The remote user can authenticate using either a password or a public key. After the connection is established, it is controlled by the configured password or the public key.
Password authentication
With password authentication, a password is configured for the remote user. This is the initial authentication type for an appliance that is added to the Central Management System appliance using the Web UI.
Public key authentication
Public key authentication uses a pair of keys—a public key and a private key. With public key authentication, an SSH-DSA2 or SSH-RSA2 identity is configured for the remote user and is pushed to the Central Management System appliance.
Benefits of public key authentication include:
The private key remains on the Network Security appliance and cannot be computed from the public key. This is an advantage over password authentication, where the password could be cracked.
If you use password authentication, password change policies can break the connection between the Central Management System platform and the managed appliance.
For example, suppose users on the Central Management System appliance must change their passwords every 90 days. As the administrator of the Network Security appliance, you might be unaware of this policy. After the password for the remote user changes, the connection to the Central Management System appliance will be broken until you change the password on the Network Security appliance.
Tip
Because password change policies apply only to password authentication, Trellix recommends using public key authentication for this connection.
For details, see the following topics:
Creating a public key using the CLI
Use the commands in this section to create a new public key for SSH user authentication. You can use this key instead of the password to authenticate the remote user.
Note
If no SSH-DSA2 or SSH-RSA2 public keys exist, you can use the Web UI to create an "admin" SSH-DSA2 key and an "admin" SSH-RSA2 key. For details, see Importing a host key into the global host-keys database using the Web UI.
To create a public key:
Go to CLI configuration mode:
hostname > enable hostname # configure terminalCreate the public key:
hostname (config) # cmc auth <keyType> identity <identityName> generatewhere
<keyType>can bessh-dsa2orssh-rsa2and<identityName>is a user-friendly name.Verify your changes:
hostname (config) # show cmc auth identitiesSave your changes:
hostname (config) # write memory
To remove a public key:
Go to CLI configuration mode:
hostname > enable hostname # configure terminalRemove the public key:
hostname (config) # no cmc auth <keyType> identity <identityName>Verify your change:
hostname (config) # show cmc auth identitiesSave your changes:
hostname (config) # write memory
Example
The following example creates an SSH-DSA2 identity named "admin4" on the NX-04 appliance.
NX-04 (config) # cmc auth ssh-dsa2 identity admin4
NX-04 (config) # show cmc auth identities
DSA2 identity admin4:
Public Key:
ssh-dss AAA3NzaC1kc3MAAACBAJl3PisWNnz/gYLvL4JC7xFMoq3HE89rai7trnJmpxjylArYhf
MzaGndFA4qGRZMFzhiz9Jhi/+W1ufIrXLGzakC0lAAAAFQCuMCsMwMGN9zT5w2JCiDt7D6orNwAA
...Note
This example is from a Network Security appliance, but it is representative of other Trellix appliances as well.
Configuring user authentication using the CLI
Use the commands in this section to configure authentication parameters for the remote user the managed appliance uses to log in to the Central Management System appliance to announce itself. This is an existing "admin" user on the Central Management System appliance.
Note
See the
sshandcmccommands in the CLI Command Reference for advanced authentication options.
To configure password authentication:
Go to CLI configuration mode:
hostname > enable hostname # configure terminalSpecify the "password" authentication type:
hostname (config) # cmc client server auth authtype passwordSpecify the remote user to log in to the Central Management System appliance:
hostname (config) # cmc client server auth password username <username>Specify the password used to authenticate the remote user:
hostname (config) # cmc client server auth password password <password>Save your changes:
hostname (config) # write memory
To configure SSH-DSA2 authentication:
Go to CLI configuration mode:
hostname > enable hostname # configure terminalSpecify the SSH-DSA2 authentication type:
hostname (config) # cmc client server auth authtype ssh-dsa2Specify the remote user to log in to the Central Management System appliance:
Specify the named identity used to authenticate the remote user:
hostname (config) # cmc client server auth ssh-dsa2 identity <identityName>where
<identityName>is the name of an existing identity.Save your changes:
hostname (config) # write memory
To configure SSH-RSA2 authentication:
Go to CLI configuration mode:
hostname > enable hostname # configure terminalSpecify the SSH-RSA2 authentication type:
hostname (config) # cmc client server auth authtype ssh-rsa2Specify the remote user to log in to the Central Management System appliance:
hostname (config) # cmc client server auth ssh-rsa2 username <username>Specify the named identity used to authenticate the remote user:
hostname (config) # cmc client server auth ssh-rsa2 identity <identityName>where
<identityName>is the name of an existing identity.Save your changes:
hostname (config) # write memory
Example
The following example configures SSH-DSA2 authentication parameters used to log in to the Central Management System appliance.
hostname (config) # cmc client server auth authtype ssh-dsa2
hostname (config) # cmc client server auth ssh-dsa2 username cmcadmin3
hostname (config) # cmc client server auth ssh-dsa2 identity admin3