Generate an SSH key pair on the Management Cloud Engine (MCE) that exports audit logs when you configure a receiver that uses public key authentication. Store the private key on the MCE and install the corresponding public key on the receiver host.

1. On the MCE host, generate a key pair. Oracle recommends that you create the key directly in /opt/oracle/mce/export/audit-export/keys.
   Use one of the following commands, replacing the example key name and comment as needed.

   # RSA 3072
      ssh-keygen -t rsa -b 3072 -a 64 -o \
        -f /opt/oracle/mce/export/audit-export/keys/mce_audit_rsa_3072 \
        -C "mce-audit-export-rsa-3072"

    # ED25519
      ssh-keygen -t ed25519 -a 64 \
        -f /opt/oracle/mce/export/audit-export/keys/mce_audit_ed25519 \
        -C "mce-audit-export-ed25519"

    # ECDSA P-384
      ssh-keygen -t ecdsa -b 384 -a 64 \
        -f /opt/oracle/mce/export/audit-export/keys/mce_audit_ecdsa_p384 \
        -C "mce-audit-export-ecdsa-p384"

2. Alternatively, generate the key pair in another directory and copy the private key to the MCE keys directory later. For example:

   # RSA 3072
      ssh-keygen -t rsa -b 3072 -a 64 -o \
        -f ~/auditExportKeys/mce_audit_rsa_3072 \
        -C "mce-audit-export-rsa-3072"

     # ED25519
      ssh-keygen -t ed25519 -a 64 \
        -f ~/auditExportKeys/mce_audit_ed25519 \
        -C "mce-audit-export-ed25519"

    # ECDSA P-384
      ssh-keygen -t ecdsa -b 384 -a 64 \
        -f ~/auditExportKeys/mce_audit_ecdsa_p384 \
        -C "mce-audit-export-ecdsa-p384"

3. When prompted, enter and confirm a passphrase, or press Enter twice to create a key without a passphrase. If you specify a passphrase, enter the same passphrase when you configure the receiver.
4. If you created the key outside /opt/oracle/mce/export/audit-export/keys, copy the private key to that directory. Do not copy the private key to the receiver host.

   cp <path-to-private-key>/<key-name> /opt/oracle/mce/export/audit-export/keys/

5. Set the required private and public file permissions in the directory that contains the key pair.

   cd /opt/oracle/mce/export/audit-export/keys
   chmod 600 mce_audit_rsa_3072
   chmod 644 mce_audit_rsa_3072.pub

6. Verify the file permissions by running the following command:

   stat -c '%a %U:%G %n' *

7. Install the public key on the receiver host. You can use ssh-copy-id.

   ssh-copy-id -i <path-to-public-key>/<key-name>.pub <target-user>@<target-host>

   Alternatively, append the contents of the public key file to the target user's ~/.ssh/authorized_keys file. Ensure that the .ssh directory has permission 700 and the authorized_keys file has permission 600.

   Note:

   The key pair does not expire automatically. To rotate a key, generate and install a new key pair, update the receiver configuration to use the new private key, verify that the export succeeds, and then remove the old public key from the receiver host.