topic Re: Adding PKI support for backuping in R81.20 in Firewall and Security Management

Adding PKI support for backuping in R81.20

Pawel_Przybysze — Fri, 06 Oct 2023 12:32:25 GMT

Hello Team,

are you able to add PKI possibility to scheduled (or even on demand) backup for SCP option in the most current version R81.20?

In the past I used a script when Nokia did not yet support SFTP (only FTP), but I would prefer not to use external scripts.

Everyone,
have you got any idea how use scheduled backups with SCP server key instead of password?

Thanks

Pawel

Re: Adding PKI support for backuping in R81.20

PhoneBoy — Fri, 06 Oct 2023 17:53:06 GMT

Do you have keys installed for the destination server on your admin user?
I believe (but could be wrong) that these will be tried first, if they exist.

Re: Adding PKI support for backuping in R81.20

Pawel_Przybysze — Mon, 09 Oct 2023 06:02:04 GMT

Which SSH key is used by embeded GAIA scheduled backup function by default? I asked because all have been added in authorized_keys. Of course I may setup both own backup scripts or ssh connectivity host profile but I'd like to use default GAIA config w/o additional configurarion under shell (only CLI or webUI).

[Expert@hostname:0]# ls -l /etc/ssh/*.pub
-rw-r----- 1 admin root 590 Jul 25 04:48 /etc/ssh/ssh_host_dsa_key.pub
-rw-r--r-- 1 admin root 179 Jul 25 04:58 /etc/ssh/ssh_host_ecdsa_key.pub
-rw-r--r-- 1 admin root 99 Jul 25 04:58 /etc/ssh/ssh_host_ed25519_key.pub
-rw-r----- 1 admin root 627 Jul 25 04:48 /etc/ssh/ssh_host_key.pub
-rw-r----- 1 admin root 382 Jul 25 04:48 /etc/ssh/ssh_host_rsa_key.pub
[Expert@hostname:0]#

BTW ssh -i option works only for ed25519, edsa and rsa (ssh_host_key and dsa return error of key format). I can connect via RSA key manually:
Oct 9 07:40:08 hostname sshd[734829]: Accepted key RSA SHA256:xxxxxxxxxx found at /srv/scp//.ssh/authorized_keys:20

but scheduled backup doesn't work:
Oct 9 07:32:23 hostname sshd[734635]: Unable to negotiate with hostname port 28758: no matching host key type found. Their offer: ssh-rsa [preauth]
Oct 9 07:32:34 hostname sshd[734639]: Accepted password for backupconfig from hostname port 28760 ssh2

It seems scheduled backup uses any other rsa key (probably SHA1).

Re: Adding PKI support for backuping in R81.20

PhoneBoy — Mon, 09 Oct 2023 19:49:49 GMT

You mentioned R81.20, which is not a valid version for Embedded Gaia.
In regular Gaia, I believe the admin user keys are used (but, again, could be wrong).

Re: Adding PKI support for backuping in R81.20

Pawel_Przybysze — Tue, 10 Oct 2023 14:58:20 GMT

Issue has been resolved by re-generate new SSH key on all our Checkpoints for admin user. Unfortunately I don't know localization of default SSH key for admin user.

I can confirm - scheduled backup to SFTP/SCP uses admin user keys.