Your browser does not support HTML5 local storage or you have disabled it. Some functionality on this site, including saving your privacy settings and offering you special discounts, uses local storage and may not work with local storage disabled. We recommend allowing the use of local storage in your browser. In some browsers, it is the same setting used for disabling cookies.
SSH-EXTERNALKEYS(5) SSH2 SSH-EXTERNALKEYS(5)
This document contains general information about using
external keys with SSH Tectia Server for IBM z/OS.
USING EXTERNAL KEYS
For applications capable of using external keys, two
strings need to be specified: the provider name and the
initialization string for the provider. These strings can
be given on the command line or in a configuration file,
depending on the application. The following section
describes the different providers available in more
The provider name and/or the initialization string may be
defined in the following configuration attributes and
EXTERNAL KEY PROVIDERS
The zos-saf provider is used for accessing keys
stored in the IBM z/OS System Authorization Facil-
The initialization string for the zos-saf provider
specifies the key(s) to be used and it has the fol-
KEYS(..) may repeat. The subattributes are:
ID - A SAF user id signifying the owner of the key
ring. If missing, the current user's id is used.
RING - Key ring name. Mandatory.
LABEL - The SAF key label. If missing, and DEFAULT
is missing, use all the keys in the key ring.
DEFAULT - Use the key that is marked as the
default key on the key ring. Do not specify
together with LABEL.
Values must be written in single quotation marks if
they contain single quotation marks or parenthesis.
The initialization string specified with the
HostKeyEkInitString keyword of sshd2_config must
point to a single private key. If the key ring con-
tains several keys, LABEL must be used to distin-
guish between the keys.
When using a trusted key provider and the SSH Tec-
tia Certificate Validator, specify KEYS variables
that include all the CA certificates needed, for
PkiEkInitString="KEYS(RING(Trusted.CAs) LABEL('Primary CA'))
The key-store[@init] attribute of ssh-broker-config.xml
and the AuthorizationEkProvider keyword of sshd2_config
can contain special strings in the key specification
that are mapped according the following list:
%U = user name
%IU = user ID
%IG = user group ID
SSH Communications Security Corp.
For more information, see http://www.ssh.com.
ssh-certd(8), ssh-broker-config(5), ssh_certd_config(5),