Preserving pfsense <user>/.ssh/id_[rd]sa.[pub,key]</user>
-
Among other applications, the load balancer offers a script to test whether a service not running on pfsense is or isn't up. In order to keep the pfsense box a 'pure' appliance (without customizations/manually installed packages) the pf box needs to be an ssh client of boxes on the lan. For that to happen without a password, the root and other users on pf need ~/.ssh/id_dsa.pub and .key or at least id_rsa.pub / key. So, ssh-keygen -t dsa and so forth.
Now those pf keys get copied to the authorized_keys files on load balancer clients, and now there's a robust way to check whether the service is totally up and running or not without installing anything custom on the pf box. All great, until…. It's time to restore a crashed pf box from a backup. It's not okay to recreate the ~/.ssh/id_* since they need to stay the same across reboots/reinstalls.
What to do? How to create/preserve ~/.ssh/id* ?
-
You could install the Backup package and then periodically grab a backup of /root/ and the user home dirs.
Eventually it would be nice to have the GUI create and store such user keys, but the functionality doesn't exist yet so for now they'd need to be backed up manually.
