System Backup SCP Cert

[FatalHalt]

Hey guys. I'm trying to get my FAZ to backup its settings to an SCP server of mine. However I want to make sure I'm on the right path. I've set up SCP on my FortiGates, so I assume it can't be too much different. 

config system backup all settings

set cert : 

set crptpasswd :

So are these the Private key and the password used to unlock the key? I've tried generating a keypair with PuttyGen, but not sure how to apply it to these settings. 

Can anyone point me in the right direction?

[137ravi]

thanks a ton mhaynie@ultimusfundsolutions.com

now stuck at given below both error 

Starting backup all settings in background, Please wait.

137fgfm # Starting transfer the backup file to SCP server... SCP error: Warning: Identity file /etc/cert/ssh/bkpscp not accessible: No such file or directory.

Failed to backup all-settings due to SCP transaction! Backup all settings...Failed.

137fgfm # Starting transfer the backup file to SCP server... Error certificate or permission denied Failed to backup all-settings due to SCP transaction! Backup all settings...Failed.

[mhaynie]

It's hard to tell if the issue is with the source or destination, the source should be something like sys_config, so I'll assume you just need to make sure that the user you are using for SCP has permission to the directory you are trying to save the file to.

[Katoomba]

I took the liberty of improving the format of the help that was provided on this page.

To use an SSH certificate with SCP backups, you need OpenSSH 5.4 or higher.
Suppose the server that is the SSH/SCP target is a LINUX machine, then do the following steps to provide FMG with "scp + certificate" for backup & restore operations.

1) Setup a CA key just like any normal SSH key, use the ssh-keygen command to generate the CA key.

$ ssh-keygen -f <output-file>

This commands generates a private/public key pair which are saved in current directory.

For example:

$ ssh-keygen -f FMG

Produces two files. File 'FMG' is the private key and 'FMG.pub' is the public key.

2) Configure the LINUX server SSH process to accept SCP connections using the trusted CA cert. Do this at the individual account level, or at a server-wide level.

Steps for an individual account

This will allow any key signed by the CA to log into one specific user account.

Add the CA public key (prefix it with the "cert-authority" directive) to .ssh/authorized_keys file in the user account's home directory. Take 'qa' as an example, the home directory is /home/qa. Then do something like this:

$ echo "cert-authority $(cat FMG.pub)" >> /home/qa/.ssh/authorized_keys

Steps for server wide

This will allow the CA key to be used by any account on the server.
Add the line "TrustedUserCAKeys /etc/ssh/FMG.pub" to /etc/ssh/sshd_config file, then copy the FMG.pub file to /etc/ssh directory.

3) Create a user key or use any existing key.

$ ssh-keygen -f user-key

The user private/public key pair are saved in current directory: "user-key" is private key, "user-key.pub" is public key.

4) Sign the user key with the CA key

$ ssh-keygen -s FMG-key -I <key_id> user-key.pub <key_id>

 is a "key identity" that is logged by the server when the certificate is used for authentication, for example, "qa's key". a separate certificate file called user-key-cert.pub will be created.

5) Create a SSH certificate entry on the FMG

config system certificate ssh
    edit "<cert-name>"
        set comment "any string"
        set private-key "<copy from user-key>"
        set certigicate "<copy from user-key-cert.pub>"
    next
end

When the above configuration steps have been setup, user can do the following using the SSH certificate:

1) Backup all-settings to the SCP server.

execute backup all-settings scp <scp server ip>, <path/filename> <username> <ssh-cert>

Where:
<username> is a user account on scp server, which trusts the CA key.
<ssh-cert> is the ssh certificate created above.

2) Restore all-settings from scp server.

execute restore all-settings scp <scp server ip>, <path/filename> <username> <ssh-cert>

3) Configure scheduled all-settings backup config

system backup all-settings
    set status enable
    set user "<username>"
    set protocol scp
    set cert "<ssh-cert>"
    ...
end