nerdexam
IBM

000-221 · Question #154

Automated scripts on an AIX system require secure non-root access to another AIX instance. Secure Shell (SSH) was the method chosen and installed on both systems. How can an administrator use SSH to…

The correct answer is D. issue ssh-keygen -t dsa on the source as non-root user append source id_dsa.pub contents to. SSH DSA key-based authentication allows automated scripts to connect securely as a non-root user without embedding passwords, by distributing the public key to the destination's authorized_keys file.

Security

Question

Automated scripts on an AIX system require secure non-root access to another AIX instance. Secure Shell (SSH) was the method chosen and installed on both systems. How can an administrator use SSH to create secure automated jobs without storing passwords in the automated scripts?

Options

  • Aissue ssh-keygen -t dsa on the source as non-root user append source id_dsa.pub contents to
  • Bissue ssh-keygen -t dsa on the source as root append source id_dsa.pub contents to /etc/ssh/
  • Cissue ssh-keygen -t dsa on the source as non-root user append source id_dsa.pub contents to
  • Dissue ssh-keygen -t dsa on the source as non-root user append source id_dsa.pub contents to

How the community answered

(46 responses)
  • A
    9% (4)
  • B
    15% (7)
  • C
    2% (1)
  • D
    74% (34)

Why each option

SSH DSA key-based authentication allows automated scripts to connect securely as a non-root user without embedding passwords, by distributing the public key to the destination's authorized_keys file.

Aissue ssh-keygen -t dsa on the source as non-root user append source id_dsa.pub contents to

This option specifies an incorrect or incomplete destination path for the authorized_keys file, which must reside in the target user's ~/.ssh/ directory to function correctly.

Bissue ssh-keygen -t dsa on the source as root append source id_dsa.pub contents to /etc/ssh/

Generating the key as root and placing it under /etc/ssh/ is incorrect because the question requires non-root access, and system-wide key files in /etc/ssh/ are not used for per-user passwordless authentication.

Cissue ssh-keygen -t dsa on the source as non-root user append source id_dsa.pub contents to

This option points to an incorrect destination path for the authorized_keys file on the remote system, which would prevent the public key from being recognized during authentication.

Dissue ssh-keygen -t dsa on the source as non-root user append source id_dsa.pub contents toCorrect

Running ssh-keygen -t dsa as the non-root user on the source system generates an id_dsa private key and id_dsa.pub public key in ~/.ssh/. Appending id_dsa.pub to the target non-root user's ~/.ssh/authorized_keys on the destination enables fully passwordless, key-based SSH authentication, satisfying both the security requirement and the need to avoid storing passwords in automated scripts.

Concept tested: SSH passwordless key-based authentication for automated jobs

Source: https://www.ibm.com/docs/en/aix/7.3?topic=s-ssh-keygen-command

Topics

#SSH#key-based authentication#ssh-keygen#passwordless login

Community Discussion

No community discussion yet for this question.

Full 000-221 Practice