Your browser does not allow storing cookies. We recommend enabling them.

SSH Tectia 
PreviousNextUp[Contents] [Index]

    About This Document >>
    Installing SSH Tectia Server for IBM z/OS >>
    Getting Started with SSH Tectia Server for IBM z/OS >>
    Configuring the Server >>
    Configuring the Client >>
    Authentication >>
        Using the z/OS System Authorization Facility
        Server Authentication with Public Keys in File >>
        Server Authentication with Certificates >>
        User Authentication with Passwords
        User Authentication with Public Keys in File >>
            Using Public-Key Authentication from z/OS Client
            Using Public-Key Authentication from Windows Client to z/OS Server
            Using Public-Key Authentication from Unix Client to z/OS Server
            z/OS Server Configuration
            Optional Configuration Settings
        User Authentication with Certificates >>
        Host-Based User Authentication >>
        User Authentication with Keyboard-Interactive >>
        Distributing Public Keys Using the Key Distribution Tool >>
    Transferring Files >>
    Tunneling >>
    Troubleshooting SSH Tectia Server for IBM z/OS >>
    Advanced Information >>
    Man Pages >>
    Log Messages >>

Using Public-Key Authentication from z/OS Client

All commands in this section are shown using the SSH Tectia z/OS client. Server-side configuration can also be done by logging in to the remote server and entering the commands locally.

To set up user public-key authentication from a z/OS Client, do the following steps:

  1. Create a key pair by executing ssh-keygen2 on the z/OS client host.

    By default, ssh-keygen2 creates a 2048-bit DSA key pair. RSA keys can be generated by specifying the -t rsa option. Key length can be specified with the -b option. For non-interactive use, the key can be generated without a passphrase with the -P option.

    > /usr/lpp/ssh2/bin/ssh-keygen2 -t rsa -b 1024 -P $HOME/.ssh2/mf_key
    Generating 1024-bit rsa key pair
       2 oOo.oOo.oOo.
    Key generated.
    1024-bit rsa, TESTUSER@ZOS, Tue Jul 11 2006 01:45:06 -0600
    Private key saved to /u/TESTUSER/.ssh2/mf_key
    Public key saved to /u/TESTUSER/.ssh2/

    If the -P option is not used, ssh-keygen2 asks for a passphrase for the new key.

    ssh-keygen2 stores your new authentication key pair in two separate files. One of the keys is your private key which must never be made available to anyone but yourself.

    In the example above, the private key file is mf_key. The other file is your public key, which can be distributed to other computers.

    For more information on the ssh-keygen2 options, see the ssh-keygen2 man page (Appendix ssh-keygen2).

  2. Create an identification file in your $HOME/.ssh2 directory on the z/OS Client, for example:
    > cd $HOME/.ssh2
    > echo "IdKey mf_key" >> identification
    > cat identification 
    IdKey mf_key
    You now have an identification file that consists of one line that denotes the file containing your identification (your private key). For special applications, you can create multiple identifications by executing ssh-keygen2 again. However, this is not usually needed.
  3. Create a .ssh2 or .ssh directory on Server (if it does not exist already).
    • If the remote host is running SSH Tectia Server on Unix or z/OS :
      $ ssh2 testuser@tectia_server mkdir .ssh2
    • If the remote host is running SSH Tectia Server on Windows:
      $ ssh2 testuser@tectia_win_server "cmd /c mkdir .ssh2"
    • If the remote host is running OpenSSH on Unix or z/OS:
      $ ssh2 testuser@openssh_server mkdir .ssh
  4. Copy your public key to Server.
    • Keys created with z/OS ssh-keygen2 are stored in the EBCDIC format. When the public key is transferred to a Unix or Windows server, it must be converted to the ASCII format.
      $ scp2 /ftadv:C=ISO8859-1,D=IBM-1047,X=TEXT/ \
      $ scp2 /ftadv:C=ISO8859-1,D=IBM-1047,X=TEXT/ \ 
    • If public-key authentication is configured between mainframe servers, conversion is not needed. To ensure that key stays in EBCDIC format, binary file transfer should be used.
      $ scp2 /ftadv:X=BIN/ 
      $ scp2 /ftadv:X=BIN/ testuser@openssh_server:.ssh
  5. Create an authorization or authorized_keys file on Server.
    • If the remote host is running SSH Tectia Server, the key entry needs to be added to authorization file.
      $ ssh2 testuser@tectia_unix_server "echo Key >> \
      $ ssh2 testuser@tectia_win_server "cmd /c echo Key >> \
    • If the remote host is running OpenSSH, the key has to be converted to the OpenSSH key format and concatenated to the authorized_keys file.
      $ ssh2 testuser@open_server "ssh-keygen -i -f .ssh/ >> \
  6. Make sure the AllowedAuthentications keyword in the /etc/ssh2/ssh2_config (or $HOME/.ssh2/ssh2_config) file on the z/OS client contains the argument publickey:

    AllowedAuthentications   publickey 

    Other authentication methods can be listed in the configuration file as well.

Using Keys Generated with OpenSSH

SSH Tectia Server for IBM z/OS can use keys generated with OpenSSH. The OpenSSH keys can be configured the same way as described above in steps 2-5 for keys generated with ssh-keygen2.

As an alternative to step 2, OpenSSH private keys can be specified using the IdentityKeyFile option in the ssh2_config file or with the -K option on the command line.

If the user has an existing OpenSSH authorized_keys file on the server, the ssh-keygen2 tool can be used to import the OpenSSH authorized_keys file and to configure the authorization file, for example:

SERVER> ssh-keygen2 --import-ssh1-authorized-key 
$HOME/.ssh/authorized_keys $HOME/.ssh2/authorization

Imported key /home/user/.ssh/authorized_keys:1 to 
/home/user/ and added to authorization file 
Imported key /home/user/.ssh/authorized_keys:2 to 
/home/user/ and added to authorization file 

For more information on the ssh-keygen2 options, see the ssh-keygen2 man page (Appendix ssh-keygen2).

Alternatively, the administrator of SSH Tectia Server may enable AuthorizedKeysFile in the server configuration file /etc/ssh2/sshd2_config, for example as follows:

AuthorizedKeysFile %D/.ssh/authorized_keys

SSH Tectia Server will check the defined AuthorizedKeysFile in addition to the user's AuthorizationFile (by default authorization). Note that the AuthorizationFile has precedence over AuthorizedKeysFile if the same key is defined in both.

Keys Generated with ssh-keygen1

SSH Tectia Server for IBM z/OS enables the use of keys generated with ssh-keygen1. However, the keys must be converted from the SSH1 format to SSH2 format.

$ ssh-keygen2 -1 <keyname>.pub 
Successfully converted public key to <keyname>.pub_ssh2
$ ssh-keygen2 -1 <keyname>     
Passphrase : 
Successfully converted private key to <keyname>_ssh2

PreviousNextUp[Contents] [Index]

[ Contact Information | Support | Feedback | SSH Home Page | SSH Products ]

Copyright © 2007 SSH Communications Security Corp.
This software is protected by international copyright laws. All rights reserved.
Copyright Notice




What to read next:

  • Reduce Secure Shell risk. Get to know the NIST 7966.

    The NISTIR 7966 guideline from the Computer Security Division of NIST is a direct call to action for organizations regardless of industry and is a mandate for the US Federal government.
    Download now
  • ISACA Practitioner Guide for SSH

    With contributions from practitioners, specialists and SSH.COM experts, the ISACA “SSH: Practitioner Considerations” guide is vital best practice from the compliance and audit community.
    Download now