Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Next »

Prior to configuring an SCP agent, it is important to note that the following prerequisites and preparations need to be done. 

Attributes

The SCP collection agent and the SCP forwarding agent share a number of common attributes. They are both supported by a number of algorithms:

3des-cbc, 3des-ctr, blowfish-cbc, aes128-cbc, aes192-cbc, aes256-cbc, aes128-ctr, aes192-ctr, aes256-ctr, arcfour, arcfour128, arcfour256.

Authentication

The SCP agents support authentication through either username/password or private key. Private keys can optionally be protected by a Key password. Most commonly used private key files, can be imported into MediationZone.

Typical command line syntax (most systems):

ssh-keygen -t <keyType> -f <directoryPath>



Setting

Description

keyType

The type of key to be generated. Both RSA and DSA key types are supported.

directoryPath

Where to save the generated keys.


Example

The private key may be created using the following command line:

 > ssh-keygen -t rsa -f /tmp/keystore
    Enter passphrase: xxxxxx
    Enter same passphrase again: xxxxxx


Then the following is stated:

Your identification key has been saved in /tmp/keystore
    Your public key has been saved in /tmp/keystore.pub

When the keys are created the private key may be imported to the SCP agent:

Finally, on the SCP server host, append /tmp/keystore.pub to $HOME/.ssh/authorized_keys. If the $HOME/.ssh/authorized_keys is not there it must be created.

SCP Agents Server Identification

The SCP agent uses a file with known host keys to validate the server identity during connection setup. The location and naming of this file is managed through the property:

mz.ssh.known_hosts_file

It is set in the <pico name>.conf file of the relevant EC to manage where the file is saved. The default value is ${mz.home}/etc/ssh/known_hosts.

The SSH implementation uses JCE (Java Cryptography Extension), which means that there may be limitations on key sizes for your Java distribution. This is usually not a problem. However, there may be some cases where the unlimited strength cryptography policy is needed. For instance, if the host RSA keys are larger than 2048 bits (depending on the SSH server configuration). This may require that you update the Java Platform that runs the EC.

For unlimited strength cryptography on the Oracle JRE, download the JCE Unlimited Strength Jurisdiction Policy Files from http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html. Replace the jar files in $JAVA_HOME/jre/lib/security with the files in this package.

The OpenJDK JRE does not require special handling of the JCE policy files for unlimited-strength cryptography. 

SCP Agents Server Keys

The SSH protocol uses host verification to guard against attacks where an attacker manages to reroute the TCP connection from the correct server to another machine. Since the password is sent directly over the encrypted connection, it is critical for security that an incorrect public key is not accepted by the client.

The agent uses a file with known hosts and keys. It will accept the key supplied by the server if either of the following is fulfilled:

  1. The host is previously unknown. In this case, the public key will be registered in the file.

  2. The host is known and the public key matches the old data.

  3. The host is known however to have a new key and the user has configured it to accept the new key. For further information, see the description of the Advanced tab.

If the host key changes for some reason, the file will have to be removed (or edited) in order for the new key to be accepted.




  • No labels