Configuring Public Key Authentication Using Reflection X Advantage

This technical note provides detailed instructions for setting up Secure Shell (SSH) public key authentication.

Two options are described:

• In the first option, you use Reflection X Advantage to generate keys and use command line options to configure the server.
• In the second option, you use the Reflection FTP Client to generate and upload a key. The server configuration is handled automatically, and then you configure Reflection X Advantage to use the key pair.

Using Reflection X Advantage to Generate Keys

Use the following procedures to generate a key pair using Reflection X Advantage and configure your server to authenticate using the public key.

Note: The required key format and configuration details are different for different Secure Shell server types. To determine the server type running on your host, you can use the following command from a terminal window:

For example, the following command sequence shows that a Reflection for Secure IT server is running:

Generate a Key Pair and Export the Public Key

This procedure generates a new key pair and stores it in the Reflection X Advantage database. You will also export the public key of the key pair to upload to the server.

1. Launch X Manager or X Manager for Domains.
2. From the Tools menu, select Secure Shell User Keys.
3. Click Generate.
4. Enter a name for the key pair to be created, and configure the type and length.
5. Enter a passphrase, or check the No passphrase box to connect without one.
6. Click OK to generate the key. The key will appear in the list of available user keys.
7. Select the key you just created and click Export.
8. Select the key format used by your Secure Shell server.

• For Reflection, F-Secure, and SSH Corporation servers: Export to SecSH format.
• For OpenSSH servers: Export to OpenSSH format (the default).

9. Click Export.
10. Click Close to close the Secure Shell User Keys dialog box.

Note: By default X Manager and X Manager for Domains store user keys in the Reflection X Advantage Store. The database used for this key store is different in standalone and domain mode. If you use both applications and want to use the same key pair for both applications, you can configure an additional, shared key store on the local file system. To do this, open the Secure Shell User Keys dialog box, click the plus sign (+) next to User Key Sources, select Add Local Directory, and browse to select a local directory. Keys are saved to this location using OpenSSH format. If you need SecSH format you can generate the key first in the Reflection X Advantage store, then export it to the local directory. (This feature is available with Reflection X Advantage 4.0 and later.)

Review Your Secure Shell Authentication Settings

By default, Secure Shell connections first attempt to authenticate to your host using public key authentication. If public key authentication fails, Reflection X Advantage attempts keyboard interactive, then password authentication. (Both of these typically prompt you for your username and password.) These Secure Shell authentication settings are saved as part of your client definition. Use the following optional procedure to review or edit these settings.

1. In X Manager or X Manager for Domains, under X Clients, select (or create) a definition to connect to your host. Confirm that "Connection method" is set to "Secure Shell."
2. Click the Advanced button.
3. Select the Authentication tab and review or edit the settings under User Authentication.

Note: If you have multiple keys configured, you will see the Select User Key dialog box when you connect using your client definition. Until your host is correctly configured, you need to click Cancel to reject all keys and move on to a password login. If some of your hosts use only password authentication, you may want to use the Authentication tab to disable public key authentication for these hosts to avoid seeing the Select User Key dialog box when you connect to these hosts.

Upload the Key to the Server

Before you can authenticate using a public key, you need to upload your public key to the server and configure the server to authenticate using that key. The steps for doing this depend on your server type.

Configure Connections to a Reflection for Secure IT, F-Secure, or SSH Corporation Server

1. Open a command window on the system running the X Manager or X Manager for Domains. (Start > All Programs > Accessories > Command Prompt)
2. Navigate to the folder location where you exported your public key. (The default is your Windows home folder. For example, c:\Users\joe.) Use a dir command to confirm that your public key is present, for example:

3. Enter the command “sftp user@host” to connect to the your host, replacing user and host with your values. For example:

4. Enter “binary” to set the transfer format correctly. For example:

5. Navigate to the .ssh2 directory. For example:

6. Enter “put filename.pub” to upload the new public key file, replacing filename with your key filename. For example.

7. Enter “quit” to exit the sftp connection. For example:

8. Enter “ssh user@host” to establish a terminal session, replacing user and host with your values. Enter your password to log on. For example:

