The Secure Shell (SSH) protocol is used for secure communication between the two Central Management System appliances (nodes) in a Central Management System cluster. Host key-authentication can be used to prevent man-in-the-middle attacks, in which another server poses as the primary or secondary node in the cluster, and intercepts the traffic between them. When the cluster is formed, a key exchange takes place. The secondary node sends a copy of its host key or keys to the primary node, where they are compared to the keys in the primary node host-keys database.
If strict host-key checking is enabled, the cluster can be formed only if the key that is sent matches an entry in the local host-keys database for the primary node remote admin user. If global host-key checking is enabled, the cluster can be formed only if the key that is sent matches an entry in the global host-keys database for the primary node. You must import the host key for the default HA interface into the global host-keys database. Trellix recommends you also import the key for the backup HA interface, if configured, to ensure continuous communication if the default HA interface fails.
You can enforce strict host-key checking, global host-key checking, or both.
Important
Host keys are stored in the configuration database, so they are included in the backup file.
Note
In compliance mode, both strict and global host-key checking automatically enforced. For details, see the FIPS and Common Criteria Addendum.
For details, see:
Prerequisites
Admin access to configure authentication
Monitor, Operator, or Admin access to obtain host keys