Public-key authentication is based on the use of digital signatures and provides very good authentication security. To use public-key authentication, the user must first create a key pair on the client, and upload the public key to the server.

The default directory where Tectia Server stores the users' public keys is $HOME/.ssh2/authorized_keys on Unix, and %USERPROFILE%\.ssh2\authorized_keys on Windows. The directory can be changed with the authorized-keys-directory attribute in the ssh-server-config.xml file. See auth-publickey.

The user is required to have the read rights, (and optionally the write rights) to the public-key files and directories, but the locations must not be accessible to other users. The read permissions are required for the key.pub file, the authorized_keys directory, and to the authorization file, if used. The write permission to these files are needed if the users are allowed to upload their own keys to the server.

To enable public-key authentication on the server, the authentication-methods element of the ssh-server-config.xml file must contain an auth-publickey element. For example:

<authentication-methods>
  <authentication action="allow">
    <auth-publickey authorized-keys-directory="%D/.ssh2/authorized_keys" />
    ...
  </authentication>
</authentication-methods>  

Also other authentication methods can be allowed.

By using selectors, it is possible to allow or require public-key authentication only for a specified group of users. See Using Selectors in Configuration File for more information.

Using the Tectia Server Configuration tool, public-key authentication can be allowed on the Authentication page. See Authentication.