Janus SSH
Janus SSH is part of the Janus family of products that provides connectivity to the Model 204 database. A Janus SSH port is a built-in SSH (Secure Shell) server that lets users connect to a Model 204 Online from a standard SSH client over an encrypted connection, obtaining an interactive Model 204 command session.
Janus SSH was introduced in Model 204 version 8.0. Like the other Janus products, it requires the Janus TCP/IP Base.
The SSH server implements the standard SSH transport, authentication, and connection protocols (RFC 4250, RFC 4253, and RFC 4254). The following algorithms are supported:
| Function | Algorithm |
|---|---|
| Key exchange | diffie-hellman-group14-sha256 |
| Host and user keys | rsa-sha2-256 and ssh-rsa (RSA) |
| Encryption | aes256-ctr |
| Message authentication | hmac-sha2-256 |
Defining a Janus SSH port
An SSH port is defined with the JANUS DEFINE command, using the SSH port type. The server's host key is supplied by an SSL PROFILE, in the same way as for Janus SSL ports. For example:
JANUS DEFINE SSHPORT 5996 SSH 10 IBSIZE 4096 OBSIZE 8192 -
SSL PROFILE SSH.PKEY SSLCACHE 80 SSLIBSIZE 16512 SSLOBSIZE 4096
In this example, SSHPORT is the port name, 5996 is the TCP port number, SSH is the port type, and 10 is the maximum number of concurrent connections. The SSL PROFILE names the certificate profile that provides the server's RSA host key.
Once the port is started with the JANUS START command, users can connect with any standard SSH client:
ssh -p 5996 myuserid@myhost.example.com
Authentication
Janus SSH supports two forms of user authentication:
- Password authentication — the user supplies a Model 204 userid and password, which are validated the same way as for any other Model 204 login.
- Public-key (trusted) authentication — the user is authenticated by an RSA SSH public key that has been registered as trusted for that userid on the port, so no password is required.
Trusted public-key login
With trusted public-key login, an RSA public key is associated with a Model 204 userid on a specific SSH port. When a user connects and offers a private key whose public key is registered for the userid, the user is logged in without a password.
The following commands manage trusted keys. Each command applies to SSH ports only.
| Command | Description |
|---|---|
| JANUS TRUST portname userid base64key | Registers a trusted SSH public key for userid on the named SSH port. base64key is the base64-encoded public key blob (the middle field of an OpenSSH id_rsa.pub line). The key data may be continued across command lines. |
| JANUS DELTRUST portname userid | Removes the trusted key for userid on the named port. |
| JANUS DISPLAYTRUST [portname] | Displays the trusted keys registered on the named port, or on all ports if portname is omitted or is *. DISTRUST is an accepted abbreviation. |
| JANUS DISTOFU [portname] | Displays keys that were automatically registered by trust-on-first-use (TOFU). DISPLAYTOFU is a synonym. |
| JANUS SSHKEY | Displays the SSH public key that the current user authenticated with. This is a convenient way for a user to obtain the exact key blob to hand to an administrator for a JANUS TRUST command. |
For example, to trust a user's key on the port defined above:
JANUS TRUST SSHPORT MYUSER AAAAB3NzaC1yc2EAAAADAQAB...
Trust-on-first-use (TOFU)
Trust-on-first-use lets an SSH port automatically register a user's public key the first time that user connects and authenticates, so that subsequent connections use public-key login without further administration.
TOFU is enabled by specifying the TOFU option on the JANUS DEFINE command for an SSH port, with a maximum number of keys to retain (1 to 9999):
JANUS DEFINE SSHPORT 5996 SSH 10 SSL PROFILE SSH.PKEY TOFU 100
Keys registered by TOFU are shown by the JANUS DISTOFU command. When the maximum count is reached, the least recently used TOFU key is evicted to make room for a new one. Keys added explicitly with JANUS TRUST are never evicted by TOFU.