New Member

Solved

System Backup SCP Cert

Forum|Forum|11 years ago
March 2, 2015
7 replies
18429 views

Hey guys. I'm trying to get my FAZ to backup its settings to an SCP server of mine. However I want to make sure I'm on the right path. I've set up SCP on my FortiGates, so I assume it can't be too much different.

config system backup all settings

set cert :

set crptpasswd :

So are these the Private key and the password used to unlock the key? I've tried generating a keypair with PuttyGen, but not sure how to apply it to these settings.

Can anyone point me in the right direction?

5.0

Best answer by scao_FTNT

please use below instruction for the feature, thanks

Simon

###############

To support ssh certificate, you need OpenSSH 5.4 or higher. Suppose SSH server is on a Linux machine, do the following steps to provide FMG with "scp + certificate" backup & restore. 1) set up CA key Just like any normal ssh key, use the ssh-keygen command to generate CA key. $ ssh-keygen -f ca-key CA private/public key pair are saved in current directory: "ca-key" is private key, "ca-key.pub" is public key. 2) set up ssh server to trust the CA key. do this at the individual account level, or at a server-wide level. (individual account): let any key signed by the CA key log into one specific user account. add the CA public key(prefix it with the "cert-authority" directive) to .ssh/authorized_keys file in user account's home directory. Take 'qa' as an example, it is /home/qa. $ echo "cert-authority $(cat ca-key.pub)" >> /home/qa/.ssh/authorized_keys (server wide): let user keys signed by the CA key log into any account on the server. add the line "TrustedUserCAKeys /etc/ssh/ca-key.pub" to /etc/ssh/sshd_config file, then copy the ca-key.pub file to /ect/ssh directory. 3) create a user key or use any existing key. $ ssh-keygen -f user-key user private/public key pair are saved in current directory: "user-key" is private key, "user-key.pub" is public key. 4) sign the user key with the CA key. $ ssh-keygen -s ca-key -I <key_id> user-key.pub <key_id> is a "key identity" that is logged by the server when the certificate is used for authentication, for example, "qa's key". a separate certificate file called user-key-cert.pub will be created. 5) create a ssh certificate entry on FMG

config system certificate ssh edit "<cert-name>" set comment "any string" set private-key "<copy from user-key>" set certigicate "<copy from user-key-cert.pub>" next end after all of above steps have finished, user can do the following using the ssh certificate: a)backup all-settings to scp server. # "exec backup all-settings scp <scp server ip>, <path/filename> <username> <ssh-cert>". <username> is a user account on scp server, which trusts the CA key. <ssh-cert> is the ssh certificate created above. b) restore all-settings from scp server. # "exec restore all-settings scp <scp server ip>, <path/filename> <username> <ssh-cert>". c) configure scheduled all-settings backup config system backup all-settings set status enable set user "<username>" set protocol scp set cert "<ssh-cert>" ... end

FatalHaltAuthor

New Member

Anyone have any insight on this?

FortiAdam

New Member

Not a solution but I would like to share my experience . . .

When I proposed this question to Fortinet TAC, they tried to turn me away from using SCP and suggested I use SFTP as an alternative. I'm going to give VSFTP a try on my linux machine and see if that meets my needs better than SCP as a method for secure file transfer. I'm not sure if I will even bother with SCP if SFTP turns out to be an acceptable solution.

scao_FTNTAnswer

Staff

please use below instruction for the feature, thanks

Simon

###############

To support ssh certificate, you need OpenSSH 5.4 or higher. Suppose SSH server is on a Linux machine, do the following steps to provide FMG with "scp + certificate" backup & restore. 1) set up CA key Just like any normal ssh key, use the ssh-keygen command to generate CA key. $ ssh-keygen -f ca-key CA private/public key pair are saved in current directory: "ca-key" is private key, "ca-key.pub" is public key. 2) set up ssh server to trust the CA key. do this at the individual account level, or at a server-wide level. (individual account): let any key signed by the CA key log into one specific user account. add the CA public key(prefix it with the "cert-authority" directive) to .ssh/authorized_keys file in user account's home directory. Take 'qa' as an example, it is /home/qa. $ echo "cert-authority $(cat ca-key.pub)" >> /home/qa/.ssh/authorized_keys (server wide): let user keys signed by the CA key log into any account on the server. add the line "TrustedUserCAKeys /etc/ssh/ca-key.pub" to /etc/ssh/sshd_config file, then copy the ca-key.pub file to /ect/ssh directory. 3) create a user key or use any existing key. $ ssh-keygen -f user-key user private/public key pair are saved in current directory: "user-key" is private key, "user-key.pub" is public key. 4) sign the user key with the CA key. $ ssh-keygen -s ca-key -I <key_id> user-key.pub <key_id> is a "key identity" that is logged by the server when the certificate is used for authentication, for example, "qa's key". a separate certificate file called user-key-cert.pub will be created. 5) create a ssh certificate entry on FMG

