SSH connection to SMB with keypair

[Petr_Hantak]

Hi SMB Masters!

I would like to ask you if anyone have an experience how to setup SSH connection with keypair to Sparks. Anyone? I know it must be in bashUser etc. But SMB has no classic home folder for admin user for example. Where we should put keys if we want to do it?

[PhoneBoy]

Root's "home" directory is / (i.e. the root filesystem).
Which would imply that you can create a /.ssh/authorized_keys file.
However, in R81.10.05, it appears this is disabled in /pfrm2.0/etc/sshd_config
(Earlier code revisions use dropbear, which may already allow this)

You might be able to tweak the configuration to make this work. 

[PhoneBoy]

The official procedure for this: https://support.checkpoint.com/results/sk/sk179986 
Note that it only applies to Quantum Spark SMB appliances running R81.10.xx where OpenSSH is used instead of Dropbear.

[nmelay1]

Deleted.

It was still online last week. It's really annoying that published SKs constantly get retracted without any kind of explanation/justification.

Edit :

It seems like this SK's content made its way to the Admin Guide.
https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Content/Topics/SSH-...
That's probably where I read about this last week.
Deleted SKs are still an issue though.

[Oliver_Fink]

Sk has been deleted.

[PhoneBoy · Accepted solution]

It's in the product documentation now: https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/SS...

[G_W_Albrecht · Accepted solution]

For Security Gateway 80 / 600 / 700 / 1100 / 1200R/ 1400 appliances see here: https://community.checkpoint.com/t5/SMB-Gateways-Spark/Perform-scheduled-scripted-tasks-on-SMB-devic... and sk106836: How to configure SSH authentication using RSA key files on Security Gateway 80 / 600 / 700.... 

[Petr_Hantak]

@G_W_Albrecht and @PhoneBoy thank you guys! I am surprised that I was not able to find newest SK myself when I was digging in knowledge base. 

[nmelay1]

mkdir /storage/.ssh
chmod 700 /storage/.ssh
cd /storage/.ssh
touch authorized_keys
chmod 600 authorized_keys
cat >> authorized_keys (paste your key(s), end with Ctrl-D)
sed -i '/^AuthorizedKeysFile/s!none!/storage/.ssh/authorized_keys!' /pfrm2.0/etc/sshd_config
/pfrm2.0/bin/sshd.sh

The last 2 commands need to be repeated after each firmware upgrade.