Configuring certificate-based credentials in CCS for UNIX platform

Products

• Control Compliance Suite
• Control Compliance Suite Standards Module
• Control Compliance Suite Standards Server

Issue/Introduction

From CCS 12.7 onwards, you must use openssh key format while configuring certificate based credentials in ccs for UNIX platform.

Resolution

Starting with the SCU 2023-2 release, Security Content Update uses the LibSSH third-party library for SSH communication, replacing the PuTTY library. LibSSH can read private keys in OpenSSH format only.

Also, starting with CCS 12.7.0, for the data collection on UNIX, if you are adding new credentials or editing the existing credentials for certificate based authentication in CCS credentials workspace, it will accept only private keys that are in the OpenSSH format.

To create SSH keys in OpenSSH format, consider one of the following options:

 

• Generate New Private Key Pairs with ssh-keygen on Unix machine
  
  Generate new private key pairs using ssh-keygen in OpenSSH format.
  Example: ssh-keygen -b 2048 -t rsa

 

• Generate/Update Private Key Pairs using PuTTYgen tool
  
  Generate new private key pair or import existing putty private key (ppk) using PuTTYgen, convert them to OpenSSH format.

 

How to convert private key from putty format to openssh format:

1. Click on puttygen.exe to open the PuttyGen Key Generator.
2. On the PuttyGen Key Generator, click on the menu File→Load private key

1. Select the private key which has to be converted to the openssh format and click on Open.
2. Now from the menu click on Conversions→Export OpenSSH key OR Conversions→Export OpenSSH key (force new file format)

1. Save the key by clicking on Save.
2. The generated key will be in OpenSSH format.

 

Additional Information

NOTE: If converting the key for use with CCS 12.6.1 SCU 2023-2 then you will need to add the "ppk" extension to the newly exported file.