The SSH public key. The public key must be encoded in ssh-rsa format or PEM format. The minimum bit-length of the public key is 2048 bits. For example, you can generate a 2048-bit key, and the resulting PEM file is 1679 bytes long. The regex pattern used to validate this parameter is a string of characters consisting of the following. Jan 05, 2021 Click the Save private key button to save the private key. You must save the private key. You will need it to connect to your machine. Right-click in the text field labeled Public key for pasting into OpenSSH authorizedkeys file and choose Select All. Right-click again in the same text field and choose Copy. Importing your SSH key.
Introduction
This document describes how to generate a private secure shell (SSH) key and use that for username and authentication when logging into the command line interface (CLI) on the Cisco Email Security Appliance (ESA).
How to configure SSH Public Key Authentication for login to the ESA without a password
Public-key authentication (PKI) is an authentication method that relies on a generated public/private keypair. With PKI, a special 'key' is generated which has a very useful property: Anyone who can read the public half of the key is able encrypt data which can then only be read by a person who has access to the private half of the key. In this way, having access to the public half of a key allows you to send secret information to anyone with the private half, and to also verify that a person does in fact have access to the private half. It's easy to see how this technique could be used to authenticate.
As a user, you can generate a keypair and then place the public half of the key on a remote system, such as your ESA. That remote system is then able to authenticate your user ID, and allow you to login just by having you demonstrate that you have access to the private half of the keypair. This is done at the protocol level inside SSH and happens automatically.
It does, however, mean that you need to protect the privacy of the private key. On a shared system where you do not have root this can be accomplished by encrypting the private key with a passphrase, which functions similarly to a password. Before SSH can read your private key in order to perform the public key authentication you'll be asked to supply the passphrase so that the private key can be decrypted. On more secure systems (like a machine where you are the only user, or a machine at your home where no strangers will have physical access) you can simplify this process either by creating an unencrypted private key (with no passphrase) or by entering your passphrase once and then caching the key in memory for the duration of your time at the computer. OpenSSH contains a tool called ssh-agent which simplifies this process.
ssh-keygen example for Linux/Unix
Complete the following steps to set up your a linux/unix workstation (or server) to connect to the ESA without a password. In this example, we will not specify as passphrase.
1) On your workstation (or server), generate a private key using the Unix command ssh-keygen:
(*the above was generated from an Ubuntu 14.04.1)
2) Open the public key file (id_rsa.pub) created in #1 and copy the output:
3) Login to your appliance and configure your ESA to recognize your workstation (or server) using the public SSH key that you created in #1, and commit the changes. Notice the password prompt during login:
4) Exit out of the appliance, and re-login. Notice the password prompt is removed, and access is directly granted:
ssh-keygen example for Windows
Complete the following steps to set up your a Windows workstation (or server) to connect to the ESA without a password. In this example, we will not specify as passphrase.
Note: There are a variation on console application used from Windows. You will need to research and find the solution that works best for your console application. This example will use PuTTy and PuTTyGen.
1) Open PuttyGen.
2) For Type of key to generate, select SSH-2 RSA.
3) Click the Generate button.
4) Move your mouse in the area below the progress bar. When the progress bar is full, PuTTYgen generates your key pair.
Ssh Public Private Key Authentication
5) Type a passphrase in the Key passphrase field. Type the same passphrase in the Confirm passphrase field. You can use a key without a passphrase, but this is not recommended.
6) Click the Save private key button to save the private key.
Ssh Key Example
Note: You must save the private key. You will need it to connect to your machine.
7) Right-click in the text field labeled Public key for pasting into OpenSSH authorized_keys file and choose Select All.
8) Right-click again in the same text field and choose Copy.
9) Using PuTTY, login to your appliance and configure your ESA to recognize your Windows workstation (or server) using the public SSH key that you saved and copied from #6 - #8, and commit the changes. Notice the password prompt during login:
10) From the PuTTy configuration window, and your pre-existing Saved Session for your ESA, choose Connection > SSH > Auth and in the Private key file for authentication field, click Browse and find your saved private key from step #6.
11) Save the Session (profile) in PuTTY, and click Open. Login with the username, if not already saved or specified from the pre-configured Session. Notice the inclusion of 'Authenticating with public key '[FILE NAME OF SAVED PRIVATE KEY]' when logging in:
Related Information