Enabling strict and global host-key checking using the CLI

Use the commands in this section to enable strict host-key checking, global host-key checking, or both.

With strict host-key checking, the connection will be allowed only if the local host-keys database for the node's remote user already has an entry that matches the key the other node sends.
With global host-key checking, the connection will be allowed only if the node's global host-keys database already has an entry that matches the key the other node sends.

Caution

When you enable global host-key authentication, any established connections will be broken until you explicitly add the host key to the global host-keys database. See Importing global host keys using the CLI for instructions.

To enable strict host-key checking:

Enable the CLI configuration mode:

node-hostname > enable
node-hostname # configure terminal

Stop the cluster engine:
```
node-hostname (config) # ha engine stop
```

Enable strict host-key checking:

node-hostname (config) # cmc auth ssh host-key strict

Verify your changes:

node-hostname (config) # show cmc auth ssh

Save your changes:
```
node-hostname (config) # write memory
```
Reboot the node:
```
node-hostname (config) # reload
```
Repeat these steps on the other node.

To enable global host-key authentication:

Enable the CLI configuration mode:

node-hostname > enable
node-hostname # configure terminal

Stop the cluster engine:
```
node-hostname (config) # ha engine stop
```

Enable global host-key checking:

node-hostname (config) # cmc auth ssh host-key global-only

Verify your changes:

node-hostname (config) # show cmc auth ssh

Save your changes:
```
node-hostname (config) # write memory
```
Reboot the node:
```
node-hostname (config) # reload
```
Repeat these steps on the other node.

To disable strict or global host-key authentication:

Enable the CLI configuration mode:

node-hostname > enable
node-hostname # configure terminal

Stop the cluster engine:
```
node-hostname (config) # ha engine stop
```

Perform the following steps as needed:

To disable strict host-key checking:

node-hostname (config) # no cmc auth ssh host-key strict

To disable global host-key checking:

node-hostname (config) # no cmc auth ssh host-key global

Verify your changes:

node-hostname (config) # show cmc auth ssh

Save your changes:
```
node-hostname (config) # write memory
```
Reboot the node:
```
node-hostname (config) # reload
```
Repeat the preceding steps from the CLI of the other node.

Example

This example enables strict and global host-key authentication on node1.

node1 (config) # ha engine stop
node1 (config) # cmc auth ssh host-key strict
node1 (config) # cmc auth ssh host-key global-only
node1 (config) # show cmc auth ssh

CMC SSH configuration:
   Strict host key checking enabled:  yes
   Global only known hosts enabled:   yes
   ...
node1 (config) # write memory
node1 (config) # reload