List of options that affect all SSH connections.
URL
GET https://<IP-address-of-SPS>/api/configuration/ssh/options
Sample request
The following command lists global SSH options.
curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/ssh/options
Response
The following is a sample response received when listing global SSH options.
{
"body": {
"channel_database_cleanup": {
"enabled": false
},
"service": {
"enabled": false
},
"gssapi": {
"enabled": false
}
}
"key": "options",
"meta": {
"first": "/api/configuration/ssh/authentication_policies",
"href": "/api/configuration/ssh/options",
"last": "/api/configuration/ssh/settings_policies",
"next": "/api/configuration/ssh/settings_policies",
"parent": "/api/configuration/ssh",
"previous": "/api/configuration/ssh/connections",
"transaction": "/api/transaction"
}
}
| key |
|
Top level item |
Contains the ID of the endpoint. |
| body |
|
Top level item |
Contains the elements of the global SSH options. |
| |
channel_database_cleanup |
Top level item |
Contains settings for database cleanup. |
| |
service |
Top level item |
Global setting to enable SSH connections, and specify the logging detail. |
|
|
gssapi |
Top level item |
Global option to configure Kerberos authentication with SPS.
For more information about Kerberos authentication with SPS, see Kerberos authentication settings in the SPSAdministration Guide. |
| days |
integer |
Applies only if enabled is set to true.
Global retention time for the metadata of SSH connections, in days. Must exceed the retention time of the archiving policy (or policies) used for SSH connections, and the connection-specific database cleanup times (if configured). |
|
enabled |
boolean |
To enable the global cleanup of SSH connection metadata, set enabled to true. |
| log_level |
integer |
Applies only if enabled is set to true.
Defines the logging detail of SSH connections. |
|
enabled |
boolean |
To enable SSH connections, set to true. |
|
enabled |
|
boolean |
To enable mapping hostnames to Kerberos realms, set to true.
NOTE: Enabling this option is only required if you have more than one realms deployed on your network. |
| domain_realm_mapping |
|
list of JSON objects |
When you have more than one realms deployed on your network, and enabled is set to true, the list of JSON objects in domain_realm_mapping specify the mapping between the servers' DNS domain names and the names of their respective connected Kerberos realms. |
|
|
domain |
string |
The name of your DNS domain. |
|
|
realm |
string |
The name of your Kerberos realm. |
Examples
Querying the full list of global SSH options:
{
"body": {
"channel_database_cleanup": {
"enabled": true,
"days": 365
},
"service": {
"enabled": true,
"log_level": 4
},
"gssapi": {
"enabled": true,
"domain_realm_mapping": [
{
"domain": "server.example.com",
"realm": "SERVER.EXAMPLE.COM"
},
{
"domain": ".example.com",
"realm": "EXAMPLE.COM"
}
]
}
"key": "options",
"meta": {
"first": "/api/configuration/ssh/authentication_policies",
"href": "/api/configuration/ssh/options",
"last": "/api/configuration/ssh/settings_policies",
"next": "/api/configuration/ssh/settings_policies",
"parent": "/api/configuration/ssh",
"previous": "/api/configuration/ssh/connections",
"transaction": "/api/transaction"
}
}
| 201 |
Created |
The new resource was successfully created. |
| 400 |
InvalidQuery |
The requested filter or its value is invalid. |
| 401 |
Unauthenticated |
The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that the SPS REST API attempted to access, but could not retrieve. |
| 403 |
Unauthorized |
The requested resource cannot be retrieved because the client is not authorized to access it. The details section contains the path that the SPS REST API attempted to access, but could not retrieve. |
| 404 |
NotFound |
The requested object does not exist. |
Modify global SSH settings
To modify global SSH settings, you have to:
-
Modify the JSON object of the global SSH settings endpoint.
PUT the modified JSON object to the https://<IP-address-of-SPS>/api/configuration/ssh/options endpoint.
You can find a detailed description of the available parameters listed in Element.
For more information about the elements of the channel_database_cleanup item, see Elements of channel_database_cleanup.
For more information about the elements of the service item, see Elements of service.
For more information about the elements of the gssapi item, see Elements of gssapi.
