How do I setup public key authentication with Tectia?

To upload a key using Tectia Client version 6.1.0 or newer using ssh-broker-ctl

The instructions below assume that you have Tectia Client version 6.1.0 or newer. If you have an older version of Tectia Client or would prefer to do this manually see this question.

1. First start Tectia Connection Broker:

$ ssh-broker-g3

2. If you don't already have a public key create one by running:

$ ssh-keygen-g3 mykey

This will prompt for a passphrase for the key and create a public key pair (mykey and mykey.pub) in the following location:
in Unix:

$HOME/.ssh2/

in Windows:

%USERPROFILE%\Application Data\SSH\UserKeys\ 

3. Make sure broker can find the key by running:

$ ssh-broker-ctl list-keys

This will output something like:

1. ssh-dss [hash #cfd86e3b9f9480384a207af98d4ab8a39e0cda4d] File name: /home/joe/.ssh2/mykey
   File format: SecSH 2 Label: 2048-bit dsa, joe@myhost, Wed O...
   Key provider: software://0/
   Key path: software://0/directory_key(/home/joe/.ssh2/mykey)... Protected key [authentication code not provided] Type: 2048 bit dsa key SHA-1: cfd86e3b9f9480384a207af98d4ab8a39e0cda4d xufot-moruf-relin-gubyf-moded-bovaz-nyfig-puvup-fyleb-sikyg-tixux

4. Then upload the key using this command:

$ ssh-broker-ctl key-upload /home/pyuser/.ssh2/mykey.pub remotehost

You'll get prompted for password for remotehost and the key is automatically uploaded.

$ joe@localhost's password: 
$ Key uploaded succesfully to 'remotehost'.

Alternatively instead of specifying the path to the key you can give the key id (from the output in step 3):

$ ssh-broker-ctl key-upload 1 remotehost

After this when connecting to remotehost you'll get prompted for the passphrase for your key (the key only needs to be decoded once as long as the ssh-broker-g3 process is running):

$ sshg3 localhost
Key label: 2048-bit dsa, joe@myhost, Wed Oct 07 2009 23:02:31 +0300
File name: /home/pyuser/.ssh2/mykey
Passphrase for the private key: 
Authentication successful.

This should work against any SSH server.

*Note that public key authentication must be allowed by the server configuration.