如何将自己的公钥添加到Vagrant VM？

I got a problem with adding an ssh key to a Vagrant VM. Basically the setup that I have here works fine. Once the VMs are created, I can access them via vagrant ssh, the user "vagrant" exists and there's an ssh key for this user in the authorized_keys file.

我在向Vagrant VM添加ssh密钥时遇到了问题。基本上我在这里的设置工作正常。创建虚拟机后,我可以通过vagrant ssh访问它们,用户“vagrant”存在,并且在authorized_keys文件中有该用户的ssh密钥。

What I'd like to do now is: to be able to connect to those VMs via ssh or use scp. So I would only need to add my public key from id_rsa.pub to the authorized_keys - just like I'd do with ssh-copy-id.

我现在要做的是:能够通过ssh连接到这些VM或使用scp。所以我只需要将我的公钥从id_rsa.pub添加到authorized_keys - 就像我使用ssh-copy-id一样。

Is there a way to tell Vagrant during the setup that my public key should be included? If not (which is likely, according to my google results), is there a way to easily append my public key during the vagrant setup?

有没有办法告诉Vagrant在设置过程中应该包含我的公钥?如果没有(根据我的谷歌搜索结果,可能是这样),有没有办法在流浪汉设置过程中轻松附加我的公钥?

11 个解决方案

#1

Copying the desired public key would fall squarely into the provisioning phase. The exact answer depends on what provisioning you fancy to use (shell, Chef, Puppet etc). The most trivial would be a file provisioner for the key, something along this:

复制所需的公钥将完全属于配置阶段。确切的答案取决于您想要使用的配置(shell,Chef,Puppet等)。最琐碎的是密钥的文件配置器,其中包括:

config.vm.provision "file", source: "~/.ssh/id_rsa.pub", destination: "~/.ssh/me.pub"

Well, actually you need to append to authorized_keys, use a true provisioner, like Puppet. For example see Managing SSH Authorized Keys with Puppet.

好吧,实际上你需要附加到authorized_keys,使用真正的配置器,比如Puppet。例如,请参阅使用Puppet管理SSH授权密钥。

#2

You can use Ruby's core File module, like so:

您可以使用Ruby的核心File模块,如下所示:

  config.vm.provision "shell" do |s|
    ssh_pub_key = File.readlines("#{Dir.home}/.ssh/id_rsa.pub").first.strip
    s.inline = <<-SHELL
      echo #{ssh_pub_key} >> /home/vagrant/.ssh/authorized_keys
      echo #{ssh_pub_key} >> /root/.ssh/authorized_keys
    SHELL
  end

This working example appends ~/.ssh/id_rsa.pub to the ~/.ssh/authorized_keys of both the vagrant and root user, which will allow you to use your existing SSH key.

这个工作示例将〜/ .ssh / id_rsa.pub附加到vagrant和root用户的〜/ .ssh / authorized_keys,这将允许您使用现有的SSH密钥。

#3

There's a more "elegant" way of accomplishing what you want to do. You can find the existing private key and use it instead of going through the trouble of adding your public key.

有一种更“优雅”的方式来完成你想做的事情。您可以找到现有的私钥并使用它,而不是经历添加公钥的麻烦。

Proceed like this to see the path to existing private key (look below for IdentityFile):

像这样继续查看现有私钥的路径(请参见下面的IdentityFile):

run

 vagrant ssh-config 

result:

$ vagrant ssh-config
Host magento2.vagrant150
  HostName 127.0.0.1
  User vagrant
  Port 3150
  UserKnownHostsFile /dev/null
  StrictHostKeyChecking no
  PasswordAuthentication no
  IdentityFile "/Users/madismanni/m2/vagrant-magento/.vagrant/machines/magento2.vagrant150/virtualbox/private_key"
  IdentitiesOnly yes
  LogLevel FATAL

Then you can use the private key like this, note also the switch for switching off password authentication

然后你可以像这样使用私钥,还要注意关闭密码验证的开关

ssh -i /Users/madismanni/m2/vagrant-magento/.vagrant/machines/magento2.vagrant150/virtualbox/private_key -o PasswordAuthentication=no vagrant@127.0.0.1 -p 3150

#4

I end up using code like:

我最终使用的代码如下:

config.ssh.forward_agent    = true
config.ssh.insert_key       = false
config.ssh.private_key_path =  ["~/.vagrant.d/insecure_private_key","~/.ssh/id_rsa"]
config.vm.provision :shell, privileged: false do |s|
  ssh_pub_key = File.readlines("#{Dir.home}/.ssh/id_rsa.pub").first.strip
  s.inline = <<-SHELL
     echo #{ssh_pub_key} >> /home/$USER/.ssh/authorized_keys
     sudo bash -c "echo #{ssh_pub_key} >> /root/.ssh/authorized_keys"
  SHELL
end

Note that we should not hard code path to /home/vagrant/.ssh/authorized_keys since some vagrant boxes not using the vagrant username.

