48.5. Managing public SSH keys for hosts

Procedure

1. You can retrieve the key for your host from a ~/.ssh/known_hosts file. For example:

   server.example.com,1.2.3.4 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApvjBvSFSkTU0WQW4eOweeo0DZZ08F9Ud21xlLy6FOhzwpXFGIyxvXZ52+siHBHbbqGL5+14N7UvElruyslIHx9LYUR/pPKSMXCGyboLy5aTNl5OQ5EHwrhVnFDIKXkvp45945R7SKYCUtRumm0Iw6wq0XD4o+ILeVbV3wmcB1bXs36ZvC/M6riefn9PcJmh6vNCvIsbMY6S+FhkWUTTiOXJjUDYRLlwM273FfWhzHK+SSQXeBp/zIn1gFvJhSZMRi9HZpDoqxLbBB9QIdIw6U4MIjNmKsSI/ASpkFm2GuQ7ZK9KuMItY2AoCuIRmRAdF8iYNHBTXNfFurGogXwRDjQ==

   You can also generate a host key. See Generating SSH keys.

2. Copy the public key from the key file. The full key entry has the form host name,IP type key==. Only the key== is required, but you can store the entire entry. To use all elements in the entry, rearrange the entry so it has the order type key== [host name,IP].

   # cat /home/user/.ssh/host_keys.pub
   ssh-rsa AAAAB3NzaC1yc2E...tJG1PK2Mq++wQ== server.example.com,1.2.3.4

3. Log into the IdM Web UI.
4. Go to the Identity>Hosts tab.
5. Click the name of the host to edit.
6. In the Host Settings section, click the SSH public keys Add button.
7. Paste the public key for the host into the SSH public key field.
8. Click Set.
9. Click Save at the top of the IdM Web UI window.

Procedure

1. Run the host-mod command with the --sshpubkey option to upload the base64-encoded public key to the host entry.

   Because adding a host key changes the DNS Secure Shell fingerprint (SSHFP) record for the host, use the --updatedns option to update the host’s DNS entry. For example:

   $ ipa host-mod --sshpubkey="ssh-rsa RjlzYQo==" --updatedns host1.example.com

   A real key also usually ends with an equal sign (=) but is longer.

2. To upload more than one key, enter multiple --sshpubkey command-line parameters:

   --sshpubkey="RjlzYQo==" --sshpubkey="ZEt0TAo=="

   Note that a host can have multiple public keys.

3. After uploading the host keys, configure SSSD to use Identity Management as one of its identity domains and set up OpenSSH to use the SSSD tools for managing host keys, covered in Configuring SSSD to Provide a Cache for the OpenSSH Services.

Procedure

1. Log into the IdM Web UI.
2. Go to the Identity>Hosts tab.
3. Click the name of the host to edit.
4. Under the Host Settings section, click Delete next to the SSH public key you want to remove.
5. Click Save at the top of the page.