Host-based authentication uses the public host key of the client machine to authenticate a user to the remote server daemon (sshd2). This provides a non-interactive form of authentication, and is best used in scripts and automated processes, such as cron jobs. Host-based authentication can be used to automate backups and file transfers, or in other situations where a user will not be present to input authentication information.

The nature of any non-interactive login is inherently insecure. Whenever authentication without user challenge is permitted, some level of risk must be assumed. If feasible, public-key authentication is preferred. Tectia Server for IBM z/OS provides host-based authentication as a form of non-interactive login that is more secure than the .rhosts method used by the Berkeley 'r' commands, but it cannot resolve the inherent insecurity of non-interactive logins.

This means that you should take aggressive measures to ensure that any client machine set up for host-based authentication is adequately secured, both by software and hardware, to prevent unauthorized logins to your server.

Setting up host-based authentication requires administrator rights on the client machine. Both ends of the configuration are explained in this manual.

In the following instructions, Server is the remote host running Tectia Server for IBM z/OS to which you are trying to connect. ServerUser is the user name on Server that you are logging in as. Client is the host running Tectia client tools for z/OS. ClientUser is the user name on Client that should be allowed to log in to Server as ServerUser.