The available SSH channel types and their functionalities are described below. For details on configuring channel policies, see Channel policy.
Channel |
Special options |
Description | ||
---|---|---|---|---|
auth-agent |
None |
Agent: Forwards the SSH authentication agent from the client to the server. | ||
x11 |
Yes |
X11 Forward: Forwards the graphical X-server session from the server to the client. List the address of the client in the networks field to permit X11-forwarding only to the specified clients. Specify IP addresses or networks (in IP address/Prefix format). For example: "networks": [ { "selection": "address", "value": "192.168.1.1" }, { "selection": "address", "value": "192.168.1.2" }
| ||
local-forwards | Yes |
Local Forward: Forwards traffic arriving to a local port of the client to a remote host. To enable forwarding only between selected hosts, use the local_forwards field. If the local_forwards field is empty, local forwarding is enabled without restriction, the client may forward any traffic to the remote host. For example: "local_forwards": [ { "host_address": { "selection": "address", "value": "192.168.100.1" }, "host_port": 5555, "originator_address": { "selection": "address", "value": "192.168.1.1" } }
| ||
remote-forwards | Yes |
Remote Forward: Forwards traffic arriving a remote port of the server to the client. To enable forwarding only between selected hosts, enter their IP addresses into the remote_forwards field. If the remote_forwards field is empty, remote forwarding is enabled without restriction, the SSH server may forward any traffic to the client. For example: "remote_forwards": [ { "connected_address": { "selection": "address", "value": "192.168.100.1" }, "connected_port": 5555, "originator_address": { "selection": "address", "value": "192.168.1.1" } }
| ||
session-exec | Yes |
Session Exec: Execute a remote command (for example rsync) without opening a session shell. List the permitted command in the execs field. You can use regular expressions to specify the commands. This field can contain only letters (a-z, A-Z), numbers (0-9), and the following special characters ({}()*?\\|[]).
Channel-specific access control rules:
For example: "execs": [ "top", "ls" | ||
session-exec-scp | Yes |
Session Exec SCP: Transfers files using the Secure Copy (SCP) protocol. Channel-specific actions:
For example: "actions": { "audit": false, "four_eyes": false, "ids": false, "log_transfer_to_db": true, "log_transfer_to_syslog": true } | ||
session-subsystem | Yes |
Session Subsystem: Use a subsystem. Enter the name of the permitted subsystem into the subsystems field. Channel-specific access control rules:
For example: "execs": [ "top", "ls" | ||
session-exec-sftp | Yes |
Session SFTP: Transfers files using the Secure File Transfer Protocol (SFTP). Channel-specific actions:
For example: "actions": { "audit": false, "four_eyes": false, "ids": false, "log_transfer_to_db": true, "log_transfer_to_syslog": true } | ||
session-shell | Yes |
Session Shell: The traditional remote terminal session. Channel-specific actions:
For example: "actions": { "audit": true, "content_policy": { "key": "433849548566ab327522e6" }, "four_eyes": false, "ids": false } |
The connected_address, host_address, network, and originator_address options that you can use in SSH channel policies that allow port-forwarding and X11 forwarding have the following parameters.
Element | Type | Description | |
---|---|---|---|
connected_address, host_address, network, or originator_address | list of JSON objects | Container objects for limiting access to port-forwarding in SSH channel policies. For details, see SSH channels. | |
selection | address or network |
Specifies the type of the address. Possible values: address or network | |
value | IPv4 address or network |
The IP address, or the network in IP-address:prefix format. For example, 192.168.1.1 or 192.168.0.0/16 |
Lists the configured authentication methods that can be used in a connection. Each connection policy uses an authentication policy to determine how the client can authenticate to the target server. Separate authentication methods can be used on the client and the server-side of the connection.
GET https://<IP-address-of-SPS>/api/configuration/ssh/authentication_policies
Cookie name | Description | Required | Values |
---|---|---|---|
session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
The following command lists SSH authentication policies.
curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/ssh/authentication_policies
The following command retrieves the properties of a specific policy.
curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/ssh/authentication_policies<object-id>
The following is a sample response received when listing SSH authentication policies.
