The translation is temporarily closed for contributions due to maintenance, please come back later.
The translation was automatically locked due to following alerts: Could not merge the repository.
Zen

Source string Source string

662/10000 · 662

This translation is currently locked.

English Actions
Support for SSH Certificates
Support for certificate authentication of users and hosts using the new OpenSSH certificate format was introduced in Fedora 13, in the [package]*openssh-5.4p1-1.fc13* package. If required, to ensure the latest OpenSSH package is installed, enter the following command as `root`:
~]# dnf install openssh
Last metadata expiration check performed 0:58:01 ago on Sun Sep 6 16:07:22 2015.
Package openssh-7.1p1-1.fc23.x86_64 is already installed, skipping.
Creating SSH CA Certificate Signing Keys
Two types of certificates are required, host certificates and user certificates. It is considered better to have two separate keys for signing the two certificates, for example `ca_user_key` and `ca_host_key`, however it is possible to use just one CA key to sign both certificates. It is also easier to follow the procedures if separate keys are used, so the examples that follow will use separate keys.
The basic format of the command to sign user's public key to create a user certificate is as follows:
ssh-keygen -s ca_user_key -I pass:quotes[_certificate_ID_] id_rsa.pub
Where [option]`-s` indicates the private key used to sign the certificate, [option]`-I` indicates an identity string, the _certificate_ID_, which can be any alpha numeric value. It is stored as a zero terminated string in the certificate. The _certificate_ID_ is logged whenever the certificate is used for identification and it is also used when revoking a certificate. Having a long value would make logs hard to read, therefore using the host name for host certificates and the user name for user certificates is a safe choice.
To sign a host's public key to create a host certificate, add the [option]`-h` option:
ssh-keygen -s ca_host_key -I pass:quotes[_certificate_ID_] -h ssh_host_rsa_key.pub
Host keys are generated on the system by default, to list the keys, enter a command as follows:
~]# ls -l /etc/ssh/ssh_host*
-rw-------. 1 root root 668 Jul 9 2014 /etc/ssh/ssh_host_dsa_key
-rw-r--r--. 1 root root 590 Jul 9 2014 /etc/ssh/ssh_host_dsa_key.pub
-rw-------. 1 root root 963 Jul 9 2014 /etc/ssh/ssh_host_key
-rw-r--r--. 1 root root 627 Jul 9 2014 /etc/ssh/ssh_host_key.pub
-rw-------. 1 root root 1671 Jul 9 2014 /etc/ssh/ssh_host_rsa_key
-rw-r--r--. 1 root root 382 Jul 9 2014 /etc/ssh/ssh_host_rsa_key.pub
It is recommended to create and store CA keys in a safe place just as with any other private key. In these examples the `root` user will be used. In a real production environment using an offline computer with an administrative user account is recommended. For guidance on key lengths see [citetitle]_link:++https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar1.pdf++[NIST Special Publication 800-131A Revision 1]_.
Generating SSH CA Certificate Signing Keys
On the server designated to be the CA, generate two keys for use in signing certificates. These are the keys that all other hosts need to trust. Choose suitable names, for example `ca_user_key` and `ca_host_key`. To generate the user certificate signing key, enter the following command as `root`:
~]# ssh-keygen -t rsa -f ~/.ssh/ca_user_key
Generating public/private rsa key pair.
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/ca_user_key.
Your public key has been saved in /root/.ssh/ca_user_key.pub.
The key fingerprint is:
11:14:2f:32:fd:5d:f5:e4:7a:5a:d6:b6:a0:62:c9:1f root@host_name.example.com
The key's randomart image is:
+--[ RSA 2048]----+
| .+. o|
| . o +.|
| o + . . o|
| o + . . ..|
| S . ... *|
| . . . .*.|
| = E .. |
| . o . |
| . |
+-----------------+
Generate a host certificate signing key, `ca_host_key`, as follows:
~]# ssh-keygen -t rsa -f ~/.ssh/ca_host_key
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/ca_host_key.
Your public key has been saved in /root/.ssh/ca_host_key.pub.
The key fingerprint is:
e4:d5:d1:4f:6b:fd:a2:e3:4e:5a:73:52:91:0b:b7:7a root@host_name.example.com
The key's randomart image is:
+--[ RSA 2048]----+
| .. |
| . ....|