请注意,我们不应该硬编码/home/vagrant/.ssh/authorized_keys的路径,因为有些流浪盒不使用vagrant用户名。

#5

This excellent answer was added by user76329 in a rejected Suggested Edit

Expanding on Meow's example, we can copy the local pub/private ssh keys, set permissions, and make the inline script idempotent (runs once and will only repeat if the test condition fails, thus needing provisioning):

扩展Meow的示例,我们可以复制本地pub / private ssh密钥,设置权限,并使内联脚本具有幂等性(运行一次,只有在测试条件失败时才会重复,因此需要配置):

config.vm.provision "shell" do |s|
  ssh_prv_key = ""
  ssh_pub_key = ""
  if File.file?("#{Dir.home}/.ssh/id_rsa")
    ssh_prv_key = File.read("#{Dir.home}/.ssh/id_rsa")
    ssh_pub_key = File.readlines("#{Dir.home}/.ssh/id_rsa.pub").first.strip
  else
    puts "No SSH key found. You will need to remedy this before pushing to the repository."
  end
  s.inline = <<-SHELL
    if grep -sq "#{ssh_pub_key}" /home/vagrant/.ssh/authorized_keys; then
      echo "SSH keys already provisioned."
      exit 0;
    fi
    echo "SSH key provisioning."
    mkdir -p /home/vagrant/.ssh/
    touch /home/vagrant/.ssh/authorized_keys
    echo #{ssh_pub_key} >> /home/vagrant/.ssh/authorized_keys
    echo #{ssh_pub_key} > /home/vagrant/.ssh/id_rsa.pub
    chmod 644 /home/vagrant/.ssh/id_rsa.pub
    echo "#{ssh_prv_key}" > /home/vagrant/.ssh/id_rsa
    chmod 600 /home/vagrant/.ssh/id_rsa
    chown -R vagrant:vagrant /home/vagrant
    exit 0
  SHELL
end

#6

A shorter and more correct code should be:

更短更正确的代码应该是:

ssh_pub_key = File.readlines("#{Dir.home}/.ssh/id_rsa.pub").first.strip
config.vm.provision 'shell', inline: 'mkdir -p /root/.ssh'
config.vm.provision 'shell', inline: "echo #{ssh_pub_key} >> /root/.ssh/authorized_keys"
config.vm.provision 'shell', inline: "echo #{ssh_pub_key} >> /home/vagrant/.ssh/authorized_keys", privileged: false

Otherwise user's .ssh/authorized_keys will belong to root user.

否则用户的.ssh / authorized_keys将属于root用户。

Still it will add a line at every provision run, but Vagrant is used for testing and a VM usually have short life, so not a big problem.

它仍然会在每次提供运行时添加一行,但Vagrant用于测试,而VM通常寿命较短,因此不是一个大问题。

#7

This is an excellent thread that helped me solve a similar situation as the original poster describes.

这是一个很好的线程,帮助我解决了原始海报描述的类似情况。

While I ultimately used the settings/logic presented in smartwjw’s answer, I ran into a hitch since I use the VAGRANT_HOME environment variable to save the core vagrant.d directory stuff on an external hard drive on one of my development systems.

虽然我最终使用了smartwjw的回答中提供的设置/逻辑,但我遇到了一个障碍,因为我使用VAGRANT_HOME环境变量将核心vagrant.d目录内容保存在我的一个开发系统上的外部硬盘上。

So here is the adjusted code I am using in my Vagrantfile to accommodate for a VAGRANT_HOME environment variable being set; the “magic” happens in this line vagrant_home_path = ENV["VAGRANT_HOME"] ||= "~/.vagrant.d":

所以这里是我在Vagrantfile中使用的调整后的代码,以适应正在设置的VAGRANT_HOME环境变量; “魔法”发生在这一行vagrant_home_path = ENV [“VAGRANT_HOME”] || =“〜/ .vagrant.d”:

config.ssh.insert_key = false
config.ssh.forward_agent = true
vagrant_home_path = ENV["VAGRANT_HOME"] ||= "~/.vagrant.d"
config.ssh.private_key_path = ["#{vagrant_home_path}/insecure_private_key", "~/.ssh/id_rsa"]
config.vm.provision :shell, privileged: false do |shell_action|
  ssh_public_key = File.readlines("#{Dir.home}/.ssh/id_rsa.pub").first.strip
  shell_action.inline = <<-SHELL
    echo #{ssh_public_key} >> /home/$USER/.ssh/authorized_keys
  SHELL
end

#8

For the inline shell provisioners - it is common for a public key to contains spaces, comments, etc. So make sure to put (escaped) quotes around the var that expands to the public key:

对于内联shell配置程序 - 公钥通常包含空格,注释等。因此,请确保在扩展为公钥的var周围放置(转义)引号:

config.vm.provision 'shell', inline: "echo \"#{ssh_pub_key}\" >> /home/vagrant/.ssh/authorized_keys", privileged: false

#9

None of the older posts worked for me although some came close. I had to make rsa keys with keygen in the terminal and go with custom keys. In other words defeated from using Vagrant's keys.

