Technical Tip: How to configure SSH public-key authentication for a FortiWeb administrator using PuTTYgen

Description

This article describes how to configure SSH public-key authentication for a FortiWeb administrator account by generating a key pair with PuTTYgen and configuring the corresponding private key in PuTTY.

Scope

FortiWeb.

Solution

Step 1: Generate an SSH key pair with PuTTYgen:

1. Open PuTTYgen.
   Note: PuTTYgen is a separate utility from the PuTTY SSH client. It is normally installed as part of the PuTTY package.

2. Under Parameters, select the required key type.
   For example: RSA with 2048 bits or greater.

3. Select Generate.

4. Move the mouse within the blank area until PuTTYgen finishes generating the key.

5. Optionally configure a key passphrase.

6. Select Save private key and save the private key as a .ppk file.

7. Copy the value from the public key for pasting into the OpenSSH authorized_keys file.

Notes:

• The public key copied to FortiWeb must begin with a supported SSH key identifier:
  
  

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA...

• PuTTYgen may append an optional comment. Remove the optional key comment displayed at the end of the generated public key.

For example, the end of the generated public is:

dueLF1Ob6tMokQot2968= rsa-key-20260714 

Remove the comment so the configured value is:

ssh-rsa AAAAB3...dueLF1Ob6tMokQot2968=

• When entering the public key in the FortiWeb CLI, place the complete value inside double quotation marks.:
  
  

"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA...dueLF1Ob6tMokQot2968="

Step 2: Configure the public key on the FortiWeb administrator.

config system admin
edit "new_admin" 
set sshkey "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA..."
next 
end

Note: Replace the abbreviated example key with the complete public key copied from PuTTYgen.

Then verify:

show system admin

Step 3: Configure PuTTY with the private key.

In PuTTY, navigate to: Connection -> SSH -> Auth -> Credentials.

Then:

1. Select Browse.

2. Select the saved .ppk private-key file.

3. Return to Session.

4. Enter the FortiWeb management IP address.

5. Confirm that the port is 22.

6. Select SSH.

7. Optionally save the PuTTY session.
   
   

The username can also be configured under:

Connection -> Data -> Auto-login username

Step 4: Test the SSH connection.
Open the saved PuTTY session.

Expected behaviour:

log in as: new_admin
Authenticating with public key ...

Notes:

• PuTTY should indicate that public-key authentication is being used. The exact message may vary by PuTTY version.

• If the private key was protected with a passphrase, PuTTY prompts for the private-key passphrase. This is not the FortiWeb administrator password.
  
  

Step 5: Troubleshooting.

A public-key configuration issue may result in an error similar to:

Invalid SSH public key

Verify the following:

1. The key starts with a supported identifier, such as ssh-rsa.

2. ssh-rsa was not mistyped as sh-rsa.

3. The public key was copied from the correct PuTTYgen field.

4. The complete key is on one line.

5. The optional trailing comment was removed.

6. The CLI value is enclosed in double quotation marks.

7. The PuTTY private key matches the FortiWeb public key.

8. SSH administrative access is enabled on the relevant interface.

9. Trusted hosts permit the client IP.

10. The administrator account is allowed to use SSH.

Related documents:
PuTTY User Manual – Chapter 8: Using public keys for SSH authentication

FortiWeb Administration Guide: Administrator accounts.
FortiWeb CLI Reference: system admin.