| . . o +oo|
| o . o *o|
| S = .|
| o. .|
| *.E. |
| +o= |
| .oo. |
+-----------------+
If required, confirm the permissions are correct:
~]# ls -la ~/.ssh
total 40
drwxrwxrwx. 2 root root 4096 May 22 13:18 .
dr-xr-x---. 3 root root 4096 May 8 08:34 ..
-rw-------. 1 root root 1743 May 22 13:15 ca_host_key
-rw-r--r--. 1 root root 420 May 22 13:15 ca_host_key.pub
-rw-------. 1 root root 1743 May 22 13:14 ca_user_key
-rw-r--r--. 1 root root 420 May 22 13:14 ca_user_key.pub
-rw-r--r--. 1 root root 854 May 8 05:55 known_hosts
-r--------. 1 root root 1671 May 6 17:13 ssh_host_rsa
-rw-r--r--. 1 root root 1370 May 7 14:30 ssh_host_rsa-cert.pub
-rw-------. 1 root root 420 May 6 17:13 ssh_host_rsa.pub
Create the CA server's own host certificate by signing the server's host public key together with an identification string such as the host name, the CA server's _fully qualified domain name_ (*FQDN*) but without the trailing `.`, and a validity period. The command takes the following form:
ssh-keygen -s ~/.ssh/ca_host_key -I pass:quotes[_certificate_ID_] -h -n pass:quotes[_host_name.example.com_] -V pass:quotes[_-start:+end_] /etc/ssh/ssh_host_rsa.pub
The [option]`-n` option restricts this certificate to a specific host within the domain. The [option]`-V` option is for adding a validity period; this is highly recommend. Where the validity period is intended to be one year, fifty two weeks, consider the need for time to change the certificates and any holiday periods around the time of certificate expiry.
For example:
~]# ssh-keygen -s ~/.ssh/ca_host_key -I host_name -h -n host_name.example.com -V -1w:+54w5d /etc/ssh/ssh_host_rsa.pub
Enter passphrase:
Signed host key /root/.ssh/ssh_host_rsa-cert.pub: id "host_name" serial 0 for host_name.example.com valid from 2015-05-15T13:52:29 to 2016-06-08T13:52:29
Distributing and Trusting SSH CA Public Keys
Hosts that are to allow certificate authenticated log in from users must be configured to trust the CA's public key that was used to sign the user certificates, in order to authenticate user's certificates. In this example that is the `ca_user_key.pub`.
Publish the `ca_user_key.pub` key and download it to all hosts that are required to allow remote users to log in. Alternately, copy the CA user public key to all the hosts. In a production environment, consider copying the public key to an administrator account first. The secure copy command can be used to copy the public key to remote hosts. The command has the following format:
scp ~/.ssh/ca_user_key.pub root@pass:quotes[_host_name_].example.com:/etc/ssh/
Where _host_name_ is the host name of a server the is required to authenticate user's certificates presented during the login process. Ensure you copy the public key not the private key. For example, as `root`:
~]# scp ~/.ssh/ca_user_key.pub root@host_name.example.com:/etc/ssh/
The authenticity of host 'host_name.example.com (10.34.74.56)' can't be established.
RSA key fingerprint is fc:23:ad:ae:10:6f:d1:a1:67:ee:b1:d5:37:d4:b0:2f.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'host_name.example.com,10.34.74.56' (RSA) to the list of known hosts.
root@host_name.example.com's password:
ca_user_key.pub 100% 420 0.4KB/s 00:00

Loading…

User avatar None

Source string added
~]# ssh-keygen -t rsa -f ~/.ssh/ca_user_key
Generating public/private rsa key pair.
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/ca_user_key.
Your public key has been saved in /root/.ssh/ca_user_key.pub.
The key fingerprint is:
11:14:2f:32:fd:5d:f5:e4:7a:5a:d6:b6:a0:62:c9:1f root@host_name.example.com
The key's randomart image is:
+--[ RSA 2048]----+
| .+. o|
| . o +.|
| o + . . o|
| o + . . ..|
| S . ... *|
| . . . .*.|
| = E .. |
| . o . |
| . |
+-----------------+
4 years ago
Browse all string changes

Things to check

Ellipsis

The string uses three dots (...) instead of an ellipsis character (…)

Reset

Glossary

English English
No related strings found in the glossary.

String information

Source string description
type: delimited block -
Flags
no-wrap, read-only
Source string location
./pages/infrastructure-services/OpenSSH.adoc:530
String age
4 years ago
Last updated
a year ago
Source string age
4 years ago
Translation file
pot/f31/pages/infrastructure-services/OpenSSH.pot, string 155