SSH Tectia

Chapter 6 Choosing the Authentication Method

Table of Contents

Password Authentication
Advantages and Disadvantages of Password Authentication
Public-Key Authentication
Authentication Procedure
Compatibility with OpenSSH Keys
Advantages and Disadvantages of Public-Key Authentication
Certificate Authentication and PKI
Certificate Enrollment
Certificate Revocation
Authentication Procedure
Advantages and Disadvantages of Certificate Authentication
Making the Most of Public Keys and PKI
Certificates and Keys on Smart Cards
Authentication Agents and Key Providers
Host-Based Authentication
Advantages and Disadvantages of Host-Based Authentication
Keyboard-Interactive Authentication
Advantages and Disadvantages of Keyboard-Interactive Authentication
Password Submethod
PAM Submethod
RSA SecurID Submethod
RADIUS Submethod
GSSAPI Authentication
GSSAPI Interoperability
Advantages of GSSAPI Authentication

This chapter provides an overview of the different user authentication methods available with the SSH Tectia client/server solution, and the differences between them. It is intended for both newcomers to security software, who would like an idea of which authentication method to use, as well as experienced users looking for a quick reference, possibly in preparation for a change in their security policy. This chapter does not detail how to configure the given authentication method. Refer to SSH Tectia Server Administrator Manual, SSH Tectia Server for IBM z/OS Administrator Manual, SSH Tectia Client User Manual, and SSH Tectia Connector Administrator Manual for more information.

Table 6.1. User authentication methods supported by the SSH Tectia client/server solution

Authentication method Server (Unix)Server (Windows)Server (z/OS)Client (Unix)Client/Connector (Windows)Client (z/OS)
Password x x x x x x
Public-key x x x x x x
Certificate x x x x x x
Host-based x x x x   x
Keyboard-interactive x x x x x x
PAM1 x     x x x
RSA SecurID1 x x   x x x
RADIUS1 x x   x x x
GSSAPI/Kerberos x x   x x  

1 Through keyboard-interactive.