● Active REV 1.0 OWNER: BACKUP & RECOVERY Last reviewed: 2026-04-22

SSH Key-Based Authentication

Runbook for establishing passwordless SSH from a management host (trips-testlab) to an IBM HMC (drhmc01) for unattended monitoring and automation.

Source / Collector
trips-testlab
192.168.131.135
AIX management host · Originates SSH session as root
──▶
SSH / 22
Destination / Target
drhmc01
192.168.131.150
IBM HMC V9R2 · Restricted shell · User hscroot
00

Prerequisites

Confirm before starting

Verify the following before commencing:

Network reachability on TCP/22 from 192.168.131.135 to 192.168.131.150.

hscroot password available — required once for the initial key upload.

Root access on trips-testlab (or whichever local user will run the automation).

An SCP/PuTTY session to the HMC for paste operations.

01

Generate the SSH key pair

trips-testlab
1.1 Create the directory if it does not already exist Run on trips-testlab

The ~/.ssh directory must exist with strict permissions before key generation.

root@trips-testlab:~ #
# mkdir -p ~/.ssh
# chmod 700 ~/.ssh
1.2 Generate a dedicated RSA key pair (no passphrase) Run on trips-testlab

A dedicated key isolated from any pre-existing keys. The empty passphrase is required for unattended cron execution; key security is enforced via filesystem permissions.

root@trips-testlab:~ #
# ssh-keygen -t rsa -b 4096 \
    -C "hmc_monitor@trips-testlab" \
    -f ~/.ssh/hmc_monitor_rsa \
    -N ""
⚠ Passphrase
When prompted, leave the passphrase empty by pressing Enter twice. A passphrase will block unattended execution under cron.
✓ Verify
ls -l ~/.ssh/hmc_monitor_rsa* — should show two files: private key (mode 600) and public key (.pub, mode 644).
02

Configure SSH client alias

trips-testlab
2.1 Add a host alias to ~/.ssh/config Run on trips-testlab

This allows the script to reference drhmc01 by its short alias and have SSH automatically apply the correct user, IP, key file, and connection options.

root@trips-testlab:~ #
# cat >> ~/.ssh/config <<'EOF'

Host drhmc01
    HostName 192.168.131.150
    User hscroot
    IdentityFile ~/.ssh/hmc_monitor_rsa
    IdentitiesOnly yes
    StrictHostKeyChecking accept-new
    ConnectTimeout 10
    BatchMode yes
EOF

# chmod 600 ~/.ssh/config
ℹ Why IdentitiesOnly yes
Without this, SSH will offer every key in the agent before falling back to the configured key. HMCs may lock out hscroot after several failed attempts, so we want only the designated key to be presented.
03

Upload the public key to the HMC

drhmc01
3.1 Display the public key contents on the source host Run on trips-testlab

Print the contents of the public key so it can be copied. Select the entire output as a single line — it must not contain any line breaks when transferred.

root@trips-testlab:~ #
# cat ~/.ssh/hmc_monitor_rsa.pub

Expected format (will be a single long line):

Output
ssh-rsa AAAAB3NzaC1yc2EAAA...(very long string)... hmc_monitor@trips-testlab
3.2 SSH to the HMC interactively (last password-required step) Run on trips-testlab

Authenticate with the hscroot password one final time to register the key.

root@trips-testlab:~ #
# ssh hscroot@192.168.131.150
✕ Do not use ssh-copy-id
The HMC's restricted shell does not support ssh-copy-id's mechanism for appending to authorized_keys. The HMC-native mkauthkeys command must be used instead.
3.3 Register the public key with mkauthkeys Run on drhmc01

From the HMC prompt, paste the full public key as the argument to mkauthkeys -a. Wrap it in double quotes so the comma and trailing comment are preserved.

hscroot@drhmc01:~>
$ mkauthkeys -a "ssh-rsa AAAAB3Nza...full_key... hmc_monitor@trips-testlab"

Replace the example string above with the actual key copied in step 3.1.

✓ Verify
mkauthkeys --ls — your key should appear in the list. Inspect the comment field at the end (hmc_monitor@trips-testlab) to confirm the correct key was added.
3.4 Exit the HMC session Run on drhmc01
hscroot@drhmc01:~>
$ exit
04

Verify passwordless authentication

trips-testlab
4.1 Test connection using the configured alias Run on trips-testlab

This single command exercises the full chain: SSH config alias resolution → key selection → HMC authentication → remote command execution.

root@trips-testlab:~ #
# ssh drhmc01 lshmc -V
✓ Expected behaviour
The HMC version block should print immediately, with no password prompt. If the command returns the version, key authentication is fully functional.
05

Troubleshooting

If verification fails

For verbose output to diagnose the auth flow:

root@trips-testlab:~ #
# ssh -vvv drhmc01 lshmc -V 2>&1 | grep -E "(Offering|Authentication|denied|accept)"
SymptomLikely CauseResolution
Prompts for password despite key being present Key not registered on HMC, or wrong key being offered Re-run mkauthkeys --ls on HMC; ensure key matches ~/.ssh/hmc_monitor_rsa.pub on collector
Permission denied (publickey) Permissions on private key, ~/.ssh, or ~/.ssh/config are too open chmod 700 ~/.ssh; chmod 600 ~/.ssh/hmc_monitor_rsa ~/.ssh/config
Connection times out Firewall blocking TCP/22 or HMC unreachable Test reachability: nc -zv 192.168.131.150 22 from trips-testlab
Host key verification failed HMC was reinstalled / key changed ssh-keygen -R 192.168.131.150 ; ssh-keygen -R drhmc01 then retry
Pasted key shows as multiple lines on HMC Terminal wrapping during paste Use mkauthkeys --rm to remove malformed entry, then re-paste with quotes ensuring single line
mkauthkeys: command not found Not on the HMC restricted shell — likely shell escape or wrong host Confirm prompt shows hscroot@drhmc01; reconnect if necessary
06

Rollback procedure

If the key needs to be revoked
6.1 Remove the public key from the HMC Run on drhmc01

From an interactive hscroot session on the HMC:

hscroot@drhmc01:~>
$ mkauthkeys --ls
$ mkauthkeys --rm "ssh-rsa AAAA...full_key... hmc_monitor@trips-testlab"
6.2 Remove the keypair on the collector Run on trips-testlab
root@trips-testlab:~ #
# rm -i ~/.ssh/hmc_monitor_rsa ~/.ssh/hmc_monitor_rsa.pub

Optionally remove the alias block from ~/.ssh/config if the host is being decommissioned.