Configure Certificate Authentication for Users

Before you begin, review the requirements described in the Certificate Authentication for Users topic.

To configure user authentication using certificates, you need to install and configure Reflection PKI Services Manager and configure your server and client. Use the following procedures to get started. Many additional variations are possible. For more information, see the Reflection PKI Services Manager User Guide, which is available from the Reflection PKI Services Manager Documentation page.

You can install and configure a single instance of PKI Services Manager to support certificate authentication requests from multiple Reflection for Secure IT UNIX Client and Server clients and/or servers. However, because Reflection for Secure IT UNIX Client and Server settings allow only one entry for the PKI Services Manager address and port, this configuration creates a potential single point of failure. If PKI Services Manager is unreachable or the server is not running, all authentication attempts using certificates will fail. To provide load balancing and failover, you can define a round-robin DNS entry for the PKI Services Manager host name or place the PKI Services Manager host behind a load balancing server. You can also configure PKI Services Manager to run in a Microsoft cluster environment.

Note

Paths shown here are based on the default installation options.

To install and configure PKI Services Manager

Log in as root on the Reflection PKI Services Manager server.
Install Reflection PKI Services Manager.
Put a copy of the certificate (or certificates) you want to designate as a trust anchor into your certificate store. The default PKI Services Manager store is in the following location:

/opt/microfocus/pkid/``local-store
Open the PKI Services Manager configuration file in a text editor. The default name and location is:

/opt/microfocus/pkid/``config/pki_config
Use the TrustAnchor keyword to identify your trust anchor. For example:
```
TrustAnchor = trustedca.crt
```
-or-
```
TrustAnchor = CN=SecureCA,O=Acme,C=US
```
Note

To configure multiple trust anchors, add additional TrustAnchor lines.

Configure certificate revocation checking. For example:

To	Sample Configuration
Use CRLs stored on an LDAP server.	RevocationCheckOrder = crlserver CRLServers=ldap://crlserver
Use an OCSP responder.	RevocationCheckOrder = ocsp OCSPResponders = http://ocspresponder

Note

By default PKI Services Manager looks for CRLs in the local store. If you use this configuration, you need to copy the CRLs to your local store.

If intermediate certificates are required by the chain of trust in your certificates, configure access to these certificates. For example:

To	Sample Configuration
Use intermediate certificates you have added to your local store.	`CertSearchOrder=local`
Use certificates stored on an LDAP server.	CertSearchOrder=certserver CertServers=ldap://ldapserver

Save your changes to the configuration file.
Open the PKI Services Manager map file in a text editor. The default name and location is:

/opt/microfocus/pkid/``config/pki_mapfile
Create a user RuleType stanza and add one or more rules that define which users can authenticate with a valid certificate. For example:
```
RuleType = user

  { %UPN.user% } UPN.host Equals "acme.com"

  { fred root } Subject.CN Contains "Fred"
```
For more sample rules, see Sample PKI Services Manager Mapping Rules.

Note

After a certificate is determined to be valid, rules are processed in order (based on rule type then sequence). If the certificate meets the requirements defined in the conditional expression (or if the rule has no condition), the allowed identities specified in that rule are allowed to authenticate. No additional rules are applied after the first match.
Test for valid PKI Services Manager configuration:

/usr/local/sbin/pkid -k
```
No errors. Configuration is valid:
```
Restart Reflection PKI Services Manager.

/usr/local/sbin/pkid restart

To configure the Reflection for Secure IT UNIX Client and Server server

If PKI Services Manager is not installed on the same host as the Reflection for Secure IT UNIX Client and Server server, copy the PKI Services Manager public key to the Reflection for Secure IT UNIX Client and Server server.

The key location on PKI Services Manager is:

/opt/microfocus/pkid/config/pki_key.pub

Copy this to any location on the Reflection for Secure IT UNIX Client and Server host. For example:

/opt/microfocus/rsit/etc/pki_key.pub

Note

This key file should be owned by root and not be writable by any user but root.
Open the server configuration file (/opt/microfocus/rsit/etc/sshd2_config) in a text editor.
Edit PkidPublicKey to specify the location in which you placed the PKI Services Manager public key. For example:

PkidPublicKey=/opt/microfocus/rsit/etc/pki_key.pub
Edit PkidAddress to specify the PKI Services Manager host and port. For example:
```
PkidAddress=pkiserver.acme.com:18081
```
Note

If you specify a host and omit the port, the default PKI Services Manager port (18081) is used.
Configure AllowedAuthentications or RequiredAuthentications to allow or require public key authentication. The defaults shown below allow public key authentication, but don't require it:
```
AllowedAuthentications=gssapi-with-mic,publickey,keyboard-interactive,password
RequiredAuthentications=
```

To configure the Reflection for Secure IT UNIX Client and Server client

Obtain a user certificate and associated private key.
Install the certificate and private key. For example:
```
~/.ssh2/userkey
~/.ssh2/userkey.crt
```
Note

The certificate must be in the same directory as the private key and use the same base name with a .crt file extension.
Set permissions on the user key for user-only read-only access:
```
chmod 400 userkey
```
Create (or edit) the client identification file. (The default is ~/.ssh2/identification.) Configure this file for user-only write access:
```
chmod 600 identification
```
Add a line to the client identification file that identifies the private key. Use the CertKey keyword. (Path information is optional if the key is in the ~/.ssh2/ directory.) For example:
```
CertKey userkey
```
Open the client configuration file (/opt/microfocus/rsit/etc/ssh2_config) in a text editor.
Check your configuration of the following client settings. AllowedAuthentications must include publickey. IdentificationFile must specify the file you configured in listitem 3. The defaults are shown here:
```
AllowedAuthentications=gssapi-with-mic,publickey,keyboard-interactive,password
IdentificationFile=~/.ssh2/identification
```

More information