The translation is temporarily closed for contributions due to maintenance, please come back later.
The translation was automatically locked due to following alerts: Could not merge the repository.
English Chinese (Simplified Han script)
Where `ssh-rsa _AAAAB5Wm._pass:attributes[{blank}]` is the contents of `ca_host_key.pub`. The above configures the system to trust the CA servers host public key. This enables global authentication of the certificates presented by hosts to remote users.
 
Creating SSH Certificates
 
A certificate is a signed public key. The user's and host's public keys must be copied to the CA server for signing by the CA server's private key.
 
Copying many keys to the CA to be signed can create confusion if they are not uniquely named. If the default name is always used then the latest key to be copied will overwrite the previously copied key, which may be an acceptable method for one administrator. In the example below the default name is used. In a production environment, consider using easily recognizable names. It is recommend to have a designated directory on the CA server owned by an administrative user for the keys to be copied into. Copying these keys to the `root` user's `/etc/ssh/` directory is not recommend. In the examples below an account named `admin` with a directory named `keys/` will be used.
 
Create an administrator account, in this example `admin`, and a directory to receive the user's keys. For example:
 
~]$ [command]#mkdir keys#
 
Set the permissions to allow keys to be copied in:
 
~]$ chmod o+w keys
ls -la keys
total 8
drwxrwxrwx. 2 admin admin 4096 May 22 16:17 .
drwx------. 3 admin admin 4096 May 22 16:17 ..
 
Creating SSH Certificates to Authenticate Hosts
 
The command to sign a host certificate has the following format:
 
ssh-keygen -s ca_host_key -I pass:quotes[_host_name_] -h ssh_host_rsa_key.pub
 
The host certificate will named `ssh_host_rsa_key-cert.pub`.
 
Generating a Host Certificate
 
To authenticate a host to a user, a public key must be generated on the host, passed to the CA server, signed by the CA, and then passed back to be stored on the host to present to a user attempting to log into the host.
 
Host keys are generated automatically on the system. To list them enter the following command:
 
~]# ls -l /etc/ssh/ssh_host*
-rw-------. 1 root root 668 May 6 14:38 /etc/ssh/ssh_host_dsa_key
-rw-r--r--. 1 root root 590 May 6 14:38 /etc/ssh/ssh_host_dsa_key.pub
-rw-------. 1 root root 963 May 6 14:38 /etc/ssh/ssh_host_key
-rw-r--r--. 1 root root 627 May 6 14:38 /etc/ssh/ssh_host_key.pub
-rw-------. 1 root root 1679 May 6 14:38 /etc/ssh/ssh_host_rsa_key
-rw-r--r--. 1 root root 382 May 6 14:38 /etc/ssh/ssh_host_rsa_key.pub
 
Copy the chosen public key to the server designated as the CA. For example, from the host:
 
~]# scp /etc/ssh/ssh_host_rsa_key.pub admin@ca-server.example.com:~/keys/ssh_host_rsa_key.pub
The authenticity of host 'ca-server.example.com (10.34.74.58)' can't be established.
ECDSA key fingerprint is SHA256:ZYEUaevOAEASvYjm58PiPdMebxhhlaTZBjTMr/N2I3c.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'ca-server.example.com,10.34.74.58' (RSA) to the list of known hosts.
admin@ca-server.example.com's password:
ssh_host_rsa_key.pub 100% 382 0.4KB/s 00:00
 
Alternately, from the CA:
 
~]$ scp root@host_name.example.com:/etc/ssh/ssh_host_rsa_key.pub ~/keys/ssh_host_rsa_key.pub