---
updatedAt: 2026-03-31T18:05:58.000Z
---

# SSH Key authentication with Password Safe Cloud

## What is an SSH Key?

An SSH key is a secure credential used by the Secure Shell (SSH) protocol to authenticate users and create an encrypted, secure connection between a client and a remote server.

## How is it useful?

Applying <glossary>SSH</glossary> Key authentication on a managed system is a secure alternative to using password authentication. By implementing SSH Key authentication you can establish a more secure method of user authentication that eliminates the vulnerabilities associated with password-based access. This approach enhances the overall security of your system, reduces the risk of unauthorized access, and provides a reliable way to protect sensitive information. SSH Key authentication is set on the functional account and managed account properties.

SSH Key authentication is supported on the following systems: Linux, AIX, HP-iLO, HP-UX, DRAC, MAC OSX, Solaris, Juniper, and RACF.

## Generate and distribute the key

You can generate keys using **puttygen.exe** on Windows systems and **ssh-keygen** on Unix-based systems. Consult the system documentation for other platforms.

> ✅ Example
>
> How to generate a 2048-bit RSA key pair with **ssh-keygen**. The user account used to perform the scan is **admin**.

```
# ssh-keygen –t rsa -m PEM
Generating public/private rsa key pair.
Enter file in which to save the key (/home/admin/.ssh/id_rsa):
/home/admin/.ssh/retina_rsa
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/admin/.ssh/retina_rsa.
Your public key has been saved in /home/admin/.ssh/retina_rsa.pub.
The key fingerprint is:
7f:5f:e3:44:2e:74:3c:c2:25:2b:82:7c:f8:0e:2a:da

```

**/home/admin/.ssh/retina\_rsa** contains the RSA authentication identity of the user and should be securely transferred to the system running your scanner.

The file **/home/admin/.ssh/user\_rsa.pub** contains the RSA public key used for authentication. The contents of this file should be added to the file **\~/.ssh/authorized\_keys** on all machines that the user wishes to scan using public key authentication.

## Create a functional account with SSH Key authentication

Before you can create the account you must generate a private key. Copying or importing a key is part of setting the functional account properties with SSH Key authentication.

1. Use a browser to sign in to your **BeyondInsight/Password Safe** URL.\
   This URL is provided in the BeyondTrust welcome email and includes your site URL followed by **/login**.

2. From the left menu, click ![Configuration icon](https://files.readme.io/5440329f4c22243ec1f8721a1c3d821fa7d6b7468cd0904e01869dc74e6cf354-configuration.png).\
   The **Configuration** page displays.

3. Under **Privileged Access Management**,  select **Functional Accounts**.\
   The **Functional Accounts** page displays.

4. Click **+ Create New Functional Account**.\
   The **Create New Functional Account** panel displays.

[block:image]{"images":[{"image":["https://files.readme.io/18e1356f4ca0e7d1b8212c7a612827738a4b2c979783feca099f5cd5d5a42e22-image.png",null,"Create New Functional Account page"],"align":"center","sizing":"350px"}]}[/block]

5. Select **Asset** from the **Entity Type** dropdown.
6. Select a platform.
7. Select the elevation if required.
8. Enter the username and password.
9. From the **Authentication Type** dropdown, select **SSH Key**.
10. Upload the SSH key file.
11. Provide an alias and description.
12. Click **Save New Account**.

## Create a functional account on the Unix or Linux platform

Create an account on the Unix or Linux platform with a name like **functional\_account**.

Ensure that the **su** command is available on the platform.

To assign necessary privileges to the functional account, invoke the command **sudo visudo** in the terminal and place the following lines under the root **ALL=(ALL) ALL** line:

> ℹ️
>
> Be sure to add sudo elevation to the functional account on the managed system. These commands are adjusted to reflect password changes and SSH Key changes and are OS-specific.

#### MAC OSX

```
functional_account ALL=(ALL) NOPASSWD: /usr/bin/grep, /usr/bin/sed, /usr/bin/tee, /usr/bin/passwd
```

#### UBUNTU/REDHAT

```
functional_account ALL=(ALL) NOPASSWD: /usr/bin/grep, /usr/bin/sed, /usr/bin/tee, /usr/bin/passwd
```

#### SOLARIS

```
functional_account ALL=(ALL) NOPASSWD: /usr/bin/grep, /usr/bin/cp, /usr/bin/tee, /usr/bin/sed, /usr/bin/passwd, /usr/bin/rm
```

#### HPUX

```
functional_account ALL=(ALL) NOPASSWD: /usr/bin/grep, /usr/bin/cp, /usr/bin/sed, /usr/bin/tee, /usr/bin/passwd, /usr/bin/rm
```

#### AIX

```
functional_account ALL=(ALL) NOPASSWD: /usr/bin/grep, /usr/bin/pwdadm, /usr/bin/tee, /usr/bin/passwd, /usr/bin/sed, /usr/bin/cp, /usr/bin/rm
```

### Test the functional account

The key can be tested from the managed system.

