Host-Based User Authentication

Using Conventional Public Keys
Using Certificates

Host-based authentication uses the public key of the client machine to authenticate a user to the remote server. Host-based authentication can be used with Tectia Client on Unix. The Tectia Server can be either an Unix or Windows server. Usually also Tectia Server is installed on the client machine.

Host-based authentication provides a non-interactive form of authentication, and is best used in scripts and automated processes, such as cron jobs. Host-based authentication can be used to automate backups and file transfers, or in other situations where a user will not be present to input authentication information.

Caution

	Caution
The nature of any non-interactive login is inherently unsecured. Whenever authentication without user challenge is permitted, some level of risk must be assumed. If feasible, public-key authentication is preferred. Tectia Server provides host-based authentication as a form of non-interactive login that is more secure than the `.rhosts` method used by the Berkeley 'r' commands, but it cannot resolve the inherent lack of security of non-interactive logins.

The nature of any non-interactive login is inherently unsecured. Whenever authentication without user challenge is permitted, some level of risk must be assumed. If feasible, public-key authentication is preferred. Tectia Server provides host-based authentication as a form of non-interactive login that is more secure than the .rhosts method used by the Berkeley 'r' commands, but it cannot resolve the inherent lack of security of non-interactive logins.

This means that you should take aggressive measures to ensure that any client machine set up for host-based authentication is adequately secured, both by software and hardware, to prevent unauthorized logins to the server.

Host-based authentication can be enabled either by using conventional public keys or by using certificates.

	Note
	When FIPS mode is enabled in the Server configuration (for more information, see crypto-lib), host-based authentication only works if the file `libcrypto.*` (the file extension varies between platforms) resides in `/opt/tectia/lib/shlib/`.

	Note
	On AIX, for host-based authentication to work in FIPS mode, you must do the following on the client machine: copy the `libcrypto.a` file (or a symlink to it) to `/usr/lib/` or `/lib/`. This is required because on AIX, when a binary has the `setuid` (set user ID upon execution) access right flag, the linker is able to load libraries only from these two directories.

In the following instructions, Server is the remote host running Tectia Server to which you are trying to connect. ServerUser is the user name on Server that you are logging in as. Client is the host running Tectia Client. ClientUser is the user name on Client that should be allowed to log in to Server as ServerUser. With Tectia Client, ClientUser and ServerUser must be the same user names.