Alex: Create Janus SSH page: SSH server port type, RSA public-key trusted login, JANUS TRUST/DELTRUST/DISPLAYTRUST/DISTOFU/SSHKEY commands, TOFU (new in 8.0)

2026-08-27T01:40:53Z

Create Janus SSH page: SSH server port type, RSA public-key trusted login, JANUS TRUST/DELTRUST/DISPLAYTRUST/DISTOFU/SSHKEY commands, TOFU (new in 8.0)

New page

<var class="product">Janus SSH</var> is part of the Janus family of products that provides connectivity to the <var class="product">Model 204</var> database. A Janus SSH port is a built-in SSH (Secure Shell) server that lets users connect to a <var class="product">Model 204</var> <var class="product">Online</var> from a standard SSH client over an encrypted connection, obtaining an interactive <var class="product">Model 204</var> command session.

Janus SSH was introduced in <var class="product">Model 204</var> version 8.0. Like the other Janus products, it requires the <var class="product">[[Janus TCP/IP Base]]</var>.

The SSH server implements the standard SSH transport, authentication, and connection protocols (RFC 4250, RFC 4253, and RFC 4254). The following algorithms are supported:
<table>
<tr class="head"><th>Function</th>
<th>Algorithm</th></tr>
<tr><td>Key exchange</td><td><code>diffie-hellman-group14-sha256</code></td></tr>
<tr><td>Host and user keys</td><td><code>rsa-sha2-256</code> and <code>ssh-rsa</code> (RSA)</td></tr>
<tr><td>Encryption</td><td><code>aes256-ctr</code></td></tr>
<tr><td>Message authentication</td><td><code>hmac-sha2-256</code></td></tr>
</table>

==Defining a Janus SSH port==
An SSH port is defined with the <var>[[JANUS DEFINE]]</var> command, using the <var>SSH</var> port type. The server's host key is supplied by an <var>SSL PROFILE</var>, in the same way as for Janus SSL ports. For example:

JANUS DEFINE SSHPORT 5996 SSH 10 IBSIZE 4096 OBSIZE 8192 -
SSL PROFILE SSH.PKEY SSLCACHE 80 SSLIBSIZE 16512 SSLOBSIZE 4096

In this example, <code>SSHPORT</code> is the port name, <code>5996</code> is the TCP port number, <code>SSH</code> is the port type, and <code>10</code> is the maximum number of concurrent connections. The <var>SSL PROFILE</var> names the certificate profile that provides the server's RSA host key.

Once the port is started with the <var>[[JANUS START]]</var> command, users can connect with any standard SSH client:

ssh -p 5996 myuserid@myhost.example.com

==Authentication==
Janus SSH supports two forms of user authentication:
<ul>
<li><b>Password authentication</b> — the user supplies a <var class="product">Model 204</var> userid and password, which are validated the same way as for any other <var class="product">Model 204</var> login.</li>
<li><b>Public-key (trusted) authentication</b> — the user is authenticated by an RSA SSH public key that has been registered as trusted for that userid on the port, so no password is required.</li>
</ul>

==Trusted public-key login==
With trusted public-key login, an RSA public key is associated with a <var class="product">Model 204</var> userid on a specific SSH port. When a user connects and offers a private key whose public key is registered for the userid, the user is logged in without a password.

The following commands manage trusted keys. Each command applies to SSH ports only.

<table>
<tr class="head"><th>Command</th>
<th>Description</th></tr>
<tr>
<td nowrap><var>JANUS TRUST</var> ''portname userid base64key''</td>
<td>Registers a trusted SSH public key for ''userid'' on the named SSH port. ''base64key'' is the base64-encoded public key blob (the middle field of an OpenSSH <code>id_rsa.pub</code> line). The key data may be continued across command lines.</td></tr>
<tr>
<td nowrap><var>JANUS DELTRUST</var> ''portname userid''</td>
<td>Removes the trusted key for ''userid'' on the named port.</td></tr>
<tr>
<td nowrap><var>JANUS DISPLAYTRUST</var> [''portname'']</td>
<td>Displays the trusted keys registered on the named port, or on all ports if ''portname'' is omitted or is <code>*</code>. <var>DISTRUST</var> is an accepted abbreviation.</td></tr>
<tr>
<td nowrap><var>JANUS DISTOFU</var> [''portname'']</td>
<td>Displays keys that were automatically registered by trust-on-first-use (TOFU). <var>DISPLAYTOFU</var> is a synonym.</td></tr>
<tr>
<td nowrap><var>JANUS SSHKEY</var></td>
<td>Displays the SSH public key that the current user authenticated with. This is a convenient way for a user to obtain the exact key blob to hand to an administrator for a <var>JANUS TRUST</var> command.</td></tr>
</table>

For example, to trust a user's key on the port defined above:

JANUS TRUST SSHPORT MYUSER AAAAB3NzaC1yc2EAAAADAQAB...

==Trust-on-first-use (TOFU)==
Trust-on-first-use lets an SSH port automatically register a user's public key the first time that user connects and authenticates, so that subsequent connections use public-key login without further administration.

TOFU is enabled by specifying the <var>TOFU</var> option on the <var>[[JANUS DEFINE]]</var> command for an SSH port, with a maximum number of keys to retain (1 to 9999):

JANUS DEFINE SSHPORT 5996 SSH 10 SSL PROFILE SSH.PKEY TOFU 100

Keys registered by TOFU are shown by the <var>JANUS DISTOFU</var> command. When the maximum count is reached, the least recently used TOFU key is evicted to make room for a new one. Keys added explicitly with <var>JANUS TRUST</var> are never evicted by TOFU.

==See also==
<ul>
<li><var>[[JANUS DEFINE]]</var></li>
<li><var>[[JANUS START]]</var></li>
<li><var class="product">[[Janus TCP/IP Base]]</var></li>
<li>[[Release notes for Model 204 version 8.0#Janus SSH server|Model 204 version 8.0 release notes]]</li>
</ul>

[[Category:Janus SSH]]
[[Category:Janus commands]]

Janus SSH - Revision history

Alex: Create Janus SSH page: SSH server port type, RSA public-key trusted login, JANUS TRUST/DELTRUST/DISPLAYTRUST/DISTOFU/SSHKEY commands, TOFU (new in 8.0)