USP Tunnel SSH Keys Generation Guide

This guide explains how to generate the two SSH key pairs required to establish a secure tunnel between a USP Client and a USP Server.

info

For an explanation of how these keys are used and where each one is configured, refer to Authentication Between USP Client and USP Server. For general ssh-keygen instructions, refer to the SSH Key Pair Generation Guide.

Overview

By the end of this guide, you will have the following files:

Use	Key Number	File	Where to Set It
Verifies the Tunnel identity	1	usp-tunnel-key	In the Tunnel's Private Key field.
	2	usp-tunnel-key.pub	In the tunnel.host_key argument in the USP Client's .hcl file.
Verifies the USP Client identity	3	usp-client-1-key	In the key argument in the USP Client's .hcl file.
	4	usp-client-1-key.pub	In the Proxy Client's Public Key field.

The 1 in usp-client-1-key numbers the USP Client. To connect more USP Clients to the same Tunnel, generate another USP Client key pair for each one (for example, usp-client-2-key) and create a Proxy Client for it.

The diagram shows where each key is used:

warning

The name value in the USP Client's .hcl file must match the Name of the corresponding Proxy Client in the USP Server configuration. This is how the USP Server identifies which key to use for authentication.

Prerequisites

• ssh-keygen is part of OpenSSH. On Linux, it is typically installed by default. On Windows, the OpenSSH Client must be installed. It is not installed by default on Windows Server 2016 and may need to be installed separately. The Windows commands in this guide are written for CMD and also run unchanged in Windows PowerShell 5.1 and PowerShell 7.x.
• Define the absolute path of the directory where you will store the keys. This guide refers to it as <ssh-keys-directory>.

Generating the Keys

1. Create a Directory for Your Keys

Linux

$

mkdir -p <ssh-keys-directory>

Windows (CMD)

C:\>

mkdir <ssh-keys-directory>

2. Generate the USP Server Key Pair

Linux

$

ssh-keygen \
-t rsa \
-b 2048 \
-m PEM \
-f <ssh-keys-directory>/usp-tunnel-key

Windows (CMD)

C:\>

ssh-keygen -t rsa -b 2048 -m PEM -f <ssh-keys-directory>\usp-tunnel-key

When ssh-keygen prompts for a passphrase, press Enter twice to leave it empty. USP cannot use passphrase-protected private keys.

The command produces the following files:

• usp-tunnel-key: Private key
• usp-tunnel-key.pub: Public key

3. Generate the USP Client Key Pair

Linux

$

ssh-keygen \
-t rsa \
-b 2048 \
-m PEM \
-f <ssh-keys-directory>/usp-client-1-key

Windows (CMD)

C:\>

ssh-keygen -t rsa -b 2048 -m PEM -f <ssh-keys-directory>\usp-client-1-key

When ssh-keygen prompts for a passphrase, press Enter twice to leave it empty.

The command produces the following files:

• usp-client-1-key: Private key
• usp-client-1-key.pub: Public key

Configuring the Keys

1. Add the USP Server Private Key

Add usp-tunnel-key as a Private Key in the USP Admin UI, pasting its content in the Key field. For instructions, refer to Adding a Private Key.

To display the content of usp-tunnel-key so you can copy and paste it, run:

Linux

$

cat <ssh-keys-directory>/usp-tunnel-key

Windows (CMD)

C:\>

type <ssh-keys-directory>\usp-tunnel-key

2. Add the USP Client Public Key

Add usp-client-1-key.pub as a Public Key in the USP Admin UI, pasting its content in the Key field. For instructions, refer to Adding a Public Key.

To display the content of usp-client-1-key.pub so you can copy and paste it, run:

Linux

$

cat <ssh-keys-directory>/usp-client-1-key.pub

Windows (CMD)

C:\>

type <ssh-keys-directory>\usp-client-1-key.pub

3. Add a Tunnel

Add a Tunnel, selecting the Private Key you added in step 1 of this section in its Private Key field. For instructions, refer to Adding a Tunnel.

4. Add a Proxy Client

Add a Proxy Client to the Tunnel, with usp-client-1 as its Name and the Public Key you added in step 2 of this section as its Public Key. For instructions, refer to Adding a Proxy Client.

5. Configure the USP Client

In the USP Client's .hcl file, set the name, key, and tunnel.host_key arguments. Replace <ssh-keys-directory> with the absolute path of the directory on the USP Client host where usp-client-1-key and usp-tunnel-key.pub are stored.

Linux

usp-client.hcl

name = "usp-client-1"
key  = "<ssh-keys-directory>/usp-client-1-key"

tunnel {
  host_key = "<ssh-keys-directory>/usp-tunnel-key.pub"
}

Windows (CMD)

usp-client.hcl

name = "usp-client-1"
key  = "<ssh-keys-directory>\\usp-client-1-key"

tunnel {
  host_key = "<ssh-keys-directory>\\usp-tunnel-key.pub"
}

On Windows, write each backslash of the path twice in the .hcl file (for example, C:\\USP\\files).

For details on each argument, refer to USP Client Configuration File.