The following describes how to fetch the public keys of the users from an LDAP server and use a locally-stored private-public keypair in the server-side connection.
NOTE:
TIP: One Identity recommends using 2048-bit RSA keys (or stronger).
To configure public-key authentication using an LDAP server and a fixed key
-
Navigate to Traffic Controls > SSH > Authentication Policies and create a new Authentication Policy.
-
Select Authenticate the client to SPS using > LDAP > Public key, deselect all other options.
-
Select Relayed authentication methods > Public key > Fix, deselect all other options.
-
Select Private key and click
. A pop-up window is displayed.
-
Click Browse and select the private key of the user, or paste the key into the Copy-paste field. Enter the password for the private key into the Password field and click Upload.
NOTE: SPS accepts passwords that are not longer than 150 characters and supports the following characters:
-
Letters A-Z, a-z
-
Numbers 0-9
-
The space character
-
Special characters: !"#$%&'()*+,-./:;<>=?@[]\^-`{}_|
If the private key of the user is not available, click Generate to create a new private key. You can set the size of the key in the Generate key field. In this case, do not forget to export the public key from SPS and import it to the server. To export the key from SPS, just click on the key and save it to your local computer.
-
-
Click on the fingerprint of the key in the Server side private and public key > Private key field and save the public key. Do not forget to import this public key to the server: all connections that use this new authentication policy will use this keypair on the server side.
-
Click
.
-
Navigate to Policies > LDAP Servers and click
to create a new LDAP policy.
-
Enter the parameters of the LDAP server. For details, see Authenticating users to an LDAP server.
-
If different from sshPublicKey, enter the name of the LDAP attribute that stores the public keys of the users into the Publickey attribute name field.
Caution: The public keys stored in the LDAP database must be in OpenSSH format.
-
Navigate to Traffic Controls > SSH > Connections and create a new Connection.
-
Enter the IP addresses of the clients and the servers into the From and To fields.
-
Select the authentication policy created in Step 1 from the Authentication Policy field.
-
Select the LDAP policy created in Step 7 from the LDAP Server field.
-
If the server accepts a user only from a specific IP address, select the Use original IP address of the client radiobutton from the SNAT field.
-
Configure the other options of the connection as necessary.
-
Click
-
To test the above settings, initiate a connection from the client machine to the server.