9. Navigate to the .ssh2 directory, and use an ls command to confirm that your key is present. For example:

10. Enter the command “echo Key filename.pub >> authorization”, replacing filename with your key file name. This adds a line to the server's authorization file authorizing you to authenticate using this key. For example:

11. Use the "cat" command to confirm the change to the authorization file. For example:

12. Enter “exit” to terminate the terminal session.

Configure Connections to an OpenSSH Server

1. Open a command window on the system running the X Manager or X Manager for Domains. (Start > All Programs > Accessories > Command Prompt)
2. Navigate to the folder location where you exported your public key. (The default is your Windows home folder. For example, c:\Users\joe.) Use a dir command to confirm that your public key is present, for example:

3. Enter the command “sftp user@host” to connect to the your host, replacing user and host with your values . For example:

4. Enter “binary” to set the transfer format correctly. For example:

5. Navigate to the .ssh directory. For example:

6. Enter “put filename.pub” to upload the new public key file, replacing filename with your key filename. For example.

7. Enter “quit” to exit the sftp connection. For example:

8. Enter “ssh user@host” to establish a terminal session, replacing user and host with your values. Enter your password to log on. For example:

9. Navigate to the .ssh directory, and use an ls command to confirm that your key is present. For example:

10. Enter the command “cat filename.pub >> authorized_keys”, replacing filename with your key file name. This adds a line to the server's authorized_keys file authorizing you to authenticate using this key. For example:

11. Enter “exit” to terminate the terminal session.

Using the Reflection FTP Client to Generate and Upload Keys

An alternative approach to configuring public key authentication is to use the Reflection FTP Client. Attachmate products that include Reflection X Advantage on Windows also install the Reflection FTP Client by default. The FTP Client has the ability to generate key pairs, and also includes a key upload utility that automatically determines your server type, uploads the key to the correct location, and makes the necessary changes to the authorization file used by this server. Once this is done, you can configure Reflection X Advantage to authenticate using the key pair.

Generate a Key Pair and Upload the Public Key

1. Start the Reflection FTP Client. (Start > All Programs > Attachmate Reflection > Reflection FTP Client)
2. Click New to create a new site configuration.
3. In the Add FTP Site panel, enter the host on which your run your X client, then click Next.
4. In the Login Information pane, select User, then click Security.
5. In the Security Properties dialog box, click the Secure Shell tab and select "Use Reflection Secure Shell."
6. Click Configure to open the Reflection Secure Shell Settings dialog box.
7. In the Reflection Secure Shell Settings dialog box, click the User Keys tab.
8. Click the Generate button.
9. In the User Key Generation dialog box, specify a key type and length and enter a passphrase, or check the No passphrase box to connect without one. Click Create.
10. Specify a File name and location. (The private key is created using the name you specify. The public key is given the same name with a .pub extension.) Click Save. You should see a message saying that the key was successfully generated. Close this message box to return to the Reflection Secure Shell Settings dialog box.
11. Click the Upload button. The "Upload to host" dialog box opens with your host name already entered. Click OK.
12. Enter your user name and password on the host.
13. Reflection determines the Secure Shell server running on your host and displays the folder and file edits that will be made. Click OK to accept these changes.
14. Click OK to close the open dialog boxes. When you return to the Login information panel you can continue through the FTP Client site setup and test your connection. If you've connected successfully, you now have a key pair you can use in Reflection X Advantage.

Configure Reflection X Advantage to Use the Key Pair

Use this procedure to configure Reflection X Advantage to connect using a key pair you created and uploaded from the Reflection FTP Client.

1. Launch the X Manager or X Manager for Domains.
2. From the Tools menu, select Secure Shell User Keys.
3. Next to the heading "User Key Sources" click the plus sign (+) and select "Add Local Directory."
4. In the Directory field, enter or browse to the folder to which you saved the key pair from the FTP Client. (The default location is in your personal documents folder. For example: C:\Users\<username>\Documents\Attachmate\Reflection\.ssh.)

Note: If you prefer to store your keys in the Reflection X Advantage database, you can import keys created using the FTP Client (or any other application). To do this, in the Secure Shell User Keys dialog box, under User Key Sources select Reflection X Advantage Store. Click Import, then browse to the private key of your key pair.

Legacy KB ID

This document was originally published as Attachmate Technical Note 2708.