000-221 · Question #154
Automated scripts on an AIX system require secure non-root access to another AIX instance. Secure Shell (SSH) was the method chosen and installed on both systems. How can an administrator use SSH to…
The correct answer is D. issue ssh-keygen -t dsa on the source as non-root user append source id_dsa.pub contents to. SSH DSA key-based authentication allows automated scripts to connect securely as a non-root user without embedding passwords, by distributing the public key to the destination's authorized_keys file.
Question
Automated scripts on an AIX system require secure non-root access to another AIX instance. Secure Shell (SSH) was the method chosen and installed on both systems. How can an administrator use SSH to create secure automated jobs without storing passwords in the automated scripts?
Options
- Aissue ssh-keygen -t dsa on the source as non-root user append source id_dsa.pub contents to
- Bissue ssh-keygen -t dsa on the source as root append source id_dsa.pub contents to /etc/ssh/
- Cissue ssh-keygen -t dsa on the source as non-root user append source id_dsa.pub contents to
- Dissue ssh-keygen -t dsa on the source as non-root user append source id_dsa.pub contents to
How the community answered
(46 responses)- A9% (4)
- B15% (7)
- C2% (1)
- D74% (34)
Why each option
SSH DSA key-based authentication allows automated scripts to connect securely as a non-root user without embedding passwords, by distributing the public key to the destination's authorized_keys file.
This option specifies an incorrect or incomplete destination path for the authorized_keys file, which must reside in the target user's ~/.ssh/ directory to function correctly.
Generating the key as root and placing it under /etc/ssh/ is incorrect because the question requires non-root access, and system-wide key files in /etc/ssh/ are not used for per-user passwordless authentication.
This option points to an incorrect destination path for the authorized_keys file on the remote system, which would prevent the public key from being recognized during authentication.
Running ssh-keygen -t dsa as the non-root user on the source system generates an id_dsa private key and id_dsa.pub public key in ~/.ssh/. Appending id_dsa.pub to the target non-root user's ~/.ssh/authorized_keys on the destination enables fully passwordless, key-based SSH authentication, satisfying both the security requirement and the need to avoid storing passwords in automated scripts.
Concept tested: SSH passwordless key-based authentication for automated jobs
Source: https://www.ibm.com/docs/en/aix/7.3?topic=s-ssh-keygen-command
Topics
Community Discussion
No community discussion yet for this question.