Public-key authentication is based on the use of digital signatures and provides very good authentication security. To use public-key authentication, the user must first create a key pair on the client, and upload the public key to the server.
The default directory where Tectia Server stores the users' public keys is
$HOME/.ssh2/authorized_keys on Unix, and
%USERPROFILE%\.ssh2\authorized_keys on Windows. The directory can be changed with the
authorized-keys-directory attribute in the
ssh-server-config.xml file. See auth-publickey.
The user is required to have the
read rights, (and optionally the
write rights) to the public-key files and directories, but the locations must not be accessible to other users. The
read permissions are required for the
key.pub file, the
authorized_keys directory, and to the
authorization file, if used. The
write permission to these files are needed if the users are allowed to upload their own keys to the server.
To enable public-key authentication on the server, the
authentication-methods element of the
ssh-server-config.xml file must contain an
auth-publickey element. For example:
<authentication-methods> <authentication action="allow"> <auth-publickey authorized-keys-directory="%D/.ssh2/authorized_keys" /> ... </authentication> </authentication-methods>
Also other authentication methods can be allowed.
By using selectors, it is possible to allow or require public-key authentication only for a specified group of users. See Using Selectors in Configuration File for more information.
Using the Tectia Server Configuration tool, public-key authentication can be allowed on the Authentication page. See Authentication.