Update SSH keys for an SFTP user

This document shows how to update the Secure Shell (SSH) keys that a Cloud FTP user can use to connect to an SFTP server.

Before you begin

• Get the user's public key from each SSH key pair that they will use to connect to the server. A user can have a maximum of 10 public keys.

  If the user doesn't have an SSH key pair, use the following steps to generate one.

  Generate an SSH key pair

  Which key format do you need?

  The key format that you need depends on which client you use to connect to the SFTP server. For more information, see Supported SFTP clients.

  PEM format

  1. To create an OpenSSH key pair (PEM format), use the ssh-keygen utility.

     On the client machine that will connect to the SFTP server, run the following command:

     ssh-keygen -t rsa -b 4096 -f ~/.ssh/KEY_PAIR_NAME

     Replace KEY_PAIR_NAME with a name for the key pair, such as sftp_user_key.

  2. Extract the public key:

     cat ~/.ssh/KEY_PAIR_NAME.pub

  PPK format

  1. To create a PuTTY key pair (PPK format), use the PuTTYgen tool.

     On the client machine that will connect to the SFTP server, run the following command:

     puttygen -t rsa -b 4096 -o KEY_PAIR_NAME.ppk

     Replace KEY_PAIR_NAME with a name for the key pair, such as sftp_user_key.

  2. Extract the public key:

     puttygen -L KEY_PAIR_NAME.ppk

Required roles

To get the permission that you need to update SFTP users, ask your administrator to grant you the FTP Admin (roles/ftp.admin) IAM role on your project. For more information about granting roles, see Manage access to projects, folders, and organizations.

This predefined role contains the ftp.users.update permission, which is required to update SFTP users.

You might also be able to get this permission with custom roles or other predefined roles.

Update an SFTP user's SSH keys

gcloud

To update an SFTP user's SSH keys, run the gcloud alpha storage ftp users update command.

Caution: The keys that you provide in the request overwrite all existing values.

Before using any of the command data below, make the following replacements:

• CREDENTIAL_NAME: a unique name to identify the user credentials.
• SSH_PUBLIC_KEY: the body of the user's SSH public key, in OpenSSH format. For example, ssh-rsa AAAAB3NzaC1ycRexample....
• USERNAME: the SFTP user's username.
• LOCATION_ID: the location of the server, such as us-west1.
• SERVER_ID: the server ID.

To configure multiple public keys for a user, provide multiple credentials in the credentials.json file.

Save the following content in a file called credentials.json:

[
  {
    "credentialName": "CREDENTIAL_NAME",
    "credentialType": "PUBLIC_KEY",
    "sshPublicKeyBody": "SSH_PUBLIC_KEY"
  }
]

Execute the following command:

Linux, macOS, or Cloud Shell

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha storage ftp users update USERNAME --location=LOCATION_ID \
    --server=SERVER_ID --user-credentials-from-file=credentials.json

Windows (PowerShell)

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha storage ftp users update USERNAME --location=LOCATION_ID `
    --server=SERVER_ID --user-credentials-from-file=credentials.json

Windows (cmd.exe)

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha storage ftp users update USERNAME --location=LOCATION_ID ^
    --server=SERVER_ID --user-credentials-from-file=credentials.json

It takes a few seconds for the user to be updated.

REST

To update an SFTP user's SSH keys, use the servers.users.patch method. In the updateMask query parameter, provide the userCredentials field.

Caution: The keys that you provide in the request overwrite all existing values.

Before using any of the request data, make the following replacements:

• PROJECT_ID: the Google Cloud project ID of the server.
• LOCATION_ID: the location of the server, such as us-west1.
• SERVER_ID: the server ID.
• USERNAME: the SFTP user's username.
• CREDENTIAL_NAME: a unique name to identify the user credentials.
• SSH_PUBLIC_KEY: the body of the user's SSH public key, in OpenSSH format. For example, ssh-rsa AAAAB3NzaC1ycRexample....

To configure multiple public keys for a user, provide multiple credentials in the userCredentials list.

HTTP method and URL:

PATCH https://ftp.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/servers/SERVER_ID/users/USERNAME?updateMask=userCredentials

Request JSON body:

{
  "userCredentials": [
    {
      "credentialName": "CREDENTIAL_NAME",
      "credentialType": "PUBLIC_KEY",
      "sshPublicKeyBody": "SSH_PUBLIC_KEY"
    }
  ]
}

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login , or by using Cloud Shell, which automatically logs you into the gcloud CLI . You can check the currently active account by running gcloud auth list.

Save the request body in a file named request.json, and execute the following command:

curl -X PATCH \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://ftp.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/servers/SERVER_ID/users/USERNAME?updateMask=userCredentials"

PowerShell (Windows)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login . You can check the currently active account by running gcloud auth list.

Save the request body in a file named request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method PATCH `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://ftp.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/servers/SERVER_ID/users/USERNAME?updateMask=userCredentials" | Select-Object -Expand Content

The response identifies a long-running operation. It takes a few seconds for the user to be updated.