System Backup SCP Cert

[FatalHalt]

Hey guys. I'm trying to get my FAZ to backup its settings to an SCP server of mine. However I want to make sure I'm on the right path. I've set up SCP on my FortiGates, so I assume it can't be too much different. 

config system backup all settings

set cert : 

set crptpasswd :

So are these the Private key and the password used to unlock the key? I've tried generating a keypair with PuttyGen, but not sure how to apply it to these settings. 

Can anyone point me in the right direction?

[FatalHalt]

Anyone have any insight on this?

[FortiAdam]

Not a solution but I would like to share my experience . . .

When I proposed this question to Fortinet TAC, they tried to turn me away from using SCP and suggested I use SFTP as an alternative.  I'm going to give VSFTP a try on my linux machine and see if that meets my needs better than SCP as a method for secure file transfer.  I'm not sure if I will even bother with SCP if SFTP turns out to be an acceptable solution.

[scao_FTNT · Accepted solution]

please use below instruction for the feature, thanks

Simon

###############

To support ssh certificate, you need OpenSSH 5.4 or higher. Suppose SSH server is on a Linux machine, do the following steps to provide FMG with "scp + certificate" backup & restore. 1) set up CA key Just like any normal ssh key, use the ssh-keygen command to generate CA key. $ ssh-keygen -f ca-key CA private/public key pair are saved in current directory: "ca-key" is private key, "ca-key.pub" is public key. 2) set up ssh server to trust the CA key. do this at the individual account level, or at a server-wide level. (individual account): let any key signed by the CA key log into one specific user account. add the CA public key(prefix it with the "cert-authority" directive) to .ssh/authorized_keys file in user account's home directory. Take 'qa' as an example, it is /home/qa. $ echo "cert-authority $(cat ca-key.pub)" >> /home/qa/.ssh/authorized_keys (server wide): let user keys signed by the CA key log into any account on the server. add the line "TrustedUserCAKeys /etc/ssh/ca-key.pub" to /etc/ssh/sshd_config file, then copy the ca-key.pub file to /ect/ssh directory. 3) create a user key or use any existing key. $ ssh-keygen -f user-key user private/public key pair are saved in current directory: "user-key" is private key, "user-key.pub" is public key. 4) sign the user key with the CA key. $ ssh-keygen -s ca-key -I <key_id> user-key.pub <key_id> is a "key identity" that is logged by the server when the certificate is used for authentication, for example, "qa's key". a separate certificate file called user-key-cert.pub will be created. 5) create a ssh certificate entry on FMG

config system certificate ssh    edit "<cert-name>"        set comment "any string"        set private-key "<copy from user-key>"        set certigicate "<copy from user-key-cert.pub>"    next end after all of above steps have finished, user can do the following using the ssh certificate: a)backup all-settings to scp server. # "exec backup all-settings scp <scp server ip>, <path/filename> <username> <ssh-cert>". <username> is a user account on scp server, which trusts the CA key. <ssh-cert> is the ssh certificate created above. b) restore all-settings from scp server. # "exec restore all-settings scp <scp server ip>, <path/filename> <username> <ssh-cert>". c) configure scheduled all-settings backup config system backup all-settings    set status enable    set user "<username>"    set protocol scp    set cert "<ssh-cert>" ... end

[FatalHalt]

Thanks a ton Simon, exactly what I needed. Going to give this a shot later today!

[scao_FTNT]

Hi, FatalHalt, sorry, I just got update that this SCP feature may not work in 5.0.10 and 5.2.1, but has been fixed for next patch (5.0.11 and 5.2.2).

For 5.0.10/5.2.1, you may need to use SFTP function

Thanks

Simon

[AtiT]

Hello,

I am setting up the FAZ backup over SCP but I have a problem to set the certificate on the FAZ.

Issuing the command: set certficate "<the user certificate here>" returns me the message:

Invalid certificate. Command fail. Return code -61

The documentation says that it sould be a PEM certificate. When I create a PEM ceritificate it seems like:

-----BEGIN CERTIFICATE-----

.......

-----END CERTIFICATE-----

Is it a correct one?

The private key is imported successfully only the public key has a problem.

Tested on FAZVM 5.6.5 and 6.0.2.

[mhaynie]

    Invalid certificate.

    Command fail. Return code -61

The error appears to come from having a passphrase in the certificate, I had the same issue with the private key until I removed it. Enter the private key with new lines copied directly from the original (no need to delete them or rewrite them as \n).

[137ravi]

what should be the key_id for server-wide option while signing the user key with the CA key.

[mhaynie]

The key_id is the name you assigned it when you were creating the certificate.