Your browser does not allow storing cookies. We recommend enabling them.

SSH

Generating the Server Host Key Pair

The host public-key pair (1536-bit RSA) is generated during the setup of Tectia Server (Running the Setup Script). You only need to regenerate it if you want to change your host key pair.

Tectia Server for IBM z/OS includes a program that generates a key pair, ssh-keygen-g3, which is located in /opt/tectia/bin.

Generate the key pair for the server in such a way that the private key has no passphrase (option -P). The server will then start up without any operator interaction to enter a passphrase. Protect the key with file system access rules. The private key (/opt/tectia/etc/hostkey) must be accessible only by the SSHD2 user.

To (re)generate the host key, perform the following tasks:

  1. Use su to switch to a UID 0 user (if you are not already logged in as one).

  2. Run ssh-keygen-g3 to generate the host key, for example:

    # /opt/tectia/bin/ssh-keygen-g3 -t rsa -P /opt/tectia/etc/hostkey

    This will generate a 2048-bit RSA key pair without a passphrase and store it under /opt/tectia/etc.

    For more information on the key generation options, see the Tectia Server for IBM z/OS User Manual or the ssh-keygen-g3 man page.

  3. Restart the server as instructed in Restarting and Stopping sshd2.


 

 
Highlights from the SSH.COM blog:

  • Cryptomining with the SSH protocol: what big enterprises need to know about it

    Cryptomining malware is primarily thought of as targeting desktops and laptops and is used to hijack system resources to mine cryptocurrency.
    Read more
  • SLAM the door shut on traditional privileged access management

    Did you know that something as trivial-sounding as granting access for your developers or third parties to a product development environment can throw a gorilla-sized monkey wrench into your operations and productivity?
    Read more
  • We broke the IT security perimeter

    Everyone understands the concept of a security perimeter. You only gain access if you are identified and authorized to do so.
    Read more