Share this page

# Configure private key authentication with secure shell

This section provides information on how to configure private key authentication with secure shell (SSH).

In this topic:

## Prerequisites

Before you configure private key authentication, make sure the following:

- SSH is installed.

- The SSH server is configured for private key authorization.

- The ssh-keygen utility is part of the Cygwin installation. (To get this utility, you must enable the Open SSH components during Cygwin installation.)

- Verify that the OpenText PPM user account can be used to log on to the remote host through the SSH session.

- Add the RSA certificate information of the remote host to the ssh `known_hosts` file, which is located in the `<PPM_Home>` directory.

## Configure private key authentication

Follow the steps below to configure private key authentication with SSH.

### (Optional) Step 1: Generate a known hosts file for ECDSA

If you're using the Elliptic Curve Digital Signature Algorithm (ECDSA) for SSH, you should first generate the known hosts file for the target server. This ensures that your SSH client recognizes the server�s fingerprint, allowing it to verify the server's identity in future connections and preventing man-in-the-middle attacks.

To generate the known hosts file for ECDA, run the following command:

    ssh-keyscan -H -t ecdsa [ip_address] >> ~/.ssh/known_hosts

Where:

`[ip_address]` is the IP address or host name of the environment configured in the workbench with the SSH2 connection protocol and the Secure Copy 2 transfer protocol.

### Step 2: Add the RSA certificate of the remote SSH host to the PPM Server SSH `known_hosts` file.

1. Log on to the PPM Server as the OpenText PPM user.

2. From the command line, run the following:

       ssh <User_ID>@<Remote_Host>

   The first time you run this command, you are prompted to indicate whether you want to continue.

3. Type `yes.`

4. Terminate the SSH connection with the remote host.

### Step 3: Set up private key authentication with SSH

1. Generate the private/public key pair on the PPM Server.

2. Add the generated public key to the remote `SSH Authorized_Key` file.

3. Configure the PPM Server.

The following sections provide the steps required to perform each of these tasks.

### Step 4: Generate the private and public keys

To generate the private/public key pair on the PPM Server:

1. Log on to the PPM Server machine as the OpenText PPM user.

2. Change directory to the home directory defined for the OpenText PPM user on the operating system.

3. Run the following SSH utility:

   `ssh-keygen -t rsa -m PEM -b 1024`, or

   `ssh-keygen -m PkCS8` if you use the FIPS compliant encryption.

   Note: OpenText PPM does not support the DSA key type.

   Do not provide the "passphrase".

4. Press `Enter` twice.

5. Verify that the `<PPM_Home>/<PPM_User>/.ssh` directory now contains the following files:

   - `id_rsa` or `id_ecdsa`(the private key), and

   - `id_rsa.pub` or `id_ecdsa.pub` (the public key)

### Step 5: Add the public key to the SSH `authorized_keys` file on the remote host

To append the public key to the remote SSH `authorized_keys` file (remote hosts):

1. Transfer the `id_rsa.pub` or `id_ecdsa.pub` file to the remote SSH host machine, in the `/<PPM_User_Home_Directory>/.ssh` directory as `ppm_id_rsa.pub` or `ppm_id_ecdsa.pub`.

   Note: On the remote UNIX host, the `.ssh` directory is in the `/home/<PPM_User>/` directory. On Windows, the location depends on the user home directory defined during Cygwin installation.

2. Log on to the remote host with the user ID that the PPM Server is to use to connect.

3. Change directory to the `<PPM_Home>/<User_ID>/.ssh` directory and locate the `authorized_keys` file.

   Note: If the `authorized_keys` file does not exist, create it.

4. Append the contents of the `itg_id_rsa.pub` or `itg_id_ecdsa.pub` file to the `authorized_keys` file, by running the command:

   `cat ppm_id_rsa.pub > authorized_keys`, or

   `cat ppm_id_ecdsa.pub > authorized_keys` if you use the the FIPS compliant encryption.

5. Repeat these steps on the PPM Server to enable public key authentication from the PPM Server back to itself.

### Step 6: Reconfigure the PPM Server

1. Open the `server.conf` file in a text editor.

2. Add the following server directive to the file.

       com.kintana.core.server.SSH_PRIVATE_IDENTITY_FILE=/<PPM_Home>/<PPM_User>/.ssh/id_rsa

3. Change to the `<PPM_Home>/bin` directory.

4. To update the required startup files, run the `kUpdateHtml.sh` script.

5. Restart the PPM Server.

### Step 7: Verify server configuration

1. Open a command-line window outside of the PPM Server.

2. Log on to the PPM Server machine as the OpenText PPM user, as follows.

       ssh <User_ID>@<Remote_Host>

   Note: You should not be prompted for the password. It should log on to the remote host using the RSA key file.

3. On the PPM Server, log on to OpenText PPM.

4. From the menu bar, select Administration > Open Workbench.

   The PPM Workbench opens.

5. From the shortcut bar, select Environments > Environments.

   The Environment Workbench page opens.

6. Click New Environment.

   The Environment: Untitled window opens.

7. In the Environment Name field, type the name of the remote host.

8. In the Server section, do the following:

   1. In the Name field, type the remote server name.

   2. In the Type list, select the operating system type on the remote server.

   3. In the Username field, type the user ID you provided in step 2.

   4. In the Password field, click the Password () button.

      The Enter or Change Password dialog box opens.

      Note: The PPM Workbench requires that you provide a password, regardless of whether the authentication uses RSA.

      If authentication with RSA fails, the password you provide here will be used instead to connect to the remote host.

   5. In the Enter New Password and Confirm New Password fields, type the password for the user ID you provided in step 2.

   6. Click OK.

   7. In the Base Path field, type the base path.

   8. In the Connection Protocol list, select SSH2.

   9. In the Transfer Protocol list, select Secure Copy 2.

9. Clear the Enable Client and Enable Database checkboxes.

   Note: The user name specifies the user ID to be used to log on to the destination SSH server. The Environment Checker requires the password. Package line uses the public key file for authentication.

10. Click Save.

11. At the bottom left of the window, click Check.

    The Check Environment window opens.

12. In the left pane, expand the Server folder, and then click SSH2 Server.

13. Click Check.

    In the left pane, an icon to the left of the selected server indicates whether the check succeeded or failed. The right pane displays the details.

https://admhelp.microfocus.com PPM 8942
Tips to improve your search results... OpenText™ Project and Portfolio Management Help Center PPM Help 26.2-26.3 All View Local Help Center View Online Help Center Version: