Create the public-private key pair

In the SSH Secure Shell application, do the following:

1. Go to Edit > Settings.
2. In the tree view, select Global Settings > User Authentication > Keys.
3. Select Generate New.
   The Key Generation wizard starts.
4. Select Next.
5. Select the Key Type and Key Length.
   The defaults of DSA and 2048-bit key are good choices.
6. Select Next.
   Wait for key generation to complete.
7. Select Next.
   Enter a name for your private key file and enter the passphrase you will use to access the private key. You must enter the passphrase identically in the two Passphrase fields. Select Next.
8. Select Finish.
   The Upload Public Key function is not compatible with FortiGate units.
9. From the Keys list, select your private key file and then select View.
   Notepad opens showing your public key .
10. In the SSH Secure Shell application Settings window, select OK to close the Settings window.

The text displayed in Notepad contains your public key plus some other information. You need to copy only the key data to the FortiGate unit.

Copy the public key to the FortiGate unit

Log in to the FortiGate CLI, and do the following:

1. Enter the following commands:
   

     config system admin
       edit admin
         set ssh-public-key1 "<key-type> <key-value>"

   <key-type> must be ssh-dss for a DSA key or ssh-rsa for an RSA key. For <key-value>, you must copy and paste the public key data from the Notepad window to the CLI one line at a time. Observe the following so that you copy only the key data:
   • Do not copy the ---- BEGIN SSH2 PUBLIC KEY ---- or Comment: "[2048-bit dsa,...]" lines.
   • Do not copy the ---- END SSH2 PUBLIC KEY ---- line.
   • Do not copy the end-of-line characters that appear as small rectangles in Notepad.

   The command, including the key data, appears as a single long line of text unless your CLI console application wraps the displayed text for you. Make sure that you paste each line of key data at the end of the previously pasted data. Do not forget to type the closing quotation mark before you press Enter.

2. Enter the end command.

Your SSH Secure Shell application can now authenticate to the FortiGate unit based on SSH keys instead of using the administrator password.