Forum Discussion

bbensten_8485's avatar
bbensten_8485
Icon for Nimbostratus rankNimbostratus
Aug 20, 2014

SSH Key Access

Hi,

 

We are trying to enable SSH Public key Login to our F5. It appears the switch for "pubkeyauthentication" is set to no and we are not certain how to set it to yes without modifying the sshd conf directly. Is this the best way to do so? if we modify it, do we need to restart SSHD? We are running 11.4.

 

Thanks!

 

BIG-IP DNS
ssh
sshd
TMSH
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Aug 20, 2014

    what about tmsh modify sshd include command?

    e.g.

    // before

[root@ve11a:Active:In Sync] config  grep -i pubkeyauthentication /config/ssh/sshd_config
PubkeyAuthentication yes

// configure

[root@ve11a:Active:In Sync] config  tmsh
root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) modify sys sshd include "PubkeyAuthentication no"

root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list sys sshd
sys sshd {
    include "PubkeyAuthentication no"
}

// after

root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) q
[root@ve11a:Active:In Sync] config  grep -i pubkeyauthentication /config/ssh/sshd_config
PubkeyAuthentication no
PubkeyAuthentication yes
  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Aug 22, 2014

    If that doesn't work (please let us know if it does) you should be fine modifying the /config/ssh/sshd_config file directly but not any changes won't survive an upgrade.

     

    If security is important to you I'd also recommend adding (although I haven't researched the best ciphers to use in a while);

     

    Ciphers aes256-ctr,aes256-cbc,aes192-ctr,aes192-cbc

     

    MACs hmac-sha1,hmac-md5