Users Guide

● If all SSH login attempts present an X.509v3 certificate, disable the plain password authentication and SSH public key
authentication in the SSH server.
no ip ssh server password-authentication
no ip ssh server pubkey-authentication
● If you enable the key-usage-check in the security profile but the user certificates uses a different name syntax than the user
login names, configure the user certificate details to allow the SSH server to match the user certificate to the account.
username username certificate subject “x509v3-subject-string”
or
username username certificate principal-name user-principal-name-string
or
username username certificate fingerprint fingerprint-value
Configure local user authentication without a password
To support password-less local user authentication using a smart card and password, configure the following:
● Enable password-less X.509v3 authentication in the SSH server.
ip ssh server x509v3-authentication security-profile profile-name password-less
● Leave plain password authentication enabled for users that do not have a configured certificate.
ip ssh server password-authentication
● Leave plain public key authentication enabled if it is required that users can alternatively use SSH public key password-less
authentication.
ip ssh server pubkey-authentication
● Configure the user X.509v3 certificate details to allow the SSH server to match the user certificate to the account.
username username certificate subject “x509v3-subject-string”
or
username username certificate principal-name user-principal-name-string
or
username username certificate fingerprint fingerprint-value
Security profile settings used by X.509v3 authentication
When you log in with an X.509v3 certificate, OS10 validates the certificate before granting access. The options to control the
applied validation are determined by the specific security profile that you configured for X.509v3 SSH authentication.
The following table describes each of the available security profile options, and how they are applied to X.509v3 SSH
authentication.
Table 93. Security profile settings used by X.509v3 authentication
Security profile
setting
Description
certificate At initialization of the session, the SSH protocol exchanges host keys between the SSH server and
client. The keys are used both to authenticate the SSH server and client, and to secure the initial session
setup. OS10 supports both traditional SSH host keys and X.509v3 certificate host keys.
In OS10 SSH, authentication works with or without a PKI host certificate that is associated with
the security profile. If you configure a certificate name in the security profile and the certificate is
installed, the SSH daemon exchanges the X.509v3 certificate with the client during the client/server
authentication. This configuration enables the client to authenticate the server using a PKI certificate
authority.
key-usage-check When you configure the key-usage-check setting in the security profile, the OS10 SSH server validates
the key usage and extended key usage fields in the user certificate. The key usage field must contain
the digital signature purpose. If the extended key usage field is present in the user certificate, it must
1366 Security