SSH Public Key Authentication

Overview

Storware Backup & Recovery supports public key authentication for connections that use SSH credentials, including hypervisors and application hosts.

The default private key path is:

/opt/vprotect/.ssh/id_rsa

You can specify a different path in the relevant SSH credentials settings. The private key must be accessible on the Node executing the connection, owned by vprotect, and have permissions set to 0400.

Supported key type: RSA. Generate the private key in PEM format.

Preparing and depolying keys

1. Prepare the SSH Directory

Run the following commands as root on the Storware Backup & Recovery Node:

install -d -m 700 -o vprotect -g vprotect /opt/vprotect/.ssh

2. Generate or Import a Key

Generate an RSA key pair as the vprotect user:

sudo -u vprotect ssh-keygen \
  -t rsa \
  -m PEM \
  -f /opt/vprotect/.ssh/id_rsa

When prompted, enter a passphrase or leave it empty to create an unencrypted private key. Do not overwrite an existing key used by other connections.

Alternatively, place an existing RSA private key and its corresponding public key at:

/opt/vprotect/.ssh/id_rsa
/opt/vprotect/.ssh/id_rsa.pub

Set ownership and permissions:

chown vprotect:vprotect \
  /opt/vprotect/.ssh/id_rsa \
  /opt/vprotect/.ssh/id_rsa.pub

chmod 400 /opt/vprotect/.ssh/id_rsa
chmod 644 /opt/vprotect/.ssh/id_rsa.pub

3. Install the Public Key on the Target Host

Replace SSH_USER with the remote account used by Storware Backup & Recovery and TARGET_HOST with the target hostname or IP address:

sudo -u vprotect ssh-copy-id \
  -i /opt/vprotect/.ssh/id_rsa.pub \
  SSH_USER@TARGET_HOST

Verify the target host’s SSH fingerprint when prompted. Enter the remote account’s password to install the public key.

The remote account must have the permissions required by the selected integration.

4. Verify Authentication

Test the connection as the local vprotect user:

sudo -u vprotect ssh \
  -o PreferredAuthentications=publickey \
  -i /opt/vprotect/.ssh/id_rsa \
  SSH_USER@TARGET_HOST

The connection should succeed without requesting the remote account’s password. An encrypted private key may still require its passphrase.

Exit the remote session:

exit

5. Configure Credentials in Storware Backup & Recovery

In the SSH credentials settings for the protected resource:

1. Select public key authentication.

2. Enter the remote SSH username.

3. Specify the private key path, such as /opt/vprotect/.ssh/id_rsa.

4. Enter the private key passphrase if the key is encrypted. Otherwise, leave the passphrase empty.

5. Save the configuration and verify the connection by running inventory synchronization or the appropriate operation for the integration.

If multiple Nodes can connect to the resource, configure a usable private key and corresponding remote authorization for each participating Node.