System Configuration - SSL and SSH - SSH - Client Keys - Overview

Generating SSH Client Keys

MOVEit DMZ is NOT an SSH client key generator. Almost all modern SSH clients already have a facility to generate client keys and these facilities should be used whenever possible. Some common SSH client's key generation facilities are briefly described below:

• *nix, OpenSSH: Use the "ssh-keygen -t rsa" command.
• Windows WS_FTP 9.0: From the main menu, select "Options | Tools" and use the "Create..." button under the "SSH | Client Keys" tree.

If you must generate and distribute SSH client keys, consider using the OpenSSH for Windows toolkit to generate these. See the "Specific Clients - OpenSSH for Windows" documentation for more information about this process.

Associating SSH Client Keys with Users

The facility which associates SSH client keys with specific users on MOVEit DMZ is available as part of the "SSH Policy" from any (web-based) User Profile. Rather than store the entire SSH key for a remote client, MOVEit DMZ simply records the cryptographically unique fingerprint (MD5) of a client key. Either the client or MOVEit DMZ itself can be used to generate and import the necessary fingerprint.

Generating and Importing SSH Client Keys

There are two ways to generate and import an SSH client key for a particular user.

• End user generates key, administrator imports key or fingerprint.
• End user attempts a connection, administrator accepts cached fingerprint from holding tank.

The second option is probably quicker and less error-prone if the end user and administrator are in near-real-time communication with each other.