Manualshelf

Users Guide

ManualsBrandsDell ManualsAccess PlatformsSmartFabric OS10 Documentation
1361136213631364136513661367136813691370
Table Of Contents
Table 93. Security profile settings used by X.509v3 authentication (continued)
Security profile
setting
Description
include the client authentication purpose. key-usage-check is disabled by default in security profiles, but
Dell Technologies recommend using X509v3 SSH authentication.
ocsp-check If you configure the ocsp-check option in the security profile and the user certificate contains an OCSP
responder URL in the Authority Information Access section, the OS10 SSH server verifies the revocation
status of the user certificate with the OCSP responder in the certificate.
If you configure an OCSP responder URL in the security profile when verifying the revocation status, the
OCSP responder URL is used instead of the OCSP URL in the certificate. In this way, you can configure
the OCSP responder URL that is used as a proxy for the OCSP responder associated with a CA.
peer-name-check When you configure the peer-name-check option, the OS10 SSH server verifies if the certificate
presented by the user is associated with the username for the login attempt. The verification matches
either the common name (CN) value from the distinguished name (DN) field or the user principal name
from the subject alternative name (SAN) field of the certificate with the login username. Alternatively,
if there is a configured user certificate in OS10 for this username, it is matched against the appropriate
field in the user certificate.
The configured user certificate validates user certificates that use different names when compared
with the login name. The peer-name-check option is enabled by default and is not displayed in the
running-configuration unless disabled.
revocation-check If you configure the revocation-check option in the security profile, the OS10 SSH server verifies the
revocation status of the user certificate in the installed or dynamically downloaded certificate revocation
list (CRL) associated with the CA that signed the certificate.
Example: Configure RADIUS over TLS with X.509v3 certificates
This example shows how to install a trusted X.509v3 CA and a host certificate-key pair that supports RADIUS over TLS
authentication.
1. Install a trusted CA certificate.
OS10# copy tftp://CAadmin:secret@172.11.222.1/GeoTrust_Universal_CA.crt home://
GeoTrust_Universal_CA.crt
OS10# crypto ca-cert install home://GeoTrust_Universal_CA.crt
Processing certificate ...
Installed Root CA certificate
CommonName = GeoTrust Universal CA
IssuerName = GeoTrust Universal CA
2. Generate a CSR, copy the CSR to a CA server, download the signed certificate, and install the host certificate.
OS10# crypto cert generate request cert-file home://s4048-001-csr.pem
key-file home://tsr6-key.pem cname "Top of Rack 6" altname "IP:10.0.0.6
DNS:tor6.dell.com"
email admin@dell.com organization "Dell EMC" orgunit Networking locality "santa Clara"
state California country US length 1024
Processing certificate ...
Successfully created CSR file /home/admin/tor6-csr.pem and key
OS10# copy home://tor6-csr.pem scp://CAadmin:secret@172.11.222.1/s4048-001-csr.pem
OS10# copy scp://CAadmin:secret@172.11.222.1/s4048-001.crt usb://s4048-001-crt.pem
OS10# crypto cert install crt-file usb://s4048-001-crt.pem key-file usb://s4048-001-
crt.key
This will replace the already installed host certificate.
Do you want to proceed ? [yes/no(default)]:yes
Processing certificate ...
Host certificate installed successfully.
Security
1367