config system certificate ssh edit "<cert-name>" set comment "any string" set private-key "<copy from user-key>" set certigicate "<copy from user-key-cert.pub>" next end after all of above steps have finished, user can do the following using the ssh certificate: a)backup all-settings to scp server. # "exec backup all-settings scp <scp server ip>, <path/filename> <username> <ssh-cert>". <username> is a user account on scp server, which trusts the CA key. <ssh-cert> is the ssh certificate created above. b) restore all-settings from scp server. # "exec restore all-settings scp <scp server ip>, <path/filename> <username> <ssh-cert>". c) configure scheduled all-settings backup config system backup all-settings set status enable set user "<username>" set protocol scp set cert "<ssh-cert>" ... end

FatalHaltAuthor

New Member

Thanks a ton Simon, exactly what I needed. Going to give this a shot later today!

scao_FTNT

Staff

Hi, FatalHalt, sorry, I just got update that this SCP feature may not work in 5.0.10 and 5.2.1, but has been fixed for next patch (5.0.11 and 5.2.2).

For 5.0.10/5.2.1, you may need to use SFTP function

Thanks

Simon

AtiT

New Member

Hello,

I am setting up the FAZ backup over SCP but I have a problem to set the certificate on the FAZ.

Issuing the command: set certficate "<the user certificate here>" returns me the message:

Invalid certificate. Command fail. Return code -61

The documentation says that it sould be a PEM certificate. When I create a PEM ceritificate it seems like:

-----BEGIN CERTIFICATE-----

.......

-----END CERTIFICATE-----

Is it a correct one?

The private key is imported successfully only the public key has a problem.

Tested on FAZVM 5.6.5 and 6.0.2.

mhaynie

New Member

Invalid certificate.

Command fail. Return code -61

The error appears to come from having a passphrase in the certificate, I had the same issue with the private key until I removed it. Enter the private key with new lines copied directly from the original (no need to delete them or rewrite them as \n).

137ravi

New Member

what should be the key_id for server-wide option while signing the user key with the CA key.

Katoomba

Explorer

I took the liberty of improving the format of the help that was provided on this page.

To use an SSH certificate with SCP backups, you need OpenSSH 5.4 or higher.
Suppose the server that is the SSH/SCP target is a LINUX machine, then do the following steps to provide FMG with "scp + certificate" for backup & restore operations.

1) Setup a CA key just like any normal SSH key, use the ssh-keygen command to generate the CA key.

$ ssh-keygen -f <output-file>

This commands generates a private/public key pair which are saved in current directory.

For example:

$ ssh-keygen -f FMG

Produces two files. File 'FMG' is the private key and 'FMG.pub' is the public key.

2) Configure the LINUX server SSH process to accept SCP connections using the trusted CA cert. Do this at the individual account level, or at a server-wide level.

Steps for an individual account

This will allow any key signed by the CA to log into one specific user account.

Add the CA public key (prefix it with the "cert-authority" directive) to .ssh/authorized_keys file in the user account's home directory. Take 'qa' as an example, the home directory is /home/qa. Then do something like this:

$ echo "cert-authority $(cat FMG.pub)" >> /home/qa/.ssh/authorized_keys

Steps for server wide

This will allow the CA key to be used by any account on the server.
Add the line "TrustedUserCAKeys /etc/ssh/FMG.pub" to /etc/ssh/sshd_config file, then copy the FMG.pub file to /etc/ssh directory.

3) Create a user key or use any existing key.

$ ssh-keygen -f user-key

The user private/public key pair are saved in current directory: "user-key" is private key, "user-key.pub" is public key.

4) Sign the user key with the CA key

$ ssh-keygen -s FMG-key -I <key_id> user-key.pub <key_id>

is a "key identity" that is logged by the server when the certificate is used for authentication, for example, "qa's key". a separate certificate file called user-key-cert.pub will be created.

5) Create a SSH certificate entry on the FMG

config system certificate ssh     edit "<cert-name>"         set comment "any string"         set private-key "<copy from user-key>"         set certigicate "<copy from user-key-cert.pub>"     next end

When the above configuration steps have been setup, user can do the following using the SSH certificate:

1) Backup all-settings to the SCP server.

execute backup all-settings scp <scp server ip>, <path/filename> <username> <ssh-cert>

Where:
<username> is a user account on scp server, which trusts the CA key.
<ssh-cert> is the ssh certificate created above.

2) Restore all-settings from scp server.

execute restore all-settings scp <scp server ip>, <path/filename> <username> <ssh-cert>

3) Configure scheduled all-settings backup config

system backup all-settings     set status enable     set user "<username>"     set protocol scp     set cert "<ssh-cert>"     ... end

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded