It is possible to use a certificate instead of the traditional public-key pair to authenticate the client host.
The endpoint identity check, where the server verifies that the certificate actually belongs to the client that is attempting host-based authentication, is performed according to the following rules:
One of the DNS subject alternative names in the client certificate must match the client's fully qualified domain name obtained by doing a reverse lookup on the client's IP address. The alternative names may have an asterisk (
*) as the first component, in which case only the domain part is checked.
If the client's IP address cannot be reverse-mapped, the IP address is compared to the certificate's IP subject alternative names.
If the above checks do not produce a positive result, the certificate's subject name is checked. If it has a CN component that matches the client's reverse-mapped fully qualified domain name or IP address, the certificate is accepted.
To enable host-based authentication with certificates on
Client, do the following as
Add the following line in the
<authentication-methods> <authentication-method name="hostbased" /> ... </authentication-methods>
Also other authentication methods can be listed. Place the least interactive method first (this means usually the host-based method).
Enroll a certificate for
Client. See User Authentication with Certificates for more information.
The certificate must contain a
dnsextension which contains the fully qualified domain name (FQDN) of
Note that the private key associated with the certificate needs to be stored with an empty passphrase.
Define the private key and certificate in
<params> <hostkey> <private file="/etc/ssh2/hostcert" /> <x509-certificate file="/etc/ssh2/hostcert.crt" /> </hostkey> ... </params>
If SSH Tectia Server is not installed on
Client, create the configuration file manually and save it in the
Do the following as the server administrator:
Specify the CA certificate in the
<cert-validation> <ca-certificate name="myca" file="/etc/ssh2/ca-certificate.crt" /> ... </cert-validation>
ssh-server-config.xmlfile, under the
authentication-methodselement, add an
<authentication-methods> <authentication name="hostbased-block"> <auth-hostbased require-dns-match="no" /> <authentication action="allow" name="hostbased-cert-allow"> <selector> <host-certificate field="ca-list" pattern="exa-ca1" /> </selector> </authentication> <authentication action="deny" /> </authentication> </authentication-methods>
In addition to being signed by the required CA, the certificate must pass the endpoint identity check, described in detail in Using Certificates .
On Windows, using the SSH Tectia Server Configuration tool, host-based authentication can be configured on the Authentication page. See Authentication.
ssh-server-config-toolto take the new configuration in use. See ssh-server-config-tool(8).
On Windows, click Apply to take the new settings in use.