SSH settings policies define protocol-level settings (algorithms, greetings and banners, timeout). You can create multiple policies, and choose the appropriate one for each SSH connection.
URL
GET https://<IP-address-of-SPS>/api/configuration/ssh/settings_policies
Sample request
The following command lists SSH settings policies.
curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/ssh/settings_policies
The following command retrieves the properties of a specific policy.
curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/ssh/settings_policies/<policy-id>
Response
The following is a sample response received when listing SSH settings policies.
{
"items": [
{
"key": "-300",
"meta": {
"href": "/api/configuration/ssh/settings_policies/-300"
}
},
{
"key": "236283841571912b948b88",
"meta": {
"href": "/api/configuration/ssh/settings_policies/236283841571912b948b88"
}
}
],
"meta": {
"first": "/api/configuration/ssh/authentication_policies",
"href": "/api/configuration/ssh/settings_policies",
"last": "/api/configuration/ssh/settings_policies",
"next": null,
"parent": "/api/configuration/ssh",
"previous": "/api/configuration/ssh/options",
"transaction": "/api/transaction"
}
}
When retrieving the endpoint of a specific policy, the response is the following.
{
"body": {
"name": "default",
"timeout": 600,
"inactivity_timeout": {
"enabled": true
"value": 13000
},
"preconnect_channel_check": false,
"greeting": "",
"userauth_banner": "",
"software_version": "SSH",
"strict_mode": true,
"client_side_algorithms": {
"kex": ["diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"],
"cipher": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "blowfish-cbc", "cast128-cbc", "aes192-cbc", "aes256-cbc", "3des-cbc", "arcfour"],
"mac": ["hmac-sha1", "hmac-md5"],
"compression": ["none"]
},
"server_side_algorithms": {
"kex": ["diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1"],
"cipher": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "blowfish-cbc", "cast128-cbc", "aes192-cbc", "aes256-cbc", "3des-cbc", "arcfour"],
"mac": ["hmac-sha1", "hmac-md5"],
"compression": ["none"]
}
},
"key": "236283841571912b948b88",
"meta": {
"first": "/api/configuration/ssh/settings_policies/-300",
"href": "/api/configuration/ssh/settings_policies/236283841571912b948b88",
"last": "/api/configuration/ssh/settings_policies/236283841571912b948b88",
"next": null,
"parent": "/api/configuration/ssh/settings_policies",
"previous": "/api/configuration/ssh/settings_policies/-300",
"transaction": "/api/transaction"
}
}
| key |
|
|
string |
Top level element, contains the ID of the policy. |
| body |
|
|
Top level element (string) |
The elements of the SSH settings policy. |
|
client_side_algorithms |
|
Top level element (list) |
Lists the permitted client-side encryption parameters. |
|
|
cipher |
list |
Lists the permitted client-side cipher algorithms. |
|
|
compression |
list |
Lists the permitted client-side compression algorithms. |
|
|
kex |
list |
Lists the permitted client-side KEX algorithms. |
|
|
mac |
list |
Lists the permitted client-side MAC algorithms. |
|
greeting |
|
string |
Greeting message for the connection. |
|
name |
|
string |
Name of the SSH settings policy. |
|
preconnect_channel_check |
|
boolean |
Before establishing the server-side connection, SPS can evaluate the connection and channel policies to determine if the connection might be permitted at all. The server-side connection is established only if the evaluated policies permit the client to access the server.
To enable this function, set the parameter to true. |
|
server_side_algorithms |
|
Top level element (list) |
Lists the permitted server-side encryption parameters. |
|
|
cipher |
list |
Lists the permitted server-side cipher algorithms. |
|
|
compression |
list |
Lists the permitted server-side compression algorithms. |
|
|
kex |
list |
Lists the permitted server-side KEX algorithms. |
|
|
mac |
list |
Lists the permitted server-side MAC algorithms. |
|
software_version |
|
string |
Specifies additional text to append to the SSH protocol banner sent by the server upon connection. |
|
strict_mode |
|
boolean |
When this option is enabled, SPS rejects connections that use unrealistic parameters (for example, terminals of thousand by thousand characters) and port-forwarding connections where the address in the port-forwarding request and the channel-opening request does not match. Note that this can interfere with certain client or server applications.
