Users Guide

Successfully created CSR file /home/admin/tor6.csr and key
OS10# copy home://tor6.csr scp://CAadmin:secret@172.11.222.1/s4048-001-csr.pem
OS10# copy scp://CAadmin:secret@172.11.222.1/s4048-001.crt usb://s4048-001.crt
OS10# crypto cert install crt-file usb://s4048-001.crt key-file usb://s4048-001.key
This will replace the already installed host certificate.
Do you want to proceed ? [yes/no(default)]:yes
Processing certificate ...
Host certificate installed successfully.
3. Configure an X.509v3 security profile.
OS10# show crypto cert
-------------------------------------
| Installed non-FIPS certificates |
-------------------------------------
s4048-001
-------------------------------------
| Installed FIPS certificates |
-------------------------------------
OS10# config terminal
OS10(config)# crypto security-profile secure-cluster
OS10(config-sec-profile)# certificate s4048-001
OS10(config-sec-profile)# exit
4. Configure the cluster security profile.
OS10(config)# cluster security-profile secure-cluster
OS10(config)# exit
SSH Smart Card Authentication
OS10 allows you to use Common Access Card (CAC) and Personal Identity Verification (PIV) smart cards for authenticating
users when connecting with Secure Shell (SSH). CAC and PIV smart cards contain Public Key Infrastructure (PKI) X.509v3
certificates that are issued by certificate authorities. This feature allows the OS10 software to verify user authentication and
email signing and encryption. To use smart card authentication, use an SSH client that supports X.509v3 authentication.
The OS10 SSH server supports X.509v3 smart card authentication in two forms - with or without a password. When you use
X.509v3 authentication with passwords, you can use X.509v3 authentication along with remote authentication using RADIUS or
TACACS+ authentication.
Remote user authentication with a password
When you configure the switch for X.509v3 SSH authentication and remote authentication of users using RADIUS or TACACS+,
and when connecting using SSH, the following sequence occurs:
1. Insert a CAC or PIV smart card into the card reader slot in your computer or keyboard.
2. Start an RFC 6187 X.509v3 compatible SSH client application, set authentication to smart card or CAC, and make a
connection to the OS10 switch.
3. The SSH client application makes the initial connection to the switch, negotiates X.509v3 authentication, and validates the
OS10 switch X.509v3 certificate.
4. The SSH client application prompts you to select the required authentication certificate from the CAC or PIV card.
5. The SSH client application prompts you to enter the PIN for the CAC or PIV card.
6. The SSH client application sends an authentication request with your X.509v3 certificate.
7. The OS10 SSH server validates the public certificate, including validating the trust chain, valid date range, and usage fields. If
any of the fields are invalid, the authentication fails.
8. If the configured OS10 security profile calls for revocation checking, the OS10 SSH server verifies that the certificate is
not revoked. Verification is done by checking either the appropriate CRL or by sending an OCSP request to the appropriate
OCSP responder.
9. If the certificate is revoked, the authentication fails.
10. If peer-name-checking is enabled in the security profile, the OS10 SSH server matches the common name or principal name
fields from the user certificate against the username. The authentication fails if there is no match.
Security
1373