In Cerberus FTP Server 13.1, we have implemented support for multiple SSH host keys. This user-requested feature allows enabling one or more of the currently supported key types: RSA, DSA, ECDSA, EdDSA 25519 and EdDSA 448.
In order to allow this feature, we have implemented new GUI controls to generate host keys, export public keys, delete key pairs, edit the loaded keys, and control which keys are active. Most of the controls are accessed from Server Manager / Security / General as shown in the screenshot below.
SSH Host Key Pairs
This panel shows which keys are loaded in Cerberus. Each key shows the type, length, an administrator customized notes field, a number of fingerprint formats, and the path to the public and private key files. In this example, there are two loaded keys: RSA and ECDSA (Elliptical Curve). All Cerberus servers with SSH enabled will start with just one key which will typically be the same type as the TLS certificate.
The panel also allows Generating, Exporting, Editing and Deleting via the buttons on the top right as highlighted above. We’ll walk through each of these new controls.
Generate SSH Key Pair
Clicking the Generate button allows creating a new Key Pair. The first step is to select a Key Type. Cerberus currently supports five key types: RSA, DSA, Elliptical Curve (ECDSA), ED25519 (EdDSA 25519), and ED448 (EdDSA 448). Note: the Edwards curve EdDSA key types are not currently available in FIPS mode.
Once the type is selected, one of two messages will be displayed in the gray status well at the top as shown in the screenshot below:
- Generate a new TYPE SSH key pair
- Generate another TYPE SSH key pair
These messages indicate whether a new key pair will be created or an existing key may be replaced.
Generate SSH Key Pair
The notes field allows an Administrator to provide some context for the key pair; the field has no function in key signing. For example, this key may be used for a specific set of devices (networking hardware) or perhaps it is a temporary key for a specific user and the note could indicate the user’s name and when it can be removed. The field alleviates the need for external documentation and helps multiple administrators coordinate updates.
The Key Length is populated with values specific to the type selected; the Edwards curves have no selectable length and this field will be disabled for them.
The Private Password allows setting a password on the created Private key. Cerberus recommends setting a password; however, Administrators should securely store the password as they do other passwords as it cannot be recovered if forgotten.
The final option is a checkbox which allows either:
- Enable this SSH key pair immediately
- Replace existing SSH Key pair immediately
When unchecked, the key pair is just generated and saved; when checked, Cerberus will also load the generated key pair as one of the available SSH Host Key Pairs (replacing the current key pair for that type if one exists). Note: if this is a new key pair, it must be [activated](jump link to Activating SSH Host Keys) in the list of host keys before Cerberus will offer it to SSH clients.
Clicking the Generate Keypair button will create the key pair. All generated host keys are stored in the Cerberus certificates folder as ssh-TYPE–YYYYMMDD_HHMMSS.pem; this naming convention avoids accidentally overwriting an existing key pair. This Privacy Enhanced Mail (PEM) file will contain both the public and private keys.
Export SSH Public Keys
Clicking the Pub Export button allows exporting the public portion of a loaded Key Pair. The first step is to select a Key Type.
Export SSH Public Keys
Once a type is selected, the Public Key Path field will be populated with the full path to the selected public key. The Export Format defaults to RFC 4716 (SSH2), but Administrators can also select OpenSSH and X.509 Subject Public Key Information (RFC 3279) formats.
Clicking Generate Keypair will download the public key to the browser’s Downloads folder with a default name of ssh-public-hostkey-FORMAT_TYPE.pem
Manage SSH Keys
Clicking the Edit button allows managing loaded SSH keys. As with the other buttons, the first step is to select a Key Type. If no key of the type exists, then a new key will be added; if one exists, it may be updated, replaced or deleted.
After selecting the type, add or update the Notes, select or update the Public and Private keys (and optional Password), then click Check Key as shown in the screenshot below:
Manage SSH Keys
If the values cannot be validated, the status text will contain a message, such as not finding the public or private key or a bad password. Otherwise, one of three messages will appear:
Add New Key
If a new key is being added, the status text and button text will appear as in the screenshot below:
Manage SSH Keys: Add Key
Clicking Add Key will load the key values into Cerberus.
Update Existing Key
If an existing key is being updated, the status text and button text will appear as in the screenshot below:
Manage SSH Keys: Update Key
Clicking Keep Existing Key will update the Notes and/or Password, but otherwise keep the existing key loaded in Cerberus.
Replace Key
If an existing key is being replaced, the status text and button text will appear as in the screenshot below:
Manage SSH Keys: Replace Key
Note: This type of update should be carefully considered and planned. Changing an existing host key will require SSH clients to accept a new fingerprint and may affect automated systems.
Clicking Replace Key will replace the loaded key in Cerberus.
Delete SSH Key
If the key type corresponds to an existing key, it can also be deleted. Clicking the Delete Key button will display a prompt as shown in the screenshot below. If the Delete button is clicked, then the key will be deleted from Cerberus; however, the key files will not be removed from the certificates folder.
Manage SSH Keys: Delete Key
Activating SSH Host Keys
SSH Host Keys are enabled from Server Manager / Protocols / SSH SFTP as shown in the screenshot below.
SSH Security Defaults: Active Host Key
Any of the supported keys may be activated or deactivated; deactivated host keys will not be offered to SSH clients. If there is no host key loaded (as for DSA in the screenshot above) a warning info tooltip is shown; even if these keys are activated, they will not be offered to SSH clients. Note: the Edwards curve EdDSA key types are not currently available in FIPS mode and will not appear in the list.
Availability
These are just some of the new features that are now available in Cerberus FTP Server 13.1 editions. To learn more about all of the new features in Cerberus FTP Server 13.1, check out our release notes here.
We look forward to hearing how our customers use these features and how any additional improvements would help you create and maintain Public Shares. As always, we would love to hear your feedback.