Strict mode is allowed by default. To turn it off, set the parameter to false. |
|
timeout |
|
int |
Connection timeout, in seconds. |
|
inactivity_timeout |
|
Top level element |
|
|
|
enabled |
boolean |
- true: If no user activity is detected, it terminates the session after the configured time has passed since the last user activity.
- false: No user inactivity timeout.
|
|
|
value |
int |
Only if enabled is true
The value of user activity timeout. Must be greater than or equal to the value of timeout |
|
userauth_banner |
|
string |
You can display a banner message to the clients before authentication (as specified in RFC 4252 — The Secure Shell (SSH) Authentication Protocol). You can use this banner to inform the users that the connection is audited. |
| 201 |
Created |
The new resource was successfully created. |
| 400 |
InvalidQuery |
The requested filter or its value is invalid. |
| 401 |
Unauthenticated |
The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved. |
| 403 |
Unauthorized |
The requested resource cannot be retrieved because the client is not authorized to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved. |
| 404 |
NotFound |
The requested object does not exist. |
Add SSH settings policies
To add a settings policy, you have to:
-
Create the JSON object for the new policy.
POST the JSON object to the https://<IP-address-of-SPS>/api/configuration/ssh/settings_policies/ endpoint. You can find a detailed description of the available parameters listed in Element .
If the POST request is successful, the response includes the key of the new policy. For example:
{
"key": "59790911-415c-4ed3-a0d2-1164637472ca",
"meta": {
"href": "/api/configuration/ssh/settings_policies/59790911-415c-4ed3-a0d2-1164637472ca",
"parent": "/api/configuration/ssh/settings_policies",
"transaction": "/api/transaction"
}
}
Modify SSH settings policies
To modify a settings policy, you have to:
-
Modify the JSON object of the policy.
PUT the modified JSON object to the https://<IP-address-of-SPS>/api/configuration/ssh/settings_policies/<key-of-the-object> endpoint. You can find a detailed description of the available parameters listed in Element .
SPS stores the host keys and X.509 certificates of the trusted servers. When a client tries to connect to a server, SPS verifies the host key or the certificate of the server, and allows connections only to the servers that have their keys available on SPS (unless the SSH Connection Policy is configured differently).
URL
GET https://<IP-address-of-SPS>/api/ssh-host-keys
Sample request
The following command lists the SSH host keys and certificates of the servers that the users can connect to using SSH.
curl --cookie cookies https://<IP-address-of-SPS>/api/ssh-host-keys/
The following command retrieves the properties of a specific key.
curl --cookie cookies https://<IP-address-of-SPS>/api/ssh-host-keys/<object-id>
Response
The following is a sample response received when listing SSH host keys and certificates from the https:<IP-address-of-SPS>/api/ssh-host-keys/ endpoint.
The key of these objects is in the following format: <type-of-the-key>-<host-address>:<host-port>.
{
"meta": {
"href": "/api/ssh-host-keys",
"parent": "/api"
},
"items": [
{
"key": "ssh-dss-10.110.0.1:22",
"meta": {"href": "/api/ssh-host-keys/ssh-dss-10.110.0.1:22"}
},
{
"key": "ssh-dss-10.110.0.2:2222",
"meta": {"href": "/api/ssh-host-keys/ssh-dss-10.110.0.2:2222"}
},
{
"key": "ssh-rsa-10.110.0.1:22",
"meta": {"href": "/api/ssh-host-keys/ssh-rsa-10.110.0.1:22"}
},
{
"key": "x509v3-sign-rsa-d00::2222:dead:2222",
"meta": {"href": "/api/ssh-host-keys/x509v3-sign-rsa-d00::2222:dead:2222"}
}
]
}
When retrieving the endpoint of a specific host key, the response is the following.
