On the Connection tab, you can define a default user name to be used when connecting to remote servers. This connection is useful when several users will be using profiles jointly, either with their own system user names or with a common user account.

Figure A.4. The user name and network address family settings for connections

Select the Use current Windows user name option, to automatically apply the Windows user name of the currently logged in user to connections to remote servers.

Select the Specify user name option and enter a generic user name. Note that the name is case sensitive.

The given user name will be used in connections unless another user name is specified in a connection profile or connection attempt. In case you select this option but leave the user name field empty, the Connection Broker will prompt the user for a user name.

In principle, you can enter value "%USERNAME%", but it has the same effect as selecting Use current Windows user name.

If you specify a host name or the profile contains a host name, the Connection Broker will try to resolve the address based on the Network address family setting. If you select inet, the Connection Broker will resolve the host name only with an IPv4 address. If you select inet6, the Connection Broker will resolve the host name only with an IPv6 address. Selecting Any means that the Connection Broker will resolve the host name with any IP address (IPv4 or IPv6) available.

	Note
	You can specify a direct IP address (either IPv4 or IPv6) for the connection using either the connection profile or the command line. This setting does not restrict the user specified network family address. For example, the connection will be established to a specified IPv4 address even if the network address family was set to IPv6.

Settings made in this tab take effect the next time a user logs in.

On the Authentication tab, you can define the default user authentication methods.

Figure A.5. Authentication methods for Tectia Client

Select the Use factory defaults check box to use the factory default authentication methods, or clear the check box to define a custom list of authentication methods.

In Tectia Client 6.5, the factory default authentication methods are, in order:

The authentication methods are supported on all platforms, except for GSSAPI, which is not available on IBM z/OS.

To add a new authentication method to the list, click Add and select the method from the drop-down menu.

To remove an authentication method, select the method from the list and click Delete.

Use the arrow buttons to organize the preferred order of the authentication methods. The first method that is allowed by the Secure Shell server is used. Note that in some cases, the server may require several authentication methods to be passed before allowing login.

Possible methods for user authentication are:

In the GSSAPI Authentication field, by selecting the Allow Ticket Forwarding check box you can enable Tectia Client to allow forwarding the Kerberos ticket over several connections.

When using Public-Key Authentication, you can also define which key types are used and how the keys are selected.

Key selection defines the policy Connection Broker uses when proposing user public keys to the server. Select the mode from the drop-down list. The options are:

Key types defines whether only plain public keys or only certificates are tried during public-key authentication. Select the key type from the drop-down list. The default is to try both plain public keys and certificates.

By selecting the Issuer must match server certificate issuer check box, you can make the Connection Broker filter the user certificates that will be included in the list presented to the user. The client-side user certificates can be filtered according to their issuer name that is compared to the certificate issuers requested or accepted by the server. By default, the filtering is not done. This option is useful when a user has several certificates with different access rights to the same server, for example for a testing role and for an administrator role. The Connection Broker chooses the relevant certificates that are applicable on the remote host, and the user can choose the correct certificate from the short-listed ones.

To generate new public-key pairs and to upload the public part of the key to a server, click the Public-Key Authentication Wizard button. For more information, see Using the Public-Key Authentication Wizard.

Enabled algorithms lists the public-key signature algorithms that are used for authenticating and signing the user's public key. The algorithms that will be used are those that are configured for both Tectia Server and the Connection Broker. You can use the up and down arrow buttons to modify the order of the algorithms. To move an algorithm to the Disabled algorithms list, select it and click the right arrow button.

The factory default public-key signature algorithms are, in order:

On the Ciphers tab, you can define the encryption algorithms used.

Figure A.6. Defining a cipher list

Select the Use factory defaults check box to use the factory default algorithms, or define a cipher list using the arrow buttons. The ciphers are tried in the order they are specified.

The factory default ciphers are, in order:

The ciphers that can operate in the FIPS mode are 3DES and both the CBC-mode and CTR-mode AES-128, AES-192, and AES-256.

Tectia proprietary algorithms are marked with (Tectia) and are operable with Tectia products only. They correspond to the algorithms that end with @ssh.com in the Connection Broker configuration file.

On the MACs tab, you can configure the message integrity algorithms used.

Figure A.7. Defining a MAC list

Select the Use factory defaults check box to use the factory default algorithms, or define a MAC list using the arrow buttons. The MACs are tried in the order they are specified.

The factory default MACs are, in order:

All the HMAC-SHA (both HMAC-SHA1 and HMAC-SHA2) algorithm variants listed above can operate in the FIPS mode.

Tectia proprietary algorithms are marked with (Tectia) and are operable with Tectia products only. They correspond to the algorithms that end with @ssh.com in the Connection Broker configuration file.

The algorithms marked with (OpenSSH) correspond to the algorithms that end with @openssh.com in the Connection Broker configuration file.

On the KEXs tab, you can configure the key exhange methods used.

Figure A.8. Defining a KEX list

Select the Use factory defaults check box to use the factory default methods, or define a KEX list using the arrow buttons. The KEX methods are tried in the order they are specified.

The factory default KEXs are, in order:

All the supported KEXs, except Curve25519-sha256 (OpenSSH), can operate in FIPS mode on Windows and Linux. For more information on the FIPS-Certified Cryptographic Library, see FIPS-Certified Cryptographic Library.

Tectia proprietary algorithms are marked with (Tectia) and are operable with Tectia products only. They correspond to the algorithms that end with @ssh.com in the Connection Broker configuration file.

On the Server tab, you can define advanced server connection settings.

Figure A.9. Defining server connection settings

On the Tunneling tab, you can define the default settings for X11 connections and agent forwarding (tunneling). The defaults are applied to new connection profiles and to those connection profiles that do not have their own tunneling settings defined.

Figure A.10. Defining default tunneling settings

Select the Use factory defaults check box to apply the factory defaults for X11 and agent forwarding. According to the factory defaults, X11 forwarding is disabled (off) and agent forwarding is enabled (on).

To allow X11 forwarding on the client side, select the Tunnel X11 connections check box.

To disable agent forwarding on the client side, unselect the Allow Agent Forwarding check box.