
Note: <remote.target.host> is the ip address or hostname of the target host
[ambarihost root]$ ssh-copy-id root@<ip address>
You should see the follows. (Enter yes when prompted)
The authenticity of host '12.34.56.78 (12.34.56.78)' can't be established.
RSA key fingerprint is b1:2d:33:67:ce:35:4d:5f:f3:a8:cd:c0:c4:48:86:12.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '12.34.56.78' (RSA) to the list of known hosts.
user@12.34.56.78's password:
Now try logging into the machine, with "ssh 'root@<remote.target.host>'", and check in:
~/.ssh/authorized_keys
to make sure we haven't added extra keys that you weren't expecting.
5. Test that passwordless ssh now works, by sshing to the target host without being prompted for a password.
[ambarihost root]$ ssh root@<ipaddress>
You are successful if you are now on the target host and did not have to enter a password to get there.
6. To return to the ambari host, enter exit
[End loop]
Note:
Some versions of SSH require you to set permissions on each target host.
If you are not successful for step 5 above, log into the target host and run
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
(I did not have to do this)
