HP NonStop SSH 544701-014 User Manual (English)

To Next Page

To Previous Page

HP NonStop SSH Reference Manual SSH and SFTP Client Reference • 199

Specify the user to log in as on the remote machine. This option has the same effect as the –l command line

option or the user runtime parameter.

• AllowedAuthentications=methods

Specify the authentication methods that are allowed for user authentication. The value is a comma separated list

of method names (without any spaces). See SSH2 parameter CLIENTALLOWEDAUTHENTICATIONS for

the possibility to restrict the ssh clients' authentication methods.

-S process

Connect using a specific SSH2 process. See section "Configuring the SSH2 Process to Use" for further details.

Runtime options relevant only when creating a shell

-t

Force pseudo-tty allocation. This can be used to execute arbitrary screen-based programs on a remote machine.

-T

Do not allocate a tty.

-s

Use this option to request invocation of a subsystem on the remote system. Subsystems are a feature of the SSH2

protocol which facilitate the use of SSH as a secure transport for other applications (e.g. sftp). The subsystem is specified

as the remote command.

Runtime options relevant only for port forwarding

-L [ftp/]listen-port:host:port

Specifies that the given listen-port on the local (client) host is to be forwarded to the given host and port on the remote

side. This works by allocating a socket to listen to listen-port on the local side. Whenever a connection is made to this

port, the connection is forwarded over the secure channel, and a connection is made to host and port from the remote

machine.

Specifying the ftp/ prefix will enable dynamic port forwarding of FTP sessions, forwarding both FTP control and data

connections over the SSH session.

The –g (gateway) option controls weather all connections or only those originating from “localhost” will be forwarded.

-R [ftp/]listen-port:host:port

Specifies that the given listen-port on the remote (daemon) host is to be forwarded to the given host and port on the local

side. This works by allocating a socket to listen to listen-port on the remote side. Whenever a connection is made to this

port, the connection is forwarded over the secure channel, and a connection is made to host and port from the local

machine.

Specifying the ftp/ prefix will enable dynamic port forwarding of FTP sessions, forwarding both FTP control and data

connections over the SSH session.

The –g (gateway) option controls weather all connections or only those originating from “localhost” will be forwarded.

-N

Do not execute a shell or command. This is useful for just forwarding ports.

-g

Allows remote hosts to connect to local forwarded ports. By default, only connections originating from "localhost"

(127.0.0.1) will be forwarded. Using –g will forward any connection.

Product Name	HP NonStop SSH
Part Number	544701-014
Category	Software
Type	Secure Shell (SSH) Server
Platform	HP NonStop
Functionality	Secure remote access, file transfer
Protocol Support	SSHv2
Encryption	AES, 3DES, Blowfish, and others
Authentication Methods	Public Key, password

HP NonStop SSH 544701-014 User Manual

Table of Contents

HP NonStop SSH 544701-014 Specifications

Summary

Components of the SSH2 Software Package

Architecture Overview

SSH2 Running as SSH Daemon (Server)

SSH2 Running as SSH Client

Installation & Quick Start

System Requirements

Installation on the NonStop Server

Installing the SSH Components on the NonStop System

Unlocking the Product with a License File

Updating to a new version of the SSH2 file set

Installation of the new version

Quick Start and Guided Tour

Quick-Starting the SSH2 System

To start the STN Pseudo Terminal Server

To Start the SSH2 Component

Secure Shell Access to the NonStop Server

To Open an OSS Shell Using a Remote SSH Client

Secure Shell Access from NonStop to Remote Systems

To Connect to a Remote SSH Daemon with the NonStop SSH Client

To Establish a Port Forwarding Tunnel with the NonStop SSH Client

Forwarding Local Port to Remote Port

Forwarding Remote Port to Local Port

Encrypted File Transfer

To Connect a Remote SFTP Client to the NonStop Server

To Configure the Public Key on the Remote System

Using Public Keys to Authenticate Remote Users

To Generate a Key Pair on an OpenSSH System

To Add the Public Key to the NonStop SSH2 User Database

Using Public Keys to Logon to Remote Systems

To Generate a Key Pair for a NonStop User

To Export the Public Key and Configure it on the Remote System

Configuring and Running SSH2

Configuration Overview

The Configuration File

PARAM Commands

Startup Line Parameters

Starting SSH2

SSH2 Parameter Reference

Parameter Overview

BACKUPCPU

CIPHERS

CONFIG

CUSTOMER

FULLSSHCOMACCESSGROUP<j>

FULLSSHCOMACCESSUSER<i>

GSSAUTH

HOSTKEY

INTERFACE

INTERFACEOUT

IPMODE

LIFECYCLEPOLICYPRIVATEUSERKEY

LIFECYCLEPOLICYPUBLICUSERKEY

PARTIALSSHCOMACCESSGROUP<n>

PARTIALSSHCOMACCESSUSER<k>

PORT

PTYSERVER

SSHCTL

STRICTHOSTKEYCHECKING

SUBNET

Enabling Full TTY Access

To Start the STN Pseudo Terminal Server Included with SSH2

Enabling 6530 Terminal Access

Configuring an Alternate Command Interpreter

Configuring a Service Menu

Configuring an STN Service or Window

Forcing TACL Access via Server-side Configuration

Using TELSERV as Service Provider

Granting Access without SSH Authentication

Single Sign-on with GSSAPI Authentication

Overview

Prerequisites

Configuration of the GSSAPI Interface Process

Enabling GSSAPI Authentication for a User Account

Authorizing Kerberos Principals for Logon

Explicit Authorization

Restricting Incoming and Outgoing Connections