HP NonStop SSH 544701-014, Reference Manual

Page: 150 / 344

150
•
SSHCOM Command Reference HP NonStop SSH Reference Manual
•
<user>@<REALM>
A fully qualified Kerberos principal name will authorize a specific Kerberos principal to access this user
account
•
*@<REALM>
This pattern will authorize any principal in the given REALM to access this user account
•
*@*
This pattern will authorize any principal in any REALM (i.e. anybody with a valid service ticket) to access this
user account
Note : Specifying a wildcard pattern as principal is useful when delegating authorization to the resource started for this
user (i.e. CI-PROGRAM or SHELL-PROGRAM).
CAUTION : When specifying a wildcard PRINCIPAL, user access should be properly locked down to avoid security
breaches in which per-user authorization is bypassed (e.g. by setting SYSTEM-USER *NONE*).
The Kerberos principal name authenticated and authorized during “gssapi-with-mic” authentication will also be
displayed in the audit log and thus can be used to correlate the Kerberos principal name with the NonStop user name.
To delete a PRINCIPAL from the access control list, use the DELETE PRINCIPAL attribute.
PRIORITY
All user processes (except SFTPSERV processes) started directly by SSH2 will have the configured priority assigned.
Following are the values allowed in this parameter and their meanings:
Value Meaning
1-199 Use the given priority value
-1 Use the same priority as the SSH2 process starting the process.
Note : SFTPSERV processes will be given priority as specified via the SFTP-PRIORITY attribute.
PUBLICKEY
This attribute is used to assign one or more public key(s) to a user. Each public key must be given a <key-name> which
is unique among all public keys assigned to the current user. The key name will also be displayed in the audit log and
thus can be used to determine which public key has been used for logon at a given time.
To add multiple public keys within a single command, the PUBLICKEY attribute can be repeated within a single ADD
USER command. There is no limitation to the number of public keys that can be assigned to a user.
Public keys can be added by either specifying a file containing the public key or by specifying the fingerprint of the
public key.
To specify a file holding the public key, the key word FILE must be used. The <filename> needs to point to a file
holding the public key to be added. For details about the format of the public key file, refer to the chapter entitled "SSH
Protocol Reference".
Instead of providing a public key file, it is possible to only provide the fingerprint of the user's public key. In this case,
the key word FINGERPRINT must be used, followed by the fingerprint of the user's public key, which should be
specified either in MD5 or "bubble-babble" form and enclosed in double-quotes.
Note : Only one of the two key words FILE or FINGERPRINT can be used in a single PUBLICKEY attribute
specification.
RESTRICTION-PROFILE
Specifies the name of a RESTRICTION-PROFILE entity. If configured for a user, then the restrictions defined in the
RESTRICTION-PROFILE record will be applied for all of a user’s incoming and outgoing connections.