For details of the meta object, see Message format.
{ "items": [ { "key": "-200", "meta": { "href": "/api/configuration/ssh/authentication_policies/-200" } }, { "key": "1895203635707e3340262f", "meta": { "href": "/api/configuration/ssh/authentication_policies/1895203635707e3340262f" } } ], "meta": { "first": "/api/configuration/ssh/authentication_policies", "href": "/api/configuration/ssh/authentication_policies", "last": "/api/configuration/ssh/settings_policies", "next": "/api/configuration/ssh/channel_policies", "parent": "/api/configuration/ssh", "previous": null, "transaction": "/api/transaction" } }
When retrieving the endpoint of a specific policy, the response is the following.
{ "body": { "backend": { "selection": "none" }, "gateway_methods": { "kerberos": false, "password": false, "public_key": false }, "relayed_methods": { "kerberos": false, "keyboard_interactive": true, "password": true, "public_key": { "selection": "agent" } } }, "name": "base", "key": "-200", "meta": { "first": "/api/configuration/ssh/authentication_policies/-200", "href": "/api/configuration/ssh/authentication_policies/-200", "last": "/api/configuration/ssh/authentication_policies/1895203635707e3340262f", "next": "/api/configuration/ssh/authentication_policies/1895203635707e3340262f", "parent": "/api/configuration/ssh/authentication_policies", "previous": null, "transaction": "/api/transaction" } }
Elements of authentication policies | Type | Description | ||
---|---|---|---|---|
key | string | Top level element, contains the ID of the policy. | ||
body | Top level element | Contains the elements of the policy. | ||
backend | Top level item | The authentication database used on the client-side. | ||
gateway_methods | Top level item | Client-side gateway authentication settings. The value of selection defines which authentication method is used. | ||
mode | Top level element | Obsolete node. Any settings submitted into this node is ignored. In a response, this node may contain inaccurate data. | ||
name | string | The name of the object. This name is also displayed on the SPS web interface. It cannot contain whitespace. | ||
relayed_methods | Top level element | Server-side authentication settings. |
Elements of backend | Type | Description | ||
---|---|---|---|---|
selection | string |
Defines the authentication method for client-side gateway authentication. Possible values are:
| ||
|
enabled |
|
boolean |
Set it to true to enable public key-based client-side authentication. |
user_database | string |
References the key of the local user database. You can configure local user databases at the /api/configuration/policies/user_databases/ endpoint. To modify or add a local user database, use the value of the returned key as the value of the user_database element, and remove any child elements (including the key). | ||
servers | Top level list |
Defines the properties of the RADIUS servers used for client-side authentication. A valid list item consists of the address, port and shared_secret elements. | ||
address | Top level element | Defines the address of a RADIUS server. | ||
selection | string |
Required child of the address element. Possible values are:
| ||
value | string | The IP or the FQDN address of the RADIUS server. | ||
port | int | The port number of the RADIUS server. | ||
shared_secret | string |
References the key of the shared secret for the RADIUS server. You can configure shared secrets at the /api/configuration/passwords/ endpoint. To modify or add a shared secret, use the value of the returned key as the value of the shared_secret element, and remove any child elements (including the key). Alternatively, you can include the new password as plain text. "shared_secret": { "plain": "<new-password>" } | ||
authentication_protocol | Top level item |
RADIUS setting. Set to pap to use the Password Authentication Protocol. To use the Challenge-Handshake Authentication Protocol, set it to chap. |
Elements of relayed_methods | Type | Description | |
---|---|---|---|
kerberos | boolean |
Authentication based using Kerberos. Set it to true to enable Kerberos-based client-side authentication. If required, you can select other gateway authentication methods in addition to Kerberos, and also authentication backends and related to the selected gateway authentication methods. To use Kerberos authentication on the target server, you must use Kerberos authentication both on the SPS gateway and on the target server (in relayed_methods). | |
keyboard_interactive | boolean |
