Before you can connect to a remote SSH server, you must choose
one or more of the three supported authentication methods introduced
in Chapter 1. You configure the SSH client by specifying the authentication
methods you choose. In addition, the SSH server, which the system
manager configures, determines which authentication methods it will
use before it can make a connection. Therefore, each of these methods
requires configuration on both the SSH client and server.
After the SSH client makes a connection request to a remote
SSH server, the server sends the client its permitted authentication
methods. As with password and host-based authentication, the SSH
server may require the client to pass multiple authentication tests
before connecting.
The following SSH authentication methods are available:
Password
authentication.This method requires
that you supply a password to the client, which transmits the password
encrypted to the server over the network. Then the SSH server performs authorization,
verifying the supplied password using the OpenVMS native password-authentication mechanism.
Host-based authentication. This
method allows you to avoid specifying any secret information about the
SSH client. Host-based authentication method trusts the relationships
between hosts and does not require you to prove your identity. The SSH server host authenticates by verifying the
following:
The identity
of the client host using the client's host public key file, which
the system manager maintains in the known hosts database.
The
directory [TCPIP$SSH.SSH2.KNOWNHOSTS] contains public keys for all
client hosts that use the host-based authentication method to connect
to the server.
That the client host belongs
to the trusted hosts list, which the system
manager maintains on the server. This list of trusted hosts enables
you to log in to the server without proving your identity.
Optionally, you can restrict
users to only certain user names on the client host.
If any of these checks fail, the connection is refused.
An advantage of this method is that it does not require the client
to type a password or passphrases or to generate, distribute, and
maintain keys. This is convenient for batch processing. One disadvantage,
however, is a reliance on the identification of the host. This method requires that the server manager maintain two
pieces of information:
The
knownhost database, which contains the public key files of remote
hosts.
A trusted hosts file, which
lists the trusted hosts (and, optionally, the user names).
Public-key authentication.
This method uses public-key cryptography to verify the client's
identity and requires two pieces of data: your private-public key
pair, and, optionally, a passphrase to encode this key for saving
it in a file. This method is flexible because it allows additional
control over authorization by providing multiple keys and by applying
restrictions to each key. Public-key authentication requires management actions
on both ends of an SSH connection: both the user on the client host
and the system manager on the server host must create and maintain
keys on the client, copy public keys from the client to the server
hosts, and remember passphrases.
HP TCP/IP Services for OpenVMS Guide to SSH
Customizing the SSH Run-Time Environment
