Your browser does not allow storing cookies. We recommend enabling them.

SSH Tectia

Host-Based User Authentication

Host-based authentication uses the public key of the client machine to authenticate a user to the remote server. Host-based authentication can be used with SSH Tectia Client on Unix. The SSH Tectia Server can be either an Unix or Windows server. Usually also SSH Tectia Server is installed on the client machine.

On Windows, the user should have a local account on the server. Host-based authentication cannot be used with Windows domain accounts.

Host-based authentication provides a non-interactive form of authentication, and is best used in scripts and automated processes, such as cron jobs. Host-based authentication can be used to automate backups and file transfers, or in other situations where a user will not be present to input authentication information.


The nature of any non-interactive login is inherently unsecured. Whenever authentication without user challenge is permitted, some level of risk must be assumed. If feasible, public-key authentication is preferred. SSH Tectia Server provides host-based authentication as a form of non-interactive login that is more secure than the .rhosts method used by the Berkeley 'r' commands, but it cannot resolve the inherent lack of security of non-interactive logins.

This means that you should take aggressive measures to ensure that any client machine set up for host-based authentication is adequately secured, both by software and hardware, to prevent unauthorized logins to the server.

Host-based authentication can be enabled either by using conventional public keys or by using certificates.

In the following instructions, Server is the remote host running SSH Tectia Server to which you are trying to connect to. ServerUser is the user name on Server that you are logging in as. Client is the host running SSH Tectia Client. ClientUser is the user name on Client that should be allowed to log in to Server as ServerUser. With SSH Tectia Client, ClientUser and ServerUser must be the same.


Highlights from the SSH.COM blog:

  • Cryptomining with the SSH protocol: what big enterprises need to know about it

    Cryptomining malware is primarily thought of as targeting desktops and laptops and is used to hijack system resources to mine cryptocurrency.
    Read more
  • SLAM the door shut on traditional privileged access management

    Did you know that something as trivial-sounding as granting access for your developers or third parties to a product development environment can throw a gorilla-sized monkey wrench into your operations and productivity?
    Read more
  • We broke the IT security perimeter

    Everyone understands the concept of a security perimeter. You only gain access if you are identified and authorized to do so.
    Read more