Authentication based on exchanging messages between the user and the server. This method includes authentication schemes like S/Key or TIS authentication. Depending on the configuration of the SSH server, might have to be used together with password-based authentication. Set to true to enable interactive authentication on the remote server. | |
password | boolean |
Authentication based on username and password. Set to true to enable password-based authentication on the remote server. | |
public_key | Top level item |
Authentication based on public-private encryption keypairs. Use the selection child element to disable or configure authentication using public-private keypairs on the remote server. | |
selection | string |
Configures authenticaton on the remote server using public-private keypairs. The following values are possible:
| |
private_key | string |
References the key of the private key used for authenticating with a public-private keypair on the remote server. You can configure private keys at the /api/configuration/private_keys/ endpoint. To modify or add a private key, use the value of the returned key as the value of the private_key element, and remove any child elements (including the key). |
Password authentication against LDAP on the client side, and using a username and password on the remote server:
{ "backend": { "selection": "ldap" }, "gateway_methods": { "kerberos": false, "password": true, "public_key": false }, "name": "password_ldap", "relayed_methods": { "kerberos": false, "keyboard_interactive": false, "password": true, "public_key": { "selection": "disabled" } } }
Password authentication against a local user database on SPS, and using a username and password on the remote server. You can find the key of the local user database is available at the /api/configuration/policies/user_databases/ endpoint.
{ "backend": { "selection": "local", "user_database": "<key-of-the-local-user-database>" }, "gateway_methods": { "kerberos": false, "password": true, "public_key": true }, "relayed_methods": { "kerberos": false, "keyboard_interactive": false, "password": true, "public_key": { "selection": "disabled" } }, "name": "passwords", }
Authenticating against an RADIUS server on the client side, and using a username and password on the remote server. You can configure the key of the shared secret at the /api/configuration/passwords/ endpoint. The IP of the RADIUS server is used.
{ "backend": { "authentication_protocol": "pap", "selection": "radius", "servers": [ { "address": { "selection": "ip", "value": "192.168.1.1" }, "port": 1812, "shared_secret": <key-of-shared-secret>, } ] } "gateway_methods": { "kerberos": false, "password": true, "public_key": false }, "relayed_methods": { "kerberos": false, "keyboard_interactive": true, "password": true, "public_key": { "selection": "agent" } }, "name": "RADIUS" }
Using Kerberos authentication both on the client side and on the remote server.
{ "backend": { "selection": "none" }, "gateway_methods": { "kerberos": true, "password": false, "public_key": false }, "name": "kerberos_only", "relayed_methods": { "kerberos": true, "keyboard_interactive": false, "password": true, "public_key": { "selection": "disabled" } } }
The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.
Code | Description | Notes |
---|---|---|
201 | Created | The new resource was successfully created. |
400 | InvalidQuery | The requested filter or its value is invalid. |
401 | Unauthenticated | The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved. |
403 | Unauthorized | The requested resource cannot be retrieved because the client is not authorized to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved. |
404 | NotFound | The requested object does not exist. |
To add an SSH authentication policy, you have to:
For details, see Open a transaction.
POST the JSON object to the https://<IP-address-of-SPS>/api/configuration/ssh/authentication_policies/ endpoint. You can find a detailed description of the available parameters listed in Elements of authentication policies . The elements of gateway_methods are listed in Elements of gateway_methods. The elements of relayed_methods are listed in Elements of relayed_methods.
If the POST request is successful, the response includes the key of the new policy. For example:
{ "key": "6f924f39-e4c9-4b0f-8018-8842e2115ebd", "meta": { "href": "/api/configuration/ssh/authentication_policies/6f924f39-e4c9-4b0f-8018-8842e2115ebd", "parent": "/api/configuration/ssh/authentication_policies", "transaction": "/api/transaction" } }
For details, see Commit a transaction.
