OpenSSH New authentication method: New features in IBM-supported OpenSSH

Introduction: This article discusses some of the authentication methods supported by OpenSSH. OpenSSH is a free tool for implementing SSH1 and SSH2 protocols. In this article you will learn about the configuration of some authentication methods in OpenSSH and the features that are new in the OpenSSH version supported by IBM®.

Brief introduction

OpenSSH is a free tool for implementing SSH1 and SSH2 protocols. It is a safe and reliable tool that is often used to replace R-commands. Communication through an SSH session is encrypted, and it encrypts all traffic, including passwords.

This article describes how to configure host-based and PAM authentication methods, as well as some of the features and configuration options that are added to the IBM-supported OpenSSH version. The IBM-supported OpenSSH version of the download chain receives reference materials.

To install OpenSSH, you must first install OpenSSL. You can now get OpenSSL for INSTALLP image format, see Resources for download information.

host-based Authentication in SSH

Use host-based authentication in SSH when a user on a trusted host wants to log on to a remote computer (which can be an untrusted system). This method does not require a password. By using the following configuration settings, users on a trusted host can log on to the remote computer without providing a password.

The following configuration options are enabled on the client and server side.

In the/etc/ssh/ssh_config file on the client computer, make the following modifications:

Hostbasedauthentication Yes
enablesshkeysign Yes

In the server-side/etc/ssh/sshd_config file, make the following modifications:

Hostbasedauthentication Yes
ignorerhosts No

Perform one of the following actions:

If you are logged on as the root user on the server, enter the host in the/.rhosts or/.shosts file.

If you are logged on to the server as a non-root user, enter the host in the/etc/hosts.equiv file.

The format of the item is as follows:

<client host name or IP address > <client username>