You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
33 lines
1.4 KiB
33 lines
1.4 KiB
# Setup SSH key — root@10.100.1.24 (reverse-proxy / nginx + Docker) |
|
# SSOT: server-audit/docs/guide/ssh-access.md |
|
# Usage: .\server-connection\scripts\setup-ssh-reverse-proxy.ps1# Sekali jalan: minta password root 1x, lalu login key-only. |
|
|
|
$ErrorActionPreference = 'Stop' |
|
$hostIp = '10.100.1.24' |
|
$key = Join-Path $env:USERPROFILE '.ssh\id_rsa_geonet_laptop' |
|
$pub = "$key.pub" |
|
|
|
if (-not (Test-Path $pub)) { |
|
Write-Host "Generating key $key ..." |
|
ssh-keygen -t rsa -b 4096 -f $key -C 'geonet-laptop' -N '""' |
|
} |
|
|
|
Write-Host "Fixing private key ACL..." |
|
icacls $key /inheritance:r 2>$null | Out-Null |
|
icacls $key /grant:r "${env:USERNAME}:(R)" 2>$null | Out-Null |
|
|
|
Write-Host "Upload public key ke root@${hostIp} (password 1x)..." |
|
type $pub | ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no -m hmac-sha1 "root@${hostIp}" -p 22 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys && echo KEY_INSTALLED_OK" |
|
|
|
Write-Host "" |
|
Write-Host "Test key-only..." |
|
ssh -i $key -o BatchMode=yes -o IdentitiesOnly=yes -o PreferredAuthentications=publickey -m hmac-sha1 "root@${hostIp}" -p 22 "echo KEY_AUTH_OK" |
|
|
|
if ($LASTEXITCODE -ne 0) { |
|
Write-Host "" |
|
Write-Host "Masih gagal — cek auth log (password sekali):" |
|
Write-Host " ssh -m hmac-sha1 root@${hostIp} -p 22 `"grep sshd /var/log/secure | tail -20`"" |
|
exit 1 |
|
} |
|
|
|
Write-Host "Success. Login: ssh reverse-proxy"
|
|
|