It is possible to use a certificate instead of the traditional public-key pair to authenticate the client host.
The endpoint identity check, where the server verifies that the certificate actually belongs to the client that is attempting host-based authentication, is performed according to the following rules:
One of the DNS subject alternative names in the client certificate must
match the client's fully qualified domain name obtained by doing a
reverse lookup on the client's IP address. The alternative names may
have an asterisk (
*) as the first component, in which case
only the domain part is checked.
If the client's IP address cannot be reverse-mapped, the IP address is compared to the certificate's IP subject alternative names.
If the above checks do not produce a positive result, the certificate's subject name is checked. If it has a CN component that matches the client's reverse-mapped fully qualified domain name or IP address, the certificate is accepted.
To enable host-based authentication with certificates on
the following as
Add the following line in the
<authentication-methods> <authentication-method name="hostbased" /> ... </authentication-methods>
Also other authentication methods can be listed. Place the least interactive method first (this means usually the host-based method).
Enroll a certificate for
User Authentication with Certificates for more information.
The certificate must contain a
dns extension which
contains the fully qualified domain name (FQDN) of
Note that the private key associated with the certificate needs to be stored with an empty passphrase.
Define the private key and certificate in
<params> <hostkey> <private file="/etc/ssh2/hostcert" /> <x509-certificate file="/etc/ssh2/hostcert.crt" /> </hostkey> ... </params>
If SSH Tectia Server is not installed on
Client, create the
configuration file manually and save it in the
Do the following as the server administrator:
Specify the CA certificate in the
<cert-validation> <ca-certificate name="exa-ca1" file="/etc/ssh2/exa-ca1.crt" /> ... </cert-validation>
ssh-server-config.xml file, under
authentication-methods element, add an
auth-hostbased element. For example:
<authentication-methods> <authentication name="hostbased-block"> <auth-hostbased require-dns-match="no" /> <authentication action="allow" name="hostbased-cert-allow"> <selector> <host-certificate field="ca-list" pattern="exa-ca1" /> </selector> </authentication> <authentication action="deny" /> </authentication> </authentication-methods>
In addition to being signed by the required CA, the certificate must pass the endpoint identity check, described in detail in Using Certificates .
On Windows, using the SSH Tectia Server Configuration tool, host-based authentication can be configured on the Authentication page. See Authentication.
ssh-server-config-tool to take the new
configuration in use. See ssh-server-config-tool(8).
On Windows, click Apply to take the new settings in use.