SSH connection without password between two Azure VMs

I have two RHEL7 VMs running in the same resource group with the same subscription ID. I have assigned DNS names to them; master.eastus.cloudapp.azure.com and node.eastus.cloudapp.azure.com

The ips are dynamically assigned by Azure

These VMs are setup for a manual installation of OpenShift which requires two VMs and will need to communicate with ssh, no password

Both VMs are on the same subnet: subnet Virtual network/subnet: openshift-vm-vnet/default

I have set up two Network Interface Inbound rules for each vm-vnet/default

Master :: internal ip
name                        port    protocol        Source     Destination          Action
default -allow-ssh     22       TCP           <Corp ip>         Any               Allow
node_vm                  22       TCP        Any                Allow

Node  :: internal ip
name                        port    protocol        Source     Destination          Action
default -allow-ssh     22       TCP           <Corp ip>         Any               Allow
master_vm                22       TCP        Any                Allow

I am able to connect to both of the the VMs using the domains with windows 10 v 1 power shell. ssh -v rhel7@avantiadev.eastus.cloudapp.azure.com

When connected to the VM in powershell, I am unable to connect to the other VM with the domain. trying to connect to a domain from a windows 10 power shell connected to a VM instance times out

[rhel7@master ~]$ ssh -v rhel7@node.eastus.cloudapp.azure.com
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug1: Connecting to node.eastus.cloudapp.azure.com [public ip] port 22.
debug1: connect to address [public ip] port 22: Connection timed out
ssh: connect to host node.eastus.cloudapp.azure.com port 22: Connection timed out

I am able to connect using the internal ip. 10.0.0.x

ssh-keygen has been run on both VMinstances: ssh-keygen -t rsa -b 2048 (No password entered)

with keys created in ~/.ssh/id_rsa.pub on each VM.

When trying to copy the key from the master to the node ssh-copy-id -i ~/.ssh/id_rsa.pub rhel7@node.eastus.cloudapp.azure.com

The connection times out.

using the internal ip address is successful. ssh-copy-id -i ~/.ssh/id_rsa.pub successfully transferred the id_rsa.pub key value to the server.

Logging in to the server >ssh still requires a password

How do I configure two azure vms for ssh passwordless connections so they will be able to communicate as a part of the Openshift installation process?

  • 1
    I think your sshd_config file has a restriction on what IP range can connect to the VM. Plus within the same network, your VMs are working how it supposed to work. You should not need to go to WAN network in order to connect to a VM on the LAN network. – Praveen Premaratne Feb 8 '18 at 20:05
  • When you say Logging in to the server >ssh still requires a password are you running ssh In that case is the public of the current machine on the authorized_keys file of the root on – Praveen Premaratne Feb 8 '18 at 20:10
  • Thanks Praveen. The sshd_config hasn't been modified. I don't see a setting that would restrict IPs. I'm ssh-ing to the master from windows 10 with windows power shell. Once connected to the master I am ssh-ing to node from the master. 'ssh'. /home/rhel7/.ssh auhtorized_keys includes the ssh-rsa key for the rhel7 user of the master. known_hosts includes a entry for the master: ecdsa-sha2-nistp256. I believe this will be an issue as the ip is dynamic. – Mike T Feb 9 '18 at 20:38
  • /etc/ssh does not include any authorized_key or known_host files /root does not have a .ssh dir or authorized_keys file. – Mike T Feb 9 '18 at 20:38
  • Your config seems to be fine. When you say IP is dynamic, did you mean the could be something else tomorrow? – Praveen Premaratne Feb 9 '18 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.