SSH Authentication

Starting from R81.10.00, you can use RSA key authorization instead of password-based authentication when you log in over SSH.

Warning - This configuration does not survive a firmware upgrade.

Procedure:

Create the RSA key and export its public key in the OpenSSH format.

On the Check Point Gaia OS (not Gaia Embedded Check Point Gaia-based Operating System on Quantum Spark Appliances. OS) use this command in the Expert mode:

Run the command:

ssh-keygen -t rsa -b 4096

Notes:

In this prompt, enter the required path and the file name for the RSA Private Key:

Enter file in which to save the key (/home/admin/.ssh/id_rsa):

Note - You can append several keys in this file.

These keys are valid for all administrators configured on the Quantum Spark appliance.

In this prompt, just press the Enter key:

Enter passphrase (empty for no passphrase):

In this prompt, just press the Enter key:

Enter same passphrase again:

Example from a Gaia OS server:

Note - In this example, the "/home/admin/MyKey" file is the RSA Private Key, and the "/home/admin/MyKey.pub" file is the RSA Public Key.

[Expert@HostName:0]# ssh-keygen -t rsa -b 4096
Generating public/private rsa key pair.
Enter file in which to save the key (/home/admin/.ssh/id_rsa): /home/admin/MyKey
Enter passphrase (empty for no passphrase): Press the Enter Key
Enter same passphrase again: Press the Enter Key
Your identification has been saved in /home/admin/MyKey.
Your public key has been saved in /home/admin/MyKey.pub.
The key fingerprint is:
SHA256:iru...   ...   ...   ...   ...   ...bKrY admin@HostName
The key's randomart image is:
+---[RSA 4096]----+
|B=*. ..          |
|.B =o...         |
|  *o=.  .        |
|   O.. .         |
|..* = . S        |
|...@ = *         |
| E= O * .        |
|   = * .         |
|  ..B..          |
+----[SHA256]-----+
[Expert@HostName:0]#

On a Linux OS, you can use the "openssl" command or any other applicable tool.

Do not configure a passphrase.

openssl genrsa -out /var/log/MyKey.private 4096

openssl rsa -in /var/log/MyKey.private -out /var/log/MyKey.public -outform PEM -pubout

On a Windows OS, you can use the "PuTTYgen" tool.

Do not configure a passphrase.

In the PuTTY built-in help, refer to the chapter "Using public keys for SSH authentication".

Transfer the file with the public key from the Linux-based server to your computer:

Example	RSA Private Key	RSA Public Key
For Gaia OS	`/home/admin/MyKey`	`/home/admin/MyKey.pub`
For Linux OS	`/var/log/MyKey.private`	`/var/log/MyKey.public`

Connect to the command line on the Quantum Spark Appliance.
Log in.

If the default shell is Gaia Clish The default shell of the Gaia CLI, then go to the Expert mode:

expert

Create the required directory:

mkdir -v /storage/.ssh

Configure the required permissions on this directory:

chmod 700 /storage/.ssh

Transfer the file with the public key (in the above example for Gaia OS- "MyKey.pub") from your computer to the Quantum Spark Appliance to this directory:

/storage/.ssh

Rename the file with the public key to "authorized_keys":

mv -v /storage/MyKey.pub /storage/.ssh/authorized_keys

Configure the required permissions on the file with the public key:

chmod 600 /storage/.ssh/authorized_keys

Edit file "/pfrm2.0/etc/sshd_config" file:

Back up the current file:

cp -v /pfrm2.0/etc/sshd_config{,_BKP}

Edit the current file:

vi /pfrm2.0/etc/sshd_config

Change this line:

AuthorizedKeysFile none

to this line:

AuthorizedKeysFile /storage/.ssh/authorized_keys

Save the changes in the file and exit the editor.

Reboot the Quantum Spark Appliance.

In your SSH client, configure the SSH session to use the RSA Private Key file.

Refer to the documentation for the SSH client.

Note - For PuTTY, it is necessary to convert the RSA Private Key file from the OpenSSH format to the PPK format:

Start the PuTTYgen tool.
From the top, click the Conversions menu.
Click Import key.
Select the RSA Private Key file and click Open.
In the bottom right corner, click Save private key.

Do not configure a passphrase.

Connect with the SSH client (that uses the RSA Private Key file) to the Quantum Spark Appliance.

When prompted, enter the applicable username.

There should not be a prompt for the password.