To modify an SSH authentication policy, you have to:
For details, see Open a transaction.
PUT the modified JSON object to the https://<IP-address-of-SPS>/api/configuration/ssh/authentication_policies/<key-of-the-object> endpoint. You can find a detailed description of the available parameters listed in Elements of authentication policies . The elements of gateway_methods are listed in Elements of gateway_methods. The elements of relayed_methods are listed in Elements of relayed_methods.
For details, see Commit a transaction.
List of options that affect all SSH connections.
GET https://<IP-address-of-SPS>/api/configuration/ssh/options
Cookie name | Description | Required | Values |
---|---|---|---|
session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
The following command lists global SSH options.
curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/ssh/options
The following is a sample response received when listing global SSH options.
For details of the meta object, see Message format.
{ "body": { "audit": { "cleanup": { "channel_database_cleanup_days": 600, "enabled": true }, "timestamping": { "selection": "local", "signing_interval": 30 } }, "gssapi": { "enabled": false }, "service": { "enabled": true, "log_level": 4 } }, "key": "options", "meta": { "first": "/api/configuration/ssh/authentication_policies", "href": "/api/configuration/ssh/options", "last": "/api/configuration/ssh/settings_policies", "next": "/api/configuration/ssh/settings_policies", "parent": "/api/configuration/ssh", "previous": "/api/configuration/ssh/connections", "transaction": "/api/transaction" } }
Element | Type | Description | ||
---|---|---|---|---|
key | Top level item | Contains the ID of the endpoint. | ||
body | Top level item | Contains the elements of the global SSH options. | ||
audit | Top level item | Contains settings for timestamping and cleanup. | ||
service | Top level item | Global setting to enable SSH connections, and specify the logging detail. | ||
enabled | boolean | Set to true to enable SSH connections. | ||
log_level | int | Defines the logging detail of SSH connections. | ||
gssapi | Top level item | Deprecated setting. |
Set SPS as the timestamping server:
{ "audit": { "cleanup": { "enabled": false }, "timestamping": { "selection": "local", "signing_interval": 30 } }, "gssapi": { "enabled": false }, "service": { "enabled": true, "log_level": 4 } }
Enable cleanup, and set it to occur every 10 days:
{ "audit": { "cleanup": { "channel_database_cleanup_days": 10, "enabled": true }, "timestamping": { "selection": "local", "signing_interval": 30 } }, "gssapi": { "enabled": false }, "service": { "enabled": true, "log_level": 4 } }
Change timestamping to a remote server, without specifying a timestamping policy:
{ "audit": { "cleanup": { "channel_database_cleanup_days": 10, "enabled": true }, "timestamping": { "oid": { "enabled": false }, "selection": "remote", "server_url": "<url-of-timestamping-server>", "signing_interval": 30 } }, "gssapi": { "enabled": false }, "service": { "enabled": true, "log_level": 4 } }
Change timestamping to a remote server, and specify the 1.2.3 timestamping policy:
{ "audit": { "cleanup": { "channel_database_cleanup_days": 10, "enabled": true }, "timestamping": { "oid": { "enabled": true, "policy_oid": "1.2.3" }, "selection": "remote", "server_url": "<url-of-timestamping-server>", "signing_interval": 30 } }, "gssapi": { "enabled": false }, "service": { "enabled": true, "log_level": 4 } }
The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.
Code | Description | Notes |
---|---|---|
201 | Created | The new resource was successfully created. |
400 | InvalidQuery | The requested filter or its value is invalid. |
401 | Unauthenticated | The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved. |
403 | Unauthorized | The requested resource cannot be retrieved because the client is not authorized to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved. |
404 | NotFound | The requested object does not exist. |
To modify global SSH settings, you have to:
For details, see Open a transaction.
PUT the modified JSON object to the https://<IP-address-of-SPS>/api/configuration/ssh/options endpoint. You can find a detailed description of the available parameters listed in Element . The elements of the audit item are described in Elements of audit.
