Your browser does not allow storing cookies. We recommend enabling them.



ssh-externalkeys — Using external keys with Tectia Server for IBM z/OS


This document contains general information about using external keys with Tectia Server for IBM z/OS.

Using External Keys

For applications capable of using external keys, two strings need to be specified: the provider name and the initialization string for the provider. These strings can be given on the command line or in a configuration file, depending on the application. The following section describes the different providers available in more detail.

The provider name and/or the initialization string may be defined in the following configuration attributes and keywords:

In ssh-broker-config.xml:




In sshd2_config:





In ssh_certd_config:




External Key Providers


The zos-saf provider is used for accessing keys stored in the IBM z/OS System Authorization Facility (SAF).

The initialization string for the zos-saf provider specifies the key(s) to be used and it has the following components:

{KEYS([ID(xxx)]RING(xxx) [LABEL(xxx)|DEFAULT])}...

KEYS(..) may repeat. The sub-attributes are:

  • ID - A SAF user ID signifying the owner of the key ring. If missing, the current user's ID is used.

  • RING - Key ring name. Mandatory.

  • LABEL - The SAF key label. If missing, and DEFAULT is missing, use all the keys in the key ring.

  • DEFAULT - Use the key that is marked as the default key on the key ring. Do not specify together with LABEL.

Values must be written in single quotation marks if they contain single quotation marks or parenthesis.

The initialization string specified with the HostKeyEkInitString keyword of sshd2_config must point to a single private key. If the key ring contains several keys, LABEL must be used to distinguish between the keys.

When using a trusted key provider and the Tectia Certificate Validator, specify KEYS variables that include all the CA certificates needed, for example:

PkiEkInitString="KEYS(RING(Trusted.CAs) LABEL('Primary CA'))

The key-store[@init] attribute of ssh-broker-config.xml and the AuthorizationEkProvider keyword of sshd2_config can contain special strings in the key specification that are mapped according the following list:

  • %U = user name

  • %IU = user ID

  • %IG = user group ID




What to read next:

  • Reduce Secure Shell risk. Get to know the NIST 7966.

    The NISTIR 7966 guideline from the Computer Security Division of NIST is a direct call to action for organizations regardless of industry and is a mandate for the US Federal government.
    Download now
  • ISACA Practitioner Guide for SSH

    With contributions from practitioners, specialists and SSH.COM experts, the ISACA “SSH: Practitioner Considerations” guide is vital best practice from the compliance and audit community.
    Download now