Setting up public key-based authentication

RSA key pair requirement

Setting up key-based authentication requires an RSA key pair (a private and public key) in addition to the host and server keys. Public-key-based authentication differs between the two versions of SSH; SSH 1.x uses an RSA key pair and SSH 2.0 uses a DSA key pair in addition to an RSA key pair. For both versions of SSH, you must generate the key pairs and copy the public key to the storage system.

Generating a key pair for SSH 1.x

To generate an RSA key pair for SSH 1.x and then copy it to the storage system, complete the following steps.

Step	Action
1	Using your SSH 1.x client, generate an RSA key pair. Result Your client generates the RSA key pair, a public key and a private key, and stores them on the client.
2	Copy the generated public key to the storage system root volume and append it to the /etc/sshd/user_name/.ssh/authorized_keys file.

Step

Action

Using your SSH 1.x client, generate an RSA key pair.

Result

Your client generates the RSA key pair, a public key and a private key, and stores them on the client.

Copy the generated public key to the storage system root volume and append it to the /etc/sshd/user_name/.ssh/authorized_keys file.

Example

The following is an example of generating an RSA key pair with an OpenSSH UNIX client:

% ssh-keygen -t rsa1 -b 1024

Generating public/private rsa1 key pair.

Enter file in which to save the key (/u/john/.ssh/identity):

Enter passphrase (empty for no passphrase):

Enter same passphrase again:

Your identification has been saved in /u/john/.ssh/identity

Your public key has been saved in /u/john/.ssh/identity.pub

The key fingerprint is:

6a:c7:93:7c:b5:f4:12:87:81:56:5e:a2:62:40:07:8a john@unix1

In this example, the identity.pub file is the public-key file that you copy to the storage system root volume.

The following commands append the public key to the /etc/sshd/user_name/.ssh/authorized_keys file on storage system sys1:

% mount sys1:/ /mnt_sys1

% cat identity.pub >> /mnt_sys1/etc/sshd/john/.ssh/authorized_keys

Generating key pairs for SSH 2.0

Generating key pairs for SSH 2.0 requires generating an RSA key pair and a DSA key pair. If you use SSH 2.0 clients other than OpenSSH, you might have to edit the public key before you can use it. See Public keys generated by SecureCRT and ssh.com clients for more information.

To generate key pairs for SSH 2.0, complete the following steps.

Step	Action
1	Using your SSH 2.0 client, generate an RSA key pair. Result Your client generates the RSA key pair, a public key and a private key, and stores them on the client.
2	Using your SSH 2.0 client, generate a DSA key pair. Result Your client generates the DSA key pair, a public key and a private key, and stores them on the client.
3	Copy the generated public key to the storage system default directory and append it to the /etc/sshd/user_name/.ssh/authorized_keys file.

Step

Action

Using your SSH 2.0 client, generate an RSA key pair.

Result

Your client generates the RSA key pair, a public key and a private key, and stores them on the client.

Using your SSH 2.0 client, generate a DSA key pair.

Result

Your client generates the DSA key pair, a public key and a private key, and stores them on the client.

Copy the generated public key to the storage system default directory and append it to the /etc/sshd/user_name/.ssh/authorized_keys file.

Example

The following is an example of generating RSA and DSA key pairs with an OpenSSH UNIX client.

% ssh-keygen -t rsa -b 1024

Generating public/private rsa key pair.

Enter file in which to save the key (/u/john/.ssh/id_rsa):

Enter passphrase (empty for no passphrase):

Enter same passphrase again:

Your identification has been saved in /u/john/.ssh/id_rsa

Your public key has been saved in /u/john/.ssh/id_rsa.pub

% ssh-keygen -t dsa -b 1024

Generating public/private dsa key pair.

Enter file in which to save the key (/u/john/.ssh/id_dsa):

Enter passphrase (empty for no passphrase):

Enter same passphrase again:

Your identification has been saved in /u/john/.ssh/id_dsa

Your public key has been saved in /u/john/.ssh/id_dsa.pub

In this example, the id_rsa.pub and id_dsa.pub files are the public-key files that you copy to the storage system root volume.

The following commands append the public keys to the /etc/sshd/user_name/.ssh/authorized_keys file on storage system sys1:

% mount sys1:/ /mnt_sys1

% cat id_rsa.pub >> /mnt_sys1/etc/sshd/john/.ssh/authorized_keys

% cat id_dsa.pub >> /mnt_sys1/etc/sshd/john/.ssh/authorized_keys

Public keys generated by SecureCRT and ssh.com clients

SSH 2.0 public keys generated by SecureCRT and ssh.com clients contain comments and line breaks that make the public keys useless. You must make the following edits to the generated public keys before SecureAdmin can use them:

Remove any text that is not part of the public key.
Remove line breaks and spaces to make the public key one continuous string of characters.
Before the first character of the public key, add ssh-rsa followed by a space.

Example

The following is an example of an SSH 2.0 public key generated by a SecureCRT client. The generated public key contains extra text and line breaks at the end of each line.

---- BEGIN SSH2 PUBLIC KEY ----

Subject: john

Comment: "john@johnnt"

AAAAB3NzaC1yc2EAAAADAQABAAAAgQDJhJ6nk+2hm5iZnx737ZqxFgksPl3+OY1cP8
0s

1amXuUrwBp3/MUODEP5E51lzqjO0w5kyJlvPjCiLg9UqS7JeY5yd/6xyGarsde26De
1E

rbVJ1uqnxyAOlV9A1hjBE8TbI+lyYBH+WezT0nySix6VBQTAWhv43r9lSudswYV80Q
==

---- END SSH2 PUBLIC KEY ----

The following is the public key after removing text that is not part of the public key, removing line breaks at the end of each line, and adding ssh-rsa at the beginning of the public key.

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDJhJ6nk+2hm5iZnx737ZqxFgksPl
3+OY1cP80s1amXuUrwBp3/MUODEP5E51lzqjO0w5kyJlvPjCiLg9UqS7JeY5yd/6xy
Garsde26De1ErbVJ1uqnxyAOlV9A1hjBE8TbI+lyYBH+WezT0nySix6VBQTAWhv43r
9lSudswYV80Q==