{
"key": "ssh-rsa-10.10.100.1:22",
"meta": {
"href": "/api/ssh-host-keys/ssh-rsa-10.10.100.1:22",
"parent": "/api/ssh-host-keys"
},
"ssh-rsa-10.10.100.1:22": {
"address": "10.10.100.1",
"port": 22,
"type": {
"selection": "ssh-rsa",
"value": "AAAAB3NzaC1yc2EAAAABIwAAAQEAxrtNxBZieXhBI2gJoAdsjKNq...=="
}
}
}
| key |
|
|
string |
Top level element, contains the ID of the host key or certificate in the following format: <type-of-the-key>-<host-address>:<host-port> |
| <id-of-the-host-key> |
|
|
Top level element (string) |
The ID of the host key or certificate in the following format: <type-of-the-key>-<host-address>:<host-port>. |
|
address |
|
string |
The IPv4 or IPv6 address of the host that the key belongs to. Note that for IPv6 addresses, this is always the canonical format of the address. |
|
port |
|
number |
The port number where the host uses the key or certificate. |
|
type |
|
JSON object |
The ID of the host key or certificate in the following format: <type-of-the-key>-<host-address>:<host-port>. |
|
|
selection |
string |
Specifies the type of the host key. Possible values: ssh-rsa, ssh-dss, x509v3-sign-rsa, x509v3-sign-dss |
|
|
value |
string |
The host key or certificate as a string in PEM format. |
| 201 |
Created |
The new resource was successfully created. |
| 400 |
InvalidQuery |
The requested filter or its value is invalid. |
| 401 |
Unauthenticated |
The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved. |
| 403 |
Unauthorized |
The requested resource cannot be retrieved because the client is not authorized to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved. |
| 404 |
NotFound |
The requested object does not exist. |
Search and filter host keys
To list only specific host keys, you can use the following filters.
-
List every host key and certificate:
GET https://<IP-address-of-SPS>/api/ssh-host-keys
-
List host keys of a specific type:
GET https://<IP-address-of-SPS>/api/ssh-host-keys?type=<type-to-list>
Possible values: ssh-rsa, ssh-dss, x509v3-sign-rsa, x509v3-sign-dss. For example:
GET https://<IP-address-of-SPS>/api/ssh-host-keys?type=ssh-rsa
-
List host keys for a specific port number:
GET https://<IP-address-of-SPS>/api/ssh-host-keys?port=<port-number-to-list>
-
List host keys for a specific host address (IPv4 or IPv6):
GET https://<IP-address-of-SPS>/api/ssh-host-keys?address=<host-address>
-
For a complex filter, separate the parameters with an ampersand (&) character, for example:
GET https://<IP-address-of-SPS>/api/ssh-host-keys?port=<port-number-to-list>&type=<type-to-list>
The response to such requests is a JSON object, where the items list includes the IDs of the selected host keys (or an empty list). For example, filtering for ssh-dss keys could return a similar list:
{
"meta": {
"href": "/api/ssh-host-keys",
"parent": "/api"
},
"items": [
{
"key": "ssh-dss-10.110.0.1:22",
"meta": {"href": "/api/ssh-host-keys/ssh-dss-10.110.0.1:22"}
},
{
"key": "ssh-dss-10.110.0.2:2222",
"meta": {"href": "/api/ssh-host-keys/ssh-dss-10.110.0.2:2222"}
}
]
}
Add new host key
To upload a new host key or certificate, you have to POST the host key and other data as a JSON object to the https://<IP-address-of-SPS>/api/ssh-host-keys endpoint. For details, see Create a new object. The body of the POST request must contain a JSON object with the parameters listed in Element . If the POST request is successful, the response includes an ID for the host key in the following format: <type-of-the-key>-<host-address>:<host-port>. For example:
{
"address": "10.110.0.1",
"port": 22,
"type": {
"selection": "ssh-rsa",
"value": "AAAAB3NzaC1yc2EAAAAD...zvMwgc=="
}
}
Note that for IPv6 addresses, SPS will automatically convert the address to its canonical format.
Delete host key
To delete a host key or certificate, you have to DELETE https://<IP-address-of-SPS>/api/ssh-host-keys/<ID-of-the-host-key> endpoint. For details, see Delete an object. If the DELETE request is successful, the response includes only the meta object, for example:
{
"meta": {
"href": "/api/ssh-host-keys/ssh-rsa-10.10.20.35:22",
"parent": "/api/ssh-host-keys"
}
}
You must commit your changes to actually delete the object from SPS.
