Tutorial - Using Host-Based Authentication for an SFTP Server

In this tutorial, you will:

Configure a local SFTP server to allow host-based authentication for certain accounts.
Check that the server is refusing to serve connections for an invalid combination of accounts and keys.
Check that a connection can be performed with the UDMG partner client as explained in the Tutorial - Using Host-Based Authentication for an SFTP Partner.

This authentication method can be described as

Host-based authentication uses a server host's (HostA) host key—the key typically used by clients to verify the server’s identity—to authenticate that server (HostA) to another server (HostB) and to vouch for the identity of the user (User1) on the client side server (HostA). A configuration file (.shosts) can be used with any user account on the destination server (HostB) to specify which users on which hosts can log into that account without further authentication.

Note

Due to the nature of the UDMG as an MFT solution, the handling of the host-based authentication for SFTP is limited to having the same account name on the server (local account) and client-side (remote user). It is assumed that an SFTP client acting as User1 on the client node will attempt to login to the same User1 account on the SFTP server.

To configure host-based authentication for an SFTP server, several configuration parameters are set to mimic the behavior of the ssh_known_hosts and .shosts files in a traditional SSH environment, where the public keys and the authorized users for a given client host are configured.

Step 1	From the UDMG Admin UI navigation pane, select Local Servers Service. The Server list displays.
Step 2	Select the stonebranch-sftp-01 server and note the address 0.0.0.0 and port 4100 on the Server tab. This local server is configured in the Tutorial - Creating and Manually Starting an SFTP Server.
Step 3	Click the Accounts tab. Click the Pencil icon () to add an account to the server using the arrows. If the account does not exist, go to the Share Accounts Service via the UDMG Admin UI navigation pane. Add a new Shared Account. In the Account Name field, enter stonebranch-01-client-user. Leave the Password field, empty.
Step 4	In the Server tab, click on the Add icon () next to the Host-based authentication label. A Client Details window appears: Enter the relevant information in the pop-up window and click Confirm button.
Step 5	In Client Hostname field, input a comma-separated list of the hostnames or IP addresses that are allowed to authenticate using this public key. The hostname is matched without considering the port, so there is no need to specify the incoming port (e.g.: `hostA.example.com` should be used instead of `[hostA.example.com]:2222` for a server running on port 2222). For the tutorial, type 0.0.0.0 The hostname (or IP) is provided by the client during the authentication phase, it may not be the same as the DNS name or IP address that is seen by the UDMG server. Make sure to have the correct value from the remote partner. In Key Algorithm field, the key type or the algorithm that was used to generate the public key: ssh-rsa. The allowed types are ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, rsa-sha2-512, rsa-sha2-256, ssh-rsa, ssh-dss, ssh-ed25519. In Public Key field, paste the client public key: from the file stonebranch-client-01.crt.pub, only the key value without the comment and the algorithm label. In Account field, select a server local account for which the host-based authentication will be enabled for connection from this client: stonebranch-01-client-user. In the Remote Users field, input the name of the remote user which is allowed to connect to this local account: stonebranch-01-client-user. It must be the same name as the local account. Additional mappings of local accounts and remote users can be added with the Plus icon ().
Step 6	Click Confirm button to close the Client Details window.
Step 7	Restart the server with the Restart icon (). The local SFTP server is restarted with the new configuration and the restricted list of encryption algorithms.
Step 8	Verify that the server accepts host-based authentication attempts: `$ sftp -v \` `-o "PubkeyAuthentication=no" -o "PasswordAuthentication=no" \` `-o"HostbasedAuthentication=yes" -o "HostbasedKeyTypes=ssh-rsa" \` `-P 4100 stonebranch-01@0.0.0.0 2>&1 \|grep hostbased` `debug1: Authentications that can continue: password,publickey,hostbased` `debug1: Next authentication method: hostbased` `debug1: userauth_hostbased: trying hostkey ssh-rsa SHA256:CYzKciuXNJBKSolgD6F/fQZOXDd6tObHz/d1x4E0OgA` `debug1: Authentications that can continue: password,publickey,hostbased` `debug1: No more client hostkeys for hostbased authentication.` `Permission denied (password,publickey,hostbased).`
Step 9	To verify the connection to the local UDMG server, either configure your favorite SFTP client with the client key and the parameters that are defined on the server in Step 5 or follow the tutorial “Tutorial - Using Host-Based Authentication for an SFTP Partner” on how to set up a UDMG remote partner with host-based authentication and perform sample file transfer between the UDMG server and partner.

References: