SecureAdmin concepts

Supported protocol and version

SecureAdmin provides a secure remote shell and interactive network sessions. It supports SSH 1.0 clients only.

SecureAdmin supports only password authentication and DES (Data Encryption System) and 3DES session encryption. DES is an encryption algorithm, and 3DES is an encryption algorithm that relies on triple encryption.

Note: If you run the secureadmin command, other protocols might appear, but you should disregard any references to other protocols.

SecureAdmin administration

A daemon (sshd) runs the SecureAdmin feature. You administer SecureAdmin with the secureadmin command. You can perform the following operations on SecureAdmin:

Set up and start SecureAdmin, as described in "Setting up and starting SecureAdmin."
Reinitialize SecureAdmin and generate new keys, as described in "Reinitializing SecureAdmin."
Disable SecureAdmin, as described in "Disabling SecureAdmin."
Restart SecureAdmin, as described in "Restarting SecureAdmin."
Get the status of SecureAdmin, as described in "Determining whether SecureAdmin is running."
Display the version of SecureAdmin you are running, as described in "Displaying the version of SecureAdmin."

SecureAdmin uses RSA encryption

SecureAdmin uses public-key encryption provided by RSA for host authentication and session encryption.

Host and server key properties

Host and server keys have the following properties:

They can range in strength from 384 through 1,024 bits. The higher the strength the greater the security, but the longer it takes to initiate a new SecureAdmin session, and the higher the likelihood of lowering filer performance.
The two keys must differ by at least 128 bits.
The default values are as follows:
- Host key: 768 bits
- Server key: 512 bits

SecureAdmin keys

SecureAdmin performs encryption with three keys: a host key, a server key, and a session key, as described in the following table. The filer and clients generate keys with DES, 3DES, or proprietary algorithms.


Key	Description
Host key	One of the keys that the filer uses in encrypting and decrypting the session key. The filer generates the host key when you run the SecureAdmin `setup` program.
Server key	One of the keys that the filer uses in encrypting and decrypting the session key. The filer generates the server key when the following occurs: An hour elapses You start SecureAdmin The filer reboots
Session key	A key generated by the client. The session key encrypts all the data in a network session.

How SecureAdmin uses keys

The following process table shows how the filer and an SSH 1.0 client use keys.


Stage	What the client does	What the filer does
1	The client sends an SSH request to the filer.	The filer receives an SSH request from a client.
2		The filer sends to the client the public portion of the host and server keys.
3	The client stores the public portion of the host key.
4	The client generates a session key using client-specific procedures.
5	The client encrypts the session key using the public portion of the host and server keys and sends it to the filer.
6		The filer decrypts the session key using the private portions of the portion of the host and server keys.
7	The filer and the client exchange information that they encrypt and decrypt using the session key.

Part No. 210-02334
File: secadmi1.htm
Last updated: 02/24/99 12:17:32