Host-Based User Authentication
Host-based authentication uses the public host key of the client machine
to authenticate a user to the remote server daemon (sshd2). This
provides a non-interactive form of authentication, and is best used in
scripts and automated processes, such as cron jobs. Host-based
authentication can be used to automate backups and file transfers, or in
other situations where a user will not be present to input
authentication information.
The nature of any non-interactive login is inherently insecure. Whenever
authentication without user challenge is permitted, some level of risk must
be assumed. If feasible, public-key authentication is preferred. SSH Tectia Server
provides host-based authentication as a form of non-interactive login that
is more secure than the .rhosts method used by the Berkeley 'r'
commands, but it cannot resolve the inherent insecurity of non-interactive
logins.
This means that you should take aggressive measures to ensure that any
client machine set up for host-based authentication is adequately
secured, both by software and hardware, to prevent unauthorized logins
to your server.
Setting up host-based auhtentication requires administrator rights on the
client machine. Both ends of the configuration are explained in this manual.
In the following instructions, Server is the remote host running
SSH Tectia Server to which you are trying to connect to. ServerUser is the
username on Server that you are logging in as. Client is
the host running SSH Tectia client tools. ClientUser is the username on
Client that should be allowed to log in to Server as
ServerUser.
