Your browser does not allow storing cookies. We recommend enabling them.

SSH Tectia 
PreviousNextUp[Contents] [Index]

    About This Document >>
    Installing SSH Tectia Server for IBM z/OS >>
    Getting Started with SSH Tectia Server for IBM z/OS >>
    Configuring the Server >>
    Authentication >>
        Using the z/OS System Authorization Facility
        Server Authentication with Public Keys in File >>
        Server Authentication with Certificates
            Certificates Stored in File
            Certificates Stored in SAF
        User Authentication with Passwords
        User Authentication with Public Keys in File >>
        User Authentication with Certificates >>
        Host-Based User Authentication >>
        User Authentication with Keyboard-Interactive
    System Administration >>
    File Transfer Using SFTP >>
    Secure File Transfer Using Transparent FTP Security >>
    Tunneling >>
    Troubleshooting SSH Tectia Server for IBM z/OS >>
    Man Pages and Default Configuration Files >>
    Log Messages >>

Server Authentication with Certificates

SSH Tectia Server for IBM z/OS includes two implementations of certificate authentication. One is based on keys and X.509 certificates in files and software cryptography. This is the same implementation that is available in SSH Tectia products on other platforms. The other is based on keys and certificates managed by the z/OS System Authorization Facility (SAF) and cryptographic operations handled by the z/OS Integrated Cryptographic Service Facility (ICSF).

The implementations can be combined or used separately. The SSH Tectia validation can use trusted keys stored in file or in SAF, or the SAF validation can be used alone.

  • SAF Validation

    ICSF is the interface to hardware cryptographic devices. SSH Tectia Server for IBM z/OS benefits from the higher security and performance that these devices provide for keys and certificates managed by SAF.

    SSH Tectia Server for IBM z/OS also supports SAF keys that do not use hardware crypto devices, the so-called NON-ICSF keys. For these keys, the cryptographic operations are performed in software.

    The interface to SAF in SSH Tectia Server for IBM z/OS is implemented with an SSH Tectia External Key Provider. The External Key Providers are configured with specification strings in a configuration file or on a command line.

    SSH Tectia Server for IBM z/OS validates public keys by matching them against trusted keys stored in the file system.

    SAF does a limited form of certificate checking that only determines which SAF user is the owner of the certificate. SAF does not check the contents of the certificate, such as the validity period, or check for certificate revocation. Instead of revoking a certificate the site can reduce the user's access rights in SAF.

    A trusted key provider must be configured if SAF certificate checking is to be used.

    To enable SAF checking of remote Secure Shell servers, their certificates can be entered into SAF as SITE keys and placed on a key ring for the trusted key provider.

  • SSH Tectia Certificate Validation

    The SSH Tectia Certificate Validator does a full validation of the certificate and can be configured to use external PKI services such as LDAP servers that store revocation information.

    When a trusted key provider is configured, the Tectia validator takes its trusted CA certificates from SAF, otherwise they are read from files.

SSH Tectia Server for IBM z/OS can be configured to support either public-key or certificate authentication. With certificate authentication, the private key and certificate can be stored either in SAF or in file.

It is also possible to configure the server to use a key from SAF and use only the public key extracted from the certificate for authentication.

If a SAF key is configured but the key cannot be found or ICSF is required but not available, the server will issue an error message and will not start up.

Certificates Stored in File

Certificates Stored in SAF

PreviousNextUp[Contents] [Index]

[ Contact Information | Support | Feedback | SSH Home Page | SSH Products ]

Copyright © 2011 SSH Communications Security Corp.
This software is protected by international copyright laws. All rights reserved.
Copyright Notice




What to read next:

  • Reduce Secure Shell risk. Get to know the NIST 7966.

    The NISTIR 7966 guideline from the Computer Security Division of NIST is a direct call to action for organizations regardless of industry and is a mandate for the US Federal government.
    Download now
  • ISACA Practitioner Guide for SSH

    With contributions from practitioners, specialists and SSH.COM experts, the ISACA “SSH: Practitioner Considerations” guide is vital best practice from the compliance and audit community.
    Download now