Description
This article explains how to configure SCP backup for FortiAnalyzer/FortiManager.
Scope
FortiAnalyzer.
Solution
- Check the OpenSSH version on the Linux station for version 5.4 or higher.
- Create a private/public key pair in the current directory: Assuming the user is Fortinet execute the below command under /home/fortinet ssh-keygen -f ca-key . Resulting keys: "ca-key" - private key, 'ca-key.pub' - public key.
- Set up the ssh server to trust the CA key: Under home/fortinet execute echo 'cert-authority $(cat ca-key.pub)' >> /home/fortinet/.ssh/authorized_keys.
- Create a user private/public key pair: Under home/fortinet execute ssh-keygen -f user-key . Resulting keys: 'user-key' - private key, 'user-key.pub' - public key.
- Sign the user key with the CA key: Under /home/fortinet execute ssh-keygen -s ca-key -I <key-id> user-key.pub . <key-id> is a "key identity" that is logged by the server when the certificate is used for authentication, for example, "fortinet’s key" A separate certificate file called user-key-cert.pub will be created.
- Decrypt the user private key: Under /home/fortinet execute openssl rsa -in user-key. Copy the output.
- On the FortiAnalyzer/FortiManager, enter the following commands.
config system certificate ssh
edit <cert-name>
set private-key "<copy from the decrypted user key you got in step f>" <----- Do not forget to have the quotes (") before and after the text. copied/pastee here.
set certificate "<copy from the content of file user-key-cert.pub>" <----- Do not forget to have the quotes (") before and after the text copied/pasted here.
end
- Test backup from FortiAnalyzer/FortiManager.
exec backup all-settings scp <scp server ip, i.e. ip address of the linux server used above> <path/filename> <username> <cert-name>
Where username is a user account on scp server, which trusts the CA key. <cert-name> is the certificate created on FAZ in step 7 above.
To schedule scp backups configure as below:
config system backup all-settings
set status enable
set server <ip address of the linux server above>
set user <username>
set directory <backup directory on server>
set week_days monday Tuesday …
set time <time>
set protocol scp
set cert <cert-name>
end
