HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

Table 4-2 Software Components of HP-UX Secure Shell (continued)
Equivalent
non-secure
component(s)
LocationDescriptionComponent
Not applicableClientTool for making key pairs of the client known
to ssh-agent
ssh-add
Not applicableClientTool for generating key pairs for public key
authentication
ssh-keygen
Not applicableClientTool for a client to gather the public keys for
a set of hosts running the Secure Shell
daemon (sshd)
ssh-keyscan
Not applicableClientTools to generate the digital signature
required during host based authentication is
and it is used by ssh() to access the local host
keys host based authentication
ssh-keysign
4.6.3 Running HP-UX Secure Shell
Before running any of the Secure Shell clients listed in Table 4-2, first start the Secure
Shell server daemon, sshd. The sshd daemon obtains its initial configuration values
from the sshd_config file, located in the /opt/ssh/etc directory on the server
system. One of the most important configuration directives in sshd_config is the set
of authentication methods supported by the sshd daemon. See Section 4.6.5 for more
information.
4.6.3.1 Running the ssh Client
The ssh client application establishes a socket connection with the sshd server. The
sshd server spawns a child sshd process. This child inherits the connection socket
and authenticates the client based on the selected authentication method. A successful
secure client session is established only upon successful authentication.
After a session is created, all subsequent communication occurs directly between the
client and this child sshd process. The client can now execute remote commands on
the server. Each command request from the ssh client causes the child sshd process
to spawn a shell process to execute that command.
In summary, a running ssh client-server session consists of the following processes:
• On every client system connected to the sshd server, there is one ssh client process
for each ssh connection currently established from that client system.
• On the server system, there is one parent sshd process and as many child sshd
processes as there are concurrent ssh clients connected to the server. The number
78 Remote Access Security Administration