SSH and ACME

[Edwin Gersbach_2]

I've got the task to analyze the efford required and the impact of a change from UAF authentication to ACME authentication against our AD domain. With about 100 UAF's on clusters and single systems this seems to make sense.

However, I found a Document somewhere in HP saying:
>> SSH 5.5 ECO1 and prior versions do not
>> support external password authentication.

(http://www11.itrc.hp.com/service/cki/docDisplay.do?docLocale=en&docId=emr_na-c00639632-2)

Now, I cannot find any hint that this has changed for the current versions (VMS V8.3, TCP/IP V5.6-9ECO2). I even think to remember having seen a more recent mentioning of this problem in this forum, but I'm not able to locate it.

Does anyone have some more information about this?

Edwin

[Volker Halle · Accepted solution]

Edwin,

see this entry from about 2 months ago:

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1197550


Converting various TCP/IP Services components (IMAP, POP, PCNFS, XDM, and yes, SSH) to use the $ACM system service for password authentication is on the worklist for a future release


Volker.

[Art Wiens]

Have a look at Process's product:

VMS Authentication Module

http://www.process.com/VMSauth/index.html

From the SPD:

VAM supports the following operating
system versions:
* OpenVMS VAX V7.3
* OpenVMS Alpha V6.2 and higher
* OpenVMS I64 V8.2 and higher

VAM supports the following TCP/IP
stacks and versions:
* MultiNet V4.4 and later
* TCPware V5.6-2 and later
* TCP/IP Services v4.0 (plus ECO v5)
or later

Cheers,
Art

[Edwin Gersbach_2]

Volker,
Many thanks. That's exactly the entry I was after. Somehow I missed it with whatever keywords I was trying.

Art,
I don't see how this can help me if SSH does not use the right hooks.

Edwin

[Richard Whalen]

The combination of Process Software's SSH for VMS and VMS Authentication Module can be used to do external authentication for SSH.

[James T Horn]

So without a third-party solution, you cannot use AD Authentication?

[Paul Nunez]

Regarding James' question:

So without a third-party solution, you cannot use AD Authentication?

HP offers several solutions:

1. Use Advanced Server for OpenVMS to provide NTLM authentication for ExtAuth users. Using Advanced Server for ExtAuth involves no cost - it's absolutely free. But Advanced Server doesn't run on Itanium systems.

However, if an Itanium system is in a cluster with an Alpha running Advanced Server, the Itanium system can send the ExtAuth requests to the Alpha for processing (the necessary IA64 ACME modules are in sys$library: on the Alpha and the command procedure to load the acme modules on the itanium is in sys$startup: on the Alpha; these need to be copied to the Itanium and then the logical name PWRK$ACME_SERVER needs to be defined on the Itanium to the SCSNODE name of the Alpha(s)). See the release notes for Advanced Server v7.3B for more information.

2. Use LDAP. OpenVMS 8.3 (Alpha and Itanium) and later provide the ability (with the right kits installed ;o), to use LDAP for ExtAuth. Authentication can be directed to an Active Directory server or an HP Enterprise Directory server (and possible any of the Linux LDAP adaptations, though I'm not sure that's officially supported yet). See:

http://h71000.www7.hp.com/openvms/security.html#ldap

3. Use Kerberos. See:
http://h71000.www7.hp.com/doc/83final/BA554_90008/ch02s09.html?jumpid=reg_R1002_USEN

[Edwin Gersbach_2]

Paul,

As mentioned by Volker, your second 'solution' does not really work - at least not with the heavily used SSH.

Would be intresting to figure out wether SSH would work with the Advanced Server, but I doubt because it is said not to use the right entry points.

Anyway, I will close this thread. For us there is not enough benefit to go for a costly third party solution.

Edwin

[Edwin Gersbach_2]

As explained above.