ssh-externalkeys

Description

This document contains general information about using external keys with Tectia Server for IBM z/OS.

Using External Keys

For applications capable of using external keys, two strings need to be specified: the provider name and the initialization string for the provider. These strings can be given on the command line or in a configuration file, depending on the application. The following section describes the different providers available in more detail.

The provider name and/or the initialization string may be defined in the following configuration attributes and keywords:

In ssh-broker-config.xml:

cert-validation/key-store[@type="provider",init="initstring"]

known-hosts/key-store[@type="provider",init="initstring"]

key-stores/key-store[@type="provider",init="initstring"]

In sshd2_config:

AuthorizationEkProvider="provider:initstring"

HostKeyEkInitString="initstring"

HostKeyEkProvider="provider"

KnownHostsEkProvider="provider:initstring"

In ssh_certd_config:

HostCAEkProvider="provider:initstring"

HostCAEkProviderNoCRLs="provider:initstring"

PkiEkProvider="provider:initstring"

External Key Providers

zos-saf

The zos-saf provider is used for accessing keys stored in the IBM z/OS System Authorization Facility (SAF).

The initialization string for the zos-saf provider specifies the key(s) to be used and it has the following components:

{KEYS([ID(xxx)]RING(xxx) [LABEL(xxx)|DEFAULT])}...

KEYS(..) may repeat. The sub-attributes are:

ID - A SAF user ID signifying the owner of the key ring. If missing, the current user's ID is used.
RING - Key ring name. Mandatory.
LABEL - The SAF key label. If missing, and DEFAULT is missing, use all the keys in the key ring.
DEFAULT - Use the key that is marked as the default key on the key ring. Do not specify together with LABEL.

Values must be written in single quotation marks if they contain single quotation marks or parenthesis.

The initialization string specified with the HostKeyEkInitString keyword of sshd2_config must point to a single private key. If the key ring contains several keys, LABEL must be used to distinguish between the keys.

When using a trusted key provider and the Tectia Certificate Validator, specify KEYS variables that include all the CA certificates needed, for example:

PkiEkProvider="zos-saf"
PkiEkInitString="KEYS(RING(Trusted.CAs) LABEL('Primary CA'))
KEYS(ID(SSHTEST) RING(Internal.CAs))"

The key-store[@init] attribute of ssh-broker-config.xml and the AuthorizationEkProvider keyword of sshd2_config can contain special strings in the key specification that are mapped according the following list:

%U = user name
%IU = user ID
%IG = user group ID
%UU = user name in upper case (AuthorizationEkProvider only)
%UL = user name in lower case (AuthorizationEkProvider only)