1. Use a browser to sign in to your **BeyondInsight/Password Safe** URL.\
   This URL is provided in the BeyondTrust welcome email and includes your site URL followed by **/login**.
2. From the left menu, click ![Managed Systems icon](https://files.readme.io/f579adbe4852974a581ffef1bec41e8831f10a571d1e29b4740709260b51667c-managed-systems.png).\
   The **Managed Systems** page displays.
3. Locate the managed system in the grid.
4. Click ![Ellipsis icon](https://files.readme.io/d0b1d60d3325c79f8ce2de358b803baf9bef57584769c81a4b45eb10678899f7-ellipsis.png) **> Go to Advanced Details**.
5. Under **Advanced Details**, select **Functional Accounts**.
6. In the **Functional Account** pane, click **Test Functional Account**.

## Set SSH Key on the managed account

An alternate and secure way to set up a managed account is with SSH Key authentication.

Before you can create the account, you must generate a private key. Copying or importing a key is part of setting the managed account properties with SSH Key authentication.

To create a managed account with SSH Key authentication:

1. Use a browser to sign in to your **BeyondInsight/Password Safe** URL.\
   This URL is provided in the BeyondTrust welcome email and includes your site URL followed by **/login**.
2. From the left menu, click ![Managed Systems icon](https://files.readme.io/f579adbe4852974a581ffef1bec41e8831f10a571d1e29b4740709260b51667c-managed-systems.png).\
   The **Managed Systems** page displays.
3. Locate the managed system in the grid.
4. Click ![Ellipsis icon](https://files.readme.io/d0b1d60d3325c79f8ce2de358b803baf9bef57584769c81a4b45eb10678899f7-ellipsis.png) **> Create New Managed Account**.
5. From the **Authentication Type** dropdownm, select **SSH Key**.
6. Configure all other settings as required.
7. Click **Create Account**.

## SSH Key auto management

A SSH Key policy is set on a managed system that supports SSH Key authentication.

The **Auto-Managed SSH Key** option enables SSH Key auto-management to take place when the credential for the account is changed, either manually or scheduled. It follows the same schedule as password changing.

Generating a new SSH public/private key pair results in the removal of the old public key (if there is one) from the **authorized\_keys** file and appends the new public key.

### Get the public key

1. Use a browser to sign in to your **BeyondInsight/Password Safe** URL.\
   This URL is provided in the BeyondTrust welcome email and includes your site URL followed by **/login**.
2. From the left menu, click ![Managed Accounts icon](https://files.readme.io/ce06224851f554e4f4bdc3262ca25fcd00aaf1266a016e416e96b72bd93b20bc-managed-accounts.png).\
   The **Managed Accounts** page displays.
3. Locate the managed account in the grid.
4. Click ![Ellipsis icon](https://files.readme.io/6510db312bf2b69a8e3e5467df7161eb719d09832984ab66f99a928f94d4c54c-ellipsis.png) **> Public Key**.

> ℹ️
>
> If a public key has been supplied, a popup displays the current public key.

### Create a SSH Key policy

Password Safe ships with a default SSH Key policy:

* Type: RSA
* Bit size: 2048
* Encryption: Auto Managed Passphrase is Default Password Policy

You can change the settings for the default policy but you cannot delete the policy.

Optionally, you can create additional policies.

1. Use a browser to sign in to your **BeyondInsight/Password Safe** URL.\
   This URL is provided in the BeyondTrust welcome email and includes your site URL followed by **/login**.
2. From the left menu, click ![Configuration icon](https://files.readme.io/5440329f4c22243ec1f8721a1c3d821fa7d6b7468cd0904e01869dc74e6cf354-configuration.png).\
   The **Configuration** page displays.
3. Under **Privileged Access Management Policies**,  select **SSH Key Policies**.\
   The **SSH Key Policies** page displays.
4. Click **Create SSH Key Policy**.
5. Enter a name.
6. Enter a description.
7. Select a Key Type: **RSA** or **DSA**.
8. Check **Encryption Enabled**.
9. Select a password policy.
10. Click **Update SSH Key Policy**.