Passwords and RSA Keys

Learn about authentication in Couchdrop

Overview

Couchdrop supports password authentication and SSH public key authentication.

Passwords can be used to sign in to the Couchdrop Web Portal and for supported file transfer protocols. SSH keys are used for SFTP and SCP authentication.

Two-factor authentication (2FA/MFA) applies to Couchdrop web access only. It does not apply to SFTP, SCP, FTP, or other file transfer protocol connections.

For more information, see Two-Factor Authentication (2FA/MFA).

Password authentication

Password authentication is available for Couchdrop users and can be used for both web access and supported file transfer connections.

Passwords can be changed by an administrator or by the user when they have access to the Couchdrop Web Portal.

All users require a password, including users who also authenticate to SFTP or SCP using a public key.

SSH public key authentication

Couchdrop supports SSH public key authentication for SFTP and SCP.

Public key authentication uses a key pair:

• The public key is added to Couchdrop.

• The private key remains with the user or system connecting to Couchdrop.

Never provide Couchdrop with the private key.

Public keys are configured against individual users and can be used instead of, or together with, password authentication for SFTP and SCP.

Supported key types

Couchdrop supports the following SSH public key types:

Key type	Description
RSA	Commonly used SSH public key format.
DSA	Older SSH public key format.
ECDSA	Elliptic Curve Digital Signature Algorithm keys.

Generating an SSH key pair

SSH key pairs are generated outside Couchdrop. This ensures Couchdrop does not generate or hold your private key.

On macOS, Linux, or another Unix-based system, run:

ssh-keygen

Follow the prompts to select where the key should be stored and whether the private key should use a passphrase.

For example:

#> ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/.ssh/id_rsa): abc    
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in abc
Your public key has been saved in abc.pub
The key fingerprint is:
SHA256:slEtu8kkv6OwfhQSu0FDicYxfixekXAqXSZicPNlAJ0 [e-mail]
The key's randomart image is:
+---[RSA 3072]----+
|+oOBB=o          |
|.=+@E+   .       |
|..=.=+  o .      |
| o ++ .. o       |
|  .  ++.S        |
|    . .O o       |
|    ... =        |
|     o. ..       |
|   .o.....       |
+----[SHA256]-----+

This creates two files:

• abc — your private key

• abc.pub — your public key

The .pub file is the key you add to Couchdrop.

A public key will look similar to:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAB... [e-mail]

Never share your private key. Only the public key should be added to Couchdrop or shared with another service.

Adding a public key to a user

To configure public key authentication:

1. Open the user in Couchdrop.

2. Navigate to RSA Public Keys.

3. Paste the user's public key into the available field.

4. Add the key.

A user can have multiple public keys associated with their account.

Requiring a password and public key

For SFTP and SCP connections, Couchdrop can require both password and public key authentication.

Enable Require Password and Public Key for the user to require both authentication methods before access is granted.