Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Preserving pfsense <user>/.ssh/id_[rd]sa.[pub,key]</user>

    General pfSense Questions
    2
    2
    799
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      hcoin last edited by

      Among other applications, the load balancer offers a script to test whether a service not running on pfsense is or isn't up.  In order to keep the pfsense box a 'pure' appliance (without customizations/manually installed packages) the pf box needs to be an ssh client of boxes on the lan.  For that to happen without a password, the root and other users on pf need ~/.ssh/id_dsa.pub and .key or at least id_rsa.pub / key.    So, ssh-keygen -t dsa and so forth.

      Now those pf keys get copied to the authorized_keys files on load balancer clients, and now there's a robust way to check whether the service is totally up and running or not without installing anything custom on the pf box.    All great, until….  It's time to restore a crashed pf box from  a backup.  It's not okay to recreate the ~/.ssh/id_* since they need to stay the same across reboots/reinstalls.

      What to do?  How to create/preserve ~/.ssh/id* ?

      1 Reply Last reply Reply Quote 0
      • jimp
        jimp Rebel Alliance Developer Netgate last edited by

        You could install the Backup package and then periodically grab a backup of /root/ and the user home dirs.

        Eventually it would be nice to have the GUI create and store such user keys, but the functionality doesn't exist yet so for now they'd need to be backed up manually.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • First post
          Last post