SSH Tectia

SSH Tectia® Server 5.2

Administrator Manual

SSH Communications Security Corp.

This software is protected by international copyright laws. All rights reserved. ssh® and Tectia® are registered trademarks of SSH Communications Security Corp in the United States and in certain other jurisdictions. The SSH and Tectia logos are trademarks of SSH Communications Security Corp and may be registered in certain jurisdictions. All other names and marks are property of their respective owners.

No part of this publication may be reproduced, published, stored in an electronic database, or transmitted, in any form or by any means, electronic, mechanical, recording, or otherwise, for any purpose, without the prior written permission of SSH Communications Security Corp.

THERE IS NO WARRANTY OF ANY KIND FOR THE ACCURACY OR USEFULNESS OF THIS INFORMATION EXCEPT AS REQUIRED BY APPLICABLE LAW OR EXPRESSLY AGREED IN WRITING.

8 June 2007


Table of Contents

1. About This Document
Documentation Conventions
Customer Support
Product information
Component Terminology
2. Installing SSH Tectia Server
Planning the Installation
System Requirements
Packaging
Licensing
Upgrading from Version 4.x to 5.x
Upgrading from Version 5.x
Installing the SSH Tectia Server Software
Installing on AIX
Installing on HP-UX
Installing on Linux
Installing on Solaris
Installing on Windows
Removing the SSH Tectia Server Software
Removing from AIX
Removing from HP-UX
Removing from Linux
Removing from Solaris
Removing from Windows
3. Getting Started
Location of SSH Tectia Server Files
File Locations on Unix
File Locations on Windows
Starting and Stopping the Server
Starting and Stopping on Unix
Starting and Stopping on Windows
Examples of Use
4. Configuring SSH Tectia Server
ssh-server-config - SSH Tectia Server configuration file format
Configuration Tool (Windows)
SSH Tectia Server
General
Proxy Rules
Identity
Network
Logging
Certificate Validation
Defining Access Rules Using Selectors (Advanced Mode)
Connections and Encryption
Authentication
Services
5. Authentication
Server Authentication with Public Keys
Generating the Host Key
Notifying the Users of the Host Key Change
Server Authentication with Certificates
Certificate Enrollment Using ssh-cmpclient-g3
Server Authentication using External Host Keys
User Authentication with Passwords
Special Considerations on Windows
User Authentication with Public Keys
Using the Authorization File
Using Keys Generated with OpenSSH
Special Considerations on Windows
User Authentication with Certificates
Certificate Configuration
Host-Based User Authentication
Using Traditional Public Keys
Using Certificates
User Authentication with Keyboard-Interactive
Password Submethod
Pluggable Authentication Module (PAM) Submethod
RSA SecurID Submethod
RADIUS Submethod
User Authentication with GSSAPI
Special Considerations on Microsoft Windows Server 2003
Configuring User Authentication Chains
Basic Example
Example with Selectors
Authentication Chain Example
Example of Using the Deny Action
6. System Administration
SSH Tectia Client Privileged User
Disabling Root Login (Unix)
Restricting Connections
Chrooting (Unix)
Forced Commands
Auditing
Notification
Customizing Logging
7. File Transfer
SSH Tectia Client File Transfer User
Encryption and Authentication Methods
Restricting Services
Settings on the Client Side
Automated File Transfer Script
8. Tunneling
SSH Tectia Connector Tunneling User
Using a Shared Account
Restricting Services
Local Tunnels
Local Tunneling Rule Examples
Remote Tunnels
Remote Tunneling Rule Examples
X11 Forwarding (Unix)
Agent Forwarding (Unix)
9. Troubleshooting SSH Tectia Server
Starting SSH Tectia Server in Debug Mode on Unix
Starting SSH Tectia Server in Debug Mode on Windows
CPU Overload on SSH Tectia Server on HP-UX
Authentication Fails for Domain Account on SSH Tectia Server on Windows
A. Command-Line Tools
ssh-server-g3 - Secure Shell server - Generation 3
ssh-server-config-tool - SSH Tectia Server configuration tool
ssh-keygen-g3 - authentication key pair generator
ssh-certview-g3 - certificate viewer
ssh-cmpclient-g3 - CMP enrollment client
ssh-ekview-g3 - external key viewer
B. Server Configuration File Syntax
C. Man Pages and Help Files
D. Audit Messages
Index