Rather than using passwords, you can use SSH keys to authenticate users connecting via SSH, SFTP, or SCP. SSH keys provide security and scalability:
- Security: Using SSH keys for authentication is more secure than using passwords. Unlike a password that can be guessed by an unauthorized user, SSH key pairs provide more sophisticated security. A public key configured on the IX14 device is paired with a private key on the user's PC. The private key, once generated, remains on the user’s PC.
- Scalability: SSH keys can be used on more than one IX14 device.
Generating SSH key pairs
On a Microsoft Windows PC, you can generate SSH key pairs using a terminal emulator application, such as PuTTY or Tera Term.
On a Linux host, an SSH key pair is usually created automatically in the user’s .ssh directory. The private and public keys are named id_rsa and id_rsa.pub. If you need to generate an SSH key pair, you can use the ssh-keygen application.
For example, the following entry generates an RSA key pair in the user's .ssh directory:
ssh-keygen -t rsa -f ~/.ssh/id_rsa
The private key file is named id_rsa and the public key file is named id_rsa.pub. (The .pub extension is automatically appended to the name specified for the private key output file.)
Required configuration items
- Name for the user
- SSH public key for the user
Additional configuration items
- If you want to access the IX14 device using SSH over a WAN interface, configure the access control list for the SSH service to allow SSH access for the External firewall zone.
Web
- Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
- Access the device configuration:
Remote Manager:
- Locate your device as described in Use Digi Remote Manager to view and manage your device.
- Click the Device ID.
- Click Settings.
- Click to expand Config.
Web UI:- On the menu, click System. Under Configuration, click Device Configuration.
The Configuration window is displayed.
- Click Authentication > Users.
- Select an existing user or create a new user. See User authentication for information about creating a new user.
- Click SSH keys.
- In Add SSH key, enter a name for the SSH key and click .
- Enter the public SSH key by pasting or typing a public encryption key that this user can use for passwordless SSH login.
- Click Apply to save the configuration and apply the change.
Command line
You can add configure passwordless SSH login for an existing user or include the support when creating a new user. See User authentication for information about creating a new user. These instructions assume an existing user named temp_user.
- Select the device in Remote Manager and click Actions > Open Console, or log into the IX14 local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
- At the command line, type config to enter configuration mode:
> config (config)>
- Add an SSH key for the user by using the ssh_key command and pasting or typing a public encryption key:
(config)> add auth user maria ssh_key key_name key (config)>
where:
- key_name is a name for the key.
- key is a public SSH key, which you can enter by pasting or typing a public encryption key that this user can use for passwordless SSH login
- Save the configuration and apply the change:
(config)> save Configuration saved. > - Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.
PDF
