Enable SSH Key Authorization on FreeNAS

FreeNAS is a powerful tools for archive data and other long-term storage requirements. Recently I have started backing up this and other off-site servers to one of my local FreeNAS boxes. Since these systems are only connected via the insecure internet (no VPN), I decided to transmit the backup files via SSH using SCP.  In order to do this without having to enter my password in for each and every backup (most of which happen while I’m hopeful sleeping), I needed to implement SSH Key Authorization on the receiving FreeNAS box.

To do this first I needed to create a DSA key pair on a different system.  On my Fedora 12 laptop I ran

ssh-keygen -t dsa

The trick here is to not create your new key pair in the default directory of “~/.ssh/” but in a temporary directory instead. So when it asks you.

Generating public/private dsa key pair.
Enter file in which to save the key (/root/.ssh/id_dsa):

Enter a different file in witch to save the key in. Note this is asking for the name of a file, not the name of the directory, it will also create a .pub file, this is the public key for the above private key.

Now that you have a public/private key for the FreeNAS box, if you don’t already you need to create one for the user that you plan on sending the file from.  Just follow the above command, but this time, you may just hit enter all the way threw leaving all options as default.

Next, go to your FreeNAS web-page control panel, If you don’t already have one, you will need to create a user on your FreeNAS box for you to connect to.  You may do this via “Access -> User and Groups” from the black bar on the top of the page.

Now from the top (black) bar go to “Services -> SSH”

On your Services|SSH page, first make sure the service is enabled (top right hand corner). Once it is you will be able to change the below options.

  • TCP Port: The default (port 22) is fine in most cases, but note if you change it, you must use the new port for all connections.
  • Permit root login: My option is that the root account should never be allowed to log in via a remote process.  You should set your system up correctly where this is not needed.
  • Password authentication: For now this must be enabled (checked), once you have set “Key Authorization” up, you may disable this option.
  • TCP forwarding: Disabled (unchecked)
  • Compression: Enabled (checked)
  • Private Key: This will be were we put the private key created above.  All you need to do is copy and paste.
  • Extra options: Blank

After you have made your changes, “Save and Restart” the service.

On your local system, you need to copy the content of the local users public (~/.ssh/username.pub) key file to a new file named “authorized_keys” (Note: this is not the file we created for FreeNAS but the file we created for your local account).  This is the file that will need to be copied to your FreeNAS box.

Now that you have all the needed bits, we need to log into your FreeNAS server and create a “.ssh” directory to store the “authorized_keys” file.  To log in to the FreeNAS box interactively run a command similar too.

ssh freenasuser@freenasaddress

Or if you changed the “TCP Port” above, your command will look like this:

ssh -P freenasport freenasuser@freenasaddress

Once your logged in, you need to create the directory, by doing.

mkdir ~/.ssh

After you have successfully created your directory, you may exit out of your FreeNAS box for the next step.
Back on your local system you need to copy the “authorized_keys” file created before to the FreeNAS box. Using SCP you can do this by running a command like:

scp -P freenasport authorized_keys freenasuser@freenasaddress:~/.ssh/

This will copy the file to the FreeNAS box. Next, reconnect to the FreeNAS box as you did before and run.

cd ~/.ssh/
chmod 600 authorized_keys

Once your done, you should be able to connect to your FreeNAS box using the private key in the authorized_keys with out a password.

13 thoughts on “Enable SSH Key Authorization on FreeNAS

  1. I did those same changes to enable rsync on my FreeNAS installation.

    Then one day I had to restart FreeNAS and since it reloads everything from CompactFlash, all my settings were gone!

    Do you have any suggestions for that?

  2. I too have had the same problem.
    Everything with in /mnt/.ssh including the .ssh dir is removed on reboot.
    What is the work around for this?
    Any ideas?

      • By default, /mnt is the users home directory and it’s on the hard disk from what I can see.
        I’ve noticed my /etc/exports edits have also been destroyed after the reboot.
        If /mnt is not on hard disk then how would my 2TB RAID which is on /mnt/FileServer exist?
        Thanks.

        • /mnt is not part of your harddrive, it’s part of the FreeNAS ROM disk and will be rebuilt after every reboot. /mnt/FileServer is your mount point, everything past that is stored on your RAID. Just make the home directory of the users something like /mnt/FileServer/home/User and all your user settings will stay.

          Everything that is not inside of /mnt/FileServer/ is read only and will not last past a reboot.

          • Ah, ok. Cool. I’ll give that a go. Much appreciated!
            I guess the trick to persisting the /etc/exports file is to link to an exports file on the hard disk.
            So /etc/exports from within /etc would look like… /exports -> /mnt/FileServer/home/myuser/exports
            Will give this a go.

  3. By default /etc/exports is a link to /var/etc/exports.
    I renamed the /etc/exports link and created an /etc/exports file.
    Then once again on reboot, this is reverted.

  4. The SSH solution works as you can have a ~ directory where ever you like.
    Problem with NFS is that you can’t modify the /etc/rc.conf, /etc/exports or where they point to and have the changes persisted to disk. At least I’m not aware of a way.
    Any ideas with that?
    The settings in the web UI arn’t comprehensive enough, to secure NFS very well. I’d like to at least use -mapall=myuser:myusergroup in /etc/exports.

    • Modify the /conf/base/etc/rc.conf and /conf/base/etc/exports instead of the original files in /etc/…
      After a reboot the files in /conf/base/etc will be copied over the files in /etc
      I installed a printserver to freenas in this way by editing all necessary files in /conf/base/… and it works fine.

  5. Pingback: Setting up a NFS share in FreeNAS « Binarymist

  6. Pingback: A few steps to secure a FreeNAS server « Binarymist

  7. Pingback: How to Start Using SSH in Fedora | xjonquilx | Mepis, Ubuntu, Fedora, Linux, Oh My!

  8. Pingback: Configuring FreeNAS To Host Time Machine Volume, Allowing Mac Users To Backup Data Across Network Using Time Machine | EssayBoard

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s