虽然有些帖子很接近,但没有一篇较旧的帖子对我有用。我必须在终端中使用keygen创建rsa密钥并使用自定义密钥。换句话说,不使用Vagrant的密钥。

I'm on Mac OS Mojave as of the date of this post. I've setup two Vagrant boxes in one Vagrantfile. I'm showing all of the first box so newbies can see the context. I put the .ssh folder in the same folder as the Vagrant file, otherwise use user9091383 setup.

截至本文发表之日,我在Mac OS Mojave上。我在一个Vagrantfile中设置了两个Vagrant盒子。我正在展示所有第一个框,所以新手可以看到上下文。我将.ssh文件夹放在与Vagrant文​​件相同的文件夹中,否则使用user9091383安装程序。

Credit for this solution goes to this coder.

这个解决方案归功于这个解决方案。

Vagrant.configure("2") do |config|
  config.vm.define "pfbox", primary: true do |pfbox|
        pfbox.vm.box = "ubuntu/xenial64"
        pfbox.vm.network "forwarded_port", host: 8084, guest: 80
        pfbox.vm.network "forwarded_port", host: 8080, guest: 8080
        pfbox.vm.network "forwarded_port", host: 8079, guest: 8079
        pfbox.vm.network "forwarded_port", host: 3000, guest: 3000
        pfbox.vm.provision :shell, path: ".provision/bootstrap.sh"
        pfbox.vm.synced_folder "ubuntu", "/home/vagrant"
        pfbox.vm.provision "file", source: "~/.gitconfig", destination: "~/.gitconfig"
        pfbox.vm.network "private_network", type: "dhcp"
        pfbox.vm.network "public_network"
        pfbox.ssh.insert_key = false
        ssh_key_path = ".ssh/"  # This may not be necessary.  I may remove.
        pfbox.vm.provision "shell", inline: "mkdir -p /home/vagrant/.ssh"
        pfbox.ssh.private_key_path = ["~/.vagrant.d/insecure_private_key", ".ssh/id_rsa"]
        pfbox.vm.provision "file", source: ".ssh/id_rsa.pub", destination: ".ssh/authorized_keys"
        pfbox.vm.box_check_update = "true"
        pfbox.vm.hostname = "pfbox"
        # VirtualBox
          config.vm.provider "virtualbox" do |vb|
            # vb.gui = true
            vb.name = "pfbox" # friendly name for Oracle VM VirtualBox Manager
            vb.memory = 2048 # memory in megabytes 2.0 GB
            vb.cpus = 1 # cpu cores, can't be more than the host actually has.
          end
  end
  config.vm.define "dbbox" do |dbbox|
        ...

#10

Madis Maenni answer is closest to best solution:

Madis Maenni回答最接近最佳解决方案:

just do:

vagrant ssh-config >> ~/.ssh/config
chmod 600 ~/.ssh/config

then you can just ssh via hostname.

然后你可以通过主机名ssh。

To get list of hostnames configured in ~/.ssh/config

获取〜/ .ssh / config中配置的主机名列表

grep -E '^Host ' ~/.ssh/config

My example:

$ grep -E '^Host' ~/.ssh/config
Host web
Host db
$ ssh web
[vagrant@web ~]$

#11

Generate a rsa key pair for vagrant authentication ssh-keygen -f ~/.ssh/vagrant

生成用于流浪者身份验证的rsa密钥对ssh-keygen -f~ / .ssh / vagrant

You might also want to add the vagrant identity files to your ~/.ssh/config

您可能还想将vagrant身份文件添加到〜/ .ssh / config

IdentityFile ~/.ssh/vagrant
IdentityFile ~/.vagrant.d/insecure_private_key

For some reason we can't just specify the key we want to insert so we take a few extra steps to generate a key ourselves. This way we get security and knowledge of exactly which key we need (+ all vagrant boxes will get the same key)

出于某种原因,我们不能只指定我们想要插入的键,所以我们采取一些额外的步骤来自己生成一个键。通过这种方式,我们可以获得确切知识所需的安全性和知识(+所有流浪盒都将获得相同的密钥)

Can't ssh to vagrant VMs using the insecure private key (vagrant 1.7.2) How do I add my own public key to Vagrant VM?

无法使用不安全的私钥ssh到vagrant VM(vagrant 1.7.2)如何将自己的公钥添加到Vagrant VM?

config.ssh.insert_key = false
config.ssh.private_key_path = ['~/.ssh/vagrant', '~/.vagrant.d/insecure_private_key']
config.vm.provision "file", source: "~/.ssh/vagrant.pub", destination: "/home/vagrant/.ssh/vagrant.pub"
config.vm.provision "shell", inline: <<-SHELL
cat /home/vagrant/.ssh/vagrant.pub >> /home/vagrant/.ssh/authorized_keys
mkdir -p /root/.ssh
cat /home/vagrant/.ssh/authorized_keys >> /root/.ssh/authorized_keys

SHELL