Chapter 2: Client Connections
[myLuna] lunash:>sysconf ssh publickey disable
Public key authentication disabled
Command Result : 0 (Success)
[myLuna] lunash:>sysconf ssh show
SSHD configuration:
SSHD Listen Port: 22 (Default)
SSH is unrestricted.
Password authentication is enabled
Public key authentication is disabled
Command Result : 0 (Success)
11.
SSH in again from mypc, and verify that you are password prompted:
[root@mypc /]# ssh admin@myLuna
admin@myLuna's password:
Summary
The above example illustrates enabling and disabling Public-Key Authentication for SSH connections to your
SafeNet appliance.
NOTE
Console (serial port) access still requires the userid and password.
Once you enable public key authentication for an administration computer, the private SSH key (/root/.ssh/id_
rsa) must be protected, and access to that computer must be restricted and password-protected. Anyone who
can log into that computer can log into the SafeNet Luna Network HSM appliance without knowing the LunaSH
admin password!
To further explore/confirm the Public-Key Authentication functions, you could SSH in again from Windows and
other UNIX clients, and verify that you are still password prompted as normal for those clients.
Verify that the client list is always accurate.
Delete one or two of your public key clients. Verify that those clients are password prompted again.
Clear all public key clients with the -clear sub-command. Verify that all clients are password prompted again.
Obviously, most of the above has been an extended example, to show various aspects of the function, and you
do not need to go through all those steps just to set up Public-Key Authentication for a client/admin computer.
Set up Public-Key SSH access for other SafeNet Luna Network HSM users
Here are the high level steps to set up SSH pubkey access for a non admin user:
>
As admin, create the user and assign the desired role to that new user.
>
Log on to SafeNet Luna Network HSM as the new user. You are prompted to change the default password.
>
Transfer (
scp
) the SSH pubkey to the SafeNet appliance using the new user account (example $ scp id_
rsa_pub op-number1@lunasa6:).
>
Log in with the new account.
SafeNet Luna Network HSM 7.3 Appliance Administration Guide
007-013576-005 Rev. A 13 December 2019 Copyright 2001-2019 Thales
37
