Recently I’ve ran into an unusual problem with SSH on SLES 11 SP1. The system – a small HPC cluster – is configured to use NIS for authentication and automounter maps. Whenever a user logs in, the home directory is automounted from an external NAS. Each user has a ~/.ssh directory with the authorized_keys2 and known_hosts required for password-less SSH access among the cluster nodes.

On the one hand, this configuration is useful because you only need to have one ~/.ssh directory, which is then automatically mounted on whatever system you are trying to access. The drawback is that, apparently, there is a risk of a chicken-or-egg paradox. In order to authenticate you, sshd on the target node needs to access your ~/.ssh, which needs to be automounted first, which in turn requires successful authentication. Sometimes password-less SSH failed because the home directory was not automounted.

In my experience, this problem is unique to SLES 11 SP1. I have not seen it on any other SLES or RHEL cluster with identical NIS/autofs configuration. I found that starting or restarting ypbind and autofs after sshd started helps avoid this problem. The simplest way to do this is to add “/etc/init.d/ypbind restart ; /etc/init.d/autofs restart” line at the end of your /etc/init.d/sshd startup section. A dirty fix to be sure, but it seems to work just fine.