Chapter 50. Managing public SSH keys for users and hosts

Procedure

1. You can retrieve the key for your host from a ~/.ssh/known_hosts file. For example:

   server.example.com,1.2.3.4 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApvjBvSFSkTU0WQW4eOweeo0DZZ08F9Ud21xlLy6FOhzwpXFGIyxvXZ52+siHBHbbqGL5+14N7UvElruyslIHx9LYUR/pPKSMXCGyboLy5aTNl5OQ5EHwrhVnFDIKXkvp45945R7SKYCUtRumm0Iw6wq0XD4o+ILeVbV3wmcB1bXs36ZvC/M6riefn9PcJmh6vNCvIsbMY6S+FhkWUTTiOXJjUDYRLlwM273FfWhzHK+SSQXeBp/zIn1gFvJhSZMRi9HZpDoqxLbBB9QIdIw6U4MIjNmKsSI/ASpkFm2GuQ7ZK9KuMItY2AoCuIRmRAdF8iYNHBTXNfFurGogXwRDjQ==

   You can also generate a host key. See Generating SSH keys.

2. Copy the public key from the key file. The full key entry has the form host name,IP type key==. Only the key== is required, but you can store the entire entry. To use all elements in the entry, rearrange the entry so it has the order type key== [host name,IP].

   cat /home/user/.ssh/host_keys.pub
   ssh-rsa AAAAB3NzaC1yc2E...tJG1PK2Mq++wQ== server.example.com,1.2.3.4

3. Log into the IdM Web UI.
4. Go to the Identity>Hosts tab.
5. Click the name of the host to edit.
6. In the Host Settings section, click the SSH public keys Add button.
7. Paste the public key for the host into the SSH public key field.
8. Click Set.
9. Click Save at the top of the IdM Web UI window.

Procedure

1. Run the host-mod command with the --sshpubkey option to upload the base64-encoded public key to the host entry.

   Because adding a host key changes the DNS Secure Shell fingerprint (SSHFP) record for the host, use the --updatedns option to update the host’s DNS entry. For example:

   $ ipa host-mod --sshpubkey="ssh-rsa RjlzYQo==" --updatedns host1.example.com

   A real key also usually ends with an equal sign (=) but is longer.

2. To upload more than one key, enter multiple --sshpubkey command-line parameters:

   --sshpubkey="RjlzYQo==" --sshpubkey="ZEt0TAo=="

   Note

   A host can have multiple public keys.

3. After uploading the host keys, configure SSSD to use Identity Management as one of its identity domains and set up OpenSSH to use the SSSD tools for managing host keys, covered in Configuring SSSD to Provide a Cache for the OpenSSH Services.

Procedure

1. Log into the IdM Web UI.
2. Go to the Identity>Hosts tab.
3. Click the name of the host to edit.
4. Under the Host Settings section, click Delete next to the SSH public key you want to remove.
5. Click Save at the top of the page.

Procedure

1. Log into the IdM Web UI.
2. Go to the Identity>Users tab.
3. Click the name of the user to edit.
4. In the Account Settings section, click the SSH public keys Add button.
5. Paste the Base 64-encoded public key string into the SSH public key field.
6. Click Set.
7. Click Save at the top of the IdM Web UI window.

Procedure

1. Run the ipa user-mod command with the --sshpubkey option to upload the base64-encoded public key to the user entry.

   $ ipa user-mod user --sshpubkey="ssh-rsa AAAAB3Nza...SNc5dv== client.example.com"

   Note in this example you upload the key type, the key, and the hostname identifier to the user entry.

2. To upload multiple keys, use --sshpubkey multiple times. For example, to upload two SSH keys:

   --sshpubkey="AAAAB3Nza...SNc5dv==" --sshpubkey="RjlzYQo...ZEt0TAo="

3. To use command redirection and point to a file that contains the key instead of pasting the key string manually, use the following command:

   ipa user-mod user --sshpubkey="$(cat ~/.ssh/id_rsa.pub)" --sshpubkey="$(cat ~/.ssh/id_rsa2.pub)"

Procedure

1. Log into the IdM Web UI.
2. Go to the Identity>Users tab.
3. Click the name of the user to edit.
4. Under the Account Settings section, under SSH public key, click Delete next to the key you want to remove.
5. Click Save at the top of the page.

Procedure

1. To delete all SSH keys assigned to a user account, add the --sshpubkey option to the ipa user-mod command without specifying any key:

   $ ipa user-mod user --sshpubkey=

2. To only delete a specific SSH key or keys, use the --sshpubkey option to specify the keys you want to keep, omitting the key you are deleting.