For details, see Commit a transaction.
SSH settings policies define protocol-level settings (algorithms, greetings and banners, timeout). You can create multiple policies, and choose the appropriate one for each SSH connection.
GET https://<IP-address-of-SPS>/api/configuration/ssh/settings_policies
Cookie name | Description | Required | Values |
---|---|---|---|
session_id | Contains the authentication token of the user | Required |
The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format). |
The following command lists SSH settings policies.
curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/ssh/settings_policies
The following command retrieves the properties of a specific policy.
curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/ssh/settings_policies/<policy-id>
The following is a sample response received when listing SSH settings policies.
For details of the meta object, see Message format.
{ "items": [ { "key": "-300", "meta": { "href": "/api/configuration/ssh/settings_policies/-300" } }, { "key": "236283841571912b948b88", "meta": { "href": "/api/configuration/ssh/settings_policies/236283841571912b948b88" } } ], "meta": { "first": "/api/configuration/ssh/authentication_policies", "href": "/api/configuration/ssh/settings_policies", "last": "/api/configuration/ssh/settings_policies", "next": null, "parent": "/api/configuration/ssh", "previous": "/api/configuration/ssh/options", "transaction": "/api/transaction" } }
When retrieving the endpoint of a specific policy, the response is the following.
{ "body": { "name": "default", "timeout": 600, "inactivity_timeout": { "enabled": true "value": 13000 }, "preconnect_channel_check": false, "greeting": "", "userauth_banner": "", "software_version": "SSH", "strict_mode": true, "client_side_algorithms": { "kex": ["diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "cipher": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "blowfish-cbc", "cast128-cbc", "aes192-cbc", "aes256-cbc", "3des-cbc", "arcfour"], "mac": ["hmac-sha1", "hmac-md5"], "compression": ["none"] }, "server_side_algorithms": { "kex": ["diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"], "cipher": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "blowfish-cbc", "cast128-cbc", "aes192-cbc", "aes256-cbc", "3des-cbc", "arcfour"], "mac": ["hmac-sha1", "hmac-md5"], "compression": ["none"] } }, "key": "236283841571912b948b88", "meta": { "first": "/api/configuration/ssh/settings_policies/-300", "href": "/api/configuration/ssh/settings_policies/236283841571912b948b88", "last": "/api/configuration/ssh/settings_policies/236283841571912b948b88", "next": null, "parent": "/api/configuration/ssh/settings_policies", "previous": "/api/configuration/ssh/settings_policies/-300", "transaction": "/api/transaction" } }
The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.
Code | Description | Notes |
---|---|---|
201 | Created | The new resource was successfully created. |
400 | InvalidQuery | The requested filter or its value is invalid. |
401 | Unauthenticated | The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved. |
403 | Unauthorized | The requested resource cannot be retrieved because the client is not authorized to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved. |
404 | NotFound | The requested object does not exist. |
To add a settings policy, you have to:
For details, see Open a transaction.
POST the JSON object to the https://<IP-address-of-SPS>/api/configuration/ssh/settings_policies/ endpoint. You can find a detailed description of the available parameters listed in Element .
If the POST request is successful, the response includes the key of the new policy. For example:
{ "key": "59790911-415c-4ed3-a0d2-1164637472ca", "meta": { "href": "/api/configuration/ssh/settings_policies/59790911-415c-4ed3-a0d2-1164637472ca", "parent": "/api/configuration/ssh/settings_policies", "transaction": "/api/transaction" } }
For details, see Commit a transaction.
To modify a settings policy, you have to:
For details, see Open a transaction.
PUT the modified JSON object to the https://<IP-address-of-SPS>/api/configuration/ssh/settings_policies/<key-of-the-object> endpoint. You can find a detailed description of the available parameters listed in Element .
For details, see Commit a transaction.
© ALL RIGHTS RESERVED. Feedback Termini di utilizzo Privacy Cookie Preference Center