80
•
Panorama
6.1
Administrator’s
Guide
©
Palo
Alto
Networks,
Inc.
Set
Up
Administrative
Access
to
Panorama
Set
Up
Panorama
Enable
SSH
Key
‐
Based
Authentication
for
the
CLI
To
enable
SSH
key
‐
based
authentication,
complete
the
following
workflow
for
every
administrative
user:
Use
RADIUS
Vendor
‐
Specific
Attributes
for
Account
Authentication
To
use
RADIUS
VSAs,
complete
the
following
tasks:
Enable
SSH
Key
‐
Based
Authentication
for
the
CLI
Step
1
Use
an
SSH
key
generation
tool
to
create
an
asymmetric
keypair
on
the
client
machine.
The
supported
key
formats
are:
IETF
SECSH
and
Open
SSH;
the
supported
algorithms
are:
DSA
(1024
bits)
and
RSA
(768
‐
4096
bits).
For
the
commands
required
to
generate
the
keypair,
refer
to
the
product
documentation
for
your
SSH
client.
The
public
key
and
private
key
are
two
separate
files;
save
both
to
a
location
that
can
be
accessed
by
Panorama.
For
added
security,
enter
a
passphrase
to
encrypt
the
private
key.
The
administrator
will
be
prompted
for
this
passphrase
when
logging
in
to
Panorama.
Step
2
Create
an
account
for
the
administrator
and
enable
certificate
‐
based
authentication.
1.
Select
Panorama > Administrators
and
then
click
Add
.
2.
Enter
a
user
Name
and
Password
for
the
administrator.
Make
sure
to
enter
a
strong/complex
password
and
record
it
in
safe
location;
Panorama
will
only
prompt
for
this
password
in
the
event
that
the
certificates
are
corrupted
or
a
system
failure
occurs.
3.
(Optional)
Select
an
Authentication Profile
.
4.
Enable
Use Public Key Authentication (SSH)
.
5.
Click
Import Key
and
browse
to
import
the
public
key
you
just
created.
6.
Select
the
Role
to
assign
to
this
administrator.
You
can
either
select
one
of
the
predefined
Dynamic
roles
or
a
custom
Role
‐
Based
profile.
For
details,
see
7.
Click
OK
to
save
the
account.
8.
Click
Commit
and
select
Panorama
as
the
Commit Type
option.
Step
3
Verify
that
the
SSH
client
uses
the
private
key
to
authenticate
the
public
key
presented
by
Panorama.
1.
Configure
the
SSH
client
to
use
the
private
key
to
authenticate
to
Panorama.
2.
Log
in
to
the
CLI
on
Panorama.
3.
If
prompted,
enter
the
passphrase
you
defined
when
creating
the
keys.
