Technical Notes

Public Key Authentication for UNIX OpenSSH Client and Reflection SSH Server for Windows or UNIX
Technical Note 1927
Last Reviewed 09-Nov-2012
Applies To
Reflection for Secure IT Windows Server version 7.0 or higher
Reflection for Secure IT UNIX Server version 7.0 or higher
OpenSSH Client for UNIX
Summary

This technical note describes the steps you must follow to use public key authentication when connecting from a UNIX OpenSSH Client to a Reflection SSH Server for Windows or UNIX. You will use the key generation utility to generate a key pair, and upload the public key to the server. Troubleshooting tips are also included.

This technical note is organized into the following sections:

Public key authentication overview

Public key authentication is one way a server can authenticate a user. It requires a private and public key pair; the private key is located on the client, and the public key must be uploaded to the SSH server.

Note: If you are using the Reflection SSH Windows Server, you must have a local user account or domain account on the Windows server.

Key Formats

When a key pair is created on an SSH client, each key of the key pair—public and private—is written to a separate file in a particular format. The format generated by the OpenSSH client is compatible with Reflection for Secure IT Server version 7.x or higher, so no conversion is required. However, OpenSSH key is not compatible with Reflection for Secure IT version 6.x, so you must convert the public key to the proper format prior to uploading it to version 6.x server.

Use the OpenSSH client key generation utility

Use the OpenSSH key generation utility to generate a key pair. The steps vary depending on whether you use a default name (id_dsa or id_rsa) and location, or you use a non-default name or location when you generate a key pair:

Generate a key pair with a default name and location

When using public key authentication, the OpenSSH client by default looks for a private key named id_dsa or id_rsa in the $HOME/.ssh directory.

1. On the system running the OpenSSH client, change directories to .ssh. If the .ssh directory does not exist, create it.
2. Use the following command to create a key pair:

1. Once the utility has generated the key pair, you are prompted to enter a file and the path in which to save the key. Accept the default file name and path.
2. You are then prompted to enter and confirm a passphrase. If you want to create a passphrase-less key, press the Enter key twice without entering a passphrase.
3. After entering a passphrase, the location and names of the private and public keys are displayed. For example (on Solaris):

3. Now that you have created the key pair, proceed to the section that describes how to upload the public key to the server

Generate a key pair with a non-default name or in a non-default location

If you create a key pair with a name other than id_dsa or id_rsa, or if you save a key pair to a non-default location you must create an entry in the user-specific config file or in the global ssh_config file that points to your private key. Follow these steps:

1. On the system running the OpenSSH client, change directories to .ssh. If the .ssh directory does not exist, create it.
2. Use the following command to create a key pair:

1. Once the utility has generated the key pair, you are prompted to enter a file and the path in which to save the key. Enter the file name and path you want.
2. You are then prompted to enter and confirm a passphrase. If you want to create a passphrase-less key, press the Enter key twice without entering a passphrase.
3. After entering a passphrase, the location and names of the private and public keys are displayed. For example:

3. Once the key is generated, you must create an IdentityFile entry in either the user-specific config file or in the global ssh_config fie.

Convert the public key to the proper format - version 6.x only

If you are connecting to Reflection for Secure IT Server version 6.x, after you generate the key pair in OpenSSH client, you must convert the public key to the proper format prior to uploading it to the version 6.x server. Beginning in version 7.0, this step is no longer needed.

Use the following command to convert the OpenSSH public key to IETF SECSH format, the format required by the Reflection SSH Windows or UNIX Server:

Note: It is advisable to give <keyname2>.pub a unique name to distinguish it from <keyname>.pub. For example:

Upload the public key to the server

1. Make an SFTP connection using password authentication from the OpenSSH client to the system running Reflection SSH Windows or UNIX Server:

2. If you are connecting to the Reflection SSH UNIX server, change the directory to /$HOME/.ssh2:

3. Upload the public key from OpenSSH client to the Reflection SSH server:

4. Use the quit command to close the sftp connection.

Create the authorization file on the server

An authorization file containing the public key file name must exist on the server. If it does not exist, you must create it. Follow these steps to create an authorization file:

1. Using password authentication, make an SSH connection from the OpenSSH client to the Reflection SSH Windows or UNIX Server:

2. From your home directory, change to the .ssh2 directory where you have uploaded the public key:

3. Enter the following command to create (or append to) the authorization file:

4. Confirm that the authorization file is correct.

5. Disconnect your SSH connection.

You should now be able to connect with SSH, SFTP, or SCP from the OpenSSH client to the system running the Reflection SSH server without being prompted for a password.

Troubleshooting

If you have trouble connecting, check the troubleshooting suggestions listed below.

Verify that public key authentication is enabled

Public key authentication must be enabled on both the client and the server.

On the OpenSSH client for UNIX:

Public key authentication is enabled by default in OpenSSH client. Check if PubkeyAuthentication no is set in the user's config file (/$HOME/.ssh/config) or the system-wide /etc/ssh/ssh_config file. An entry in the user's config file will override the same entry in the system-wide ssh_config file. If public key is set to no in these files, set PubkeyAuthentication yes.

On the Reflection SSH Windows Server:

Follow these steps to verify that public key authentication is enabled on the server:

1. Click Start > Programs > Attachmate Reflection > Reflection SSH Server Configuration.
2. Click Configuration tab, and go to Authentication > Public Key in the left pane.
3. Verify that "Public key authentication" is set to Allow. Allow is the default.

If you have created Subconfiguration, check the Public Key pane within the subconfiguration window from the server console.

On the Reflection SSH UNIX Server:

The server configuration file, sshd2_config, generally located in /etc/ssh2/, should include the following entries:

Verify that the public key was uploaded and entered into the authorization file

The public key should be present in the .ssh2 folder in the user's home directory on UNIX or User key directory defined on Windows server. Verify that you transferred the public key, <keyname>.pub, to the server. Also, verify that the authorization file exists in this directory and contains a Key entry pointing to the public key file. The file name must match exactly.

Working with multiple hosts and key pairs—an example

If you are working with multiple hosts and key pairs, each key requires a separate entry line in the appropriate file—config or authorization. The following example shows the required entries for Host A to connect to Hosts C or D, or for Host B to connect to Host C:

Host A config file (client)	Host B config file (client)
IdentityFile /export/home/user/.ssh /id_dsa_1024_a	IdentityFile /export/home/user/.ssh /id_dsa_2048_a
IdentityFile /export/home/user/.ssh /id_dsa_1024_b

Host C authorization file (server)	Host D authorization file (server)
Key id_dsa_1024_a.pub	Key id_dsa_1024_b.pub
Key id_dsa_2048_a.pub

Related Technical Notes

1999	Reflection for Secure IT Technical Notes