z/OS Version 2 Release 4 z/OS OpenSSH User's Guide IBM SC27-6806-40 Note Before using this information and the product it supports, read the information in “Notices” on page 503. This edition applies to Version 2 Release 4 of z/OS (5650-ZOS) and to all subsequent releases and modifications until otherwise indicated in new editions. Last updated: 2020-11-16 © Copyright International Business Machines Corporation 2015, 2019. US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Figures................................................................................................................. ix Tables.................................................................................................................. xi About this document...........................................................................................xiii Who should use this document?............................................................................................................... xiii z/OS information........................................................................................................................................xiii Discussion list...................................................................................................................................... xiii How to send your comments to IBM......................................................................xv If you have a technical problem.................................................................................................................xv Summary of changes..........................................................................................xvii Summary of changes for z/OS Version 2 Release 4 (V2R4) and its updates.......................................... xvii General changes..................................................................................................................................xvii Message changes.................................................................................................................................xix Summary of changes for z/OS Version 2 Release 3 (V2R3) and its updates...........................................xix General changes.................................................................................................................................. xix Message changes.................................................................................................................................xix Summary of changes for z/OS Version 2 Release 2 (V2R2), as updated December 2015...................... xx Chapter 1. Introduction to z/OS OpenSSH ............................................................. 1 What is OpenSSH?........................................................................................................................................1 Chapter 2. What's new or changed in z/OS Version 2 Release 4 OpenSSH................3 New and changed configuration files.......................................................................................................... 3 Summary of changes to SYS1.MACLIB....................................................................................................... 3 Summary of changes to non-configuration files in /samples..................................................................... 4 Chapter 3. What's new or changed in z/OS Version 2 Release 3 OpenSSH................5 New and changed configuration files.......................................................................................................... 5 Summary of changes to SYS1.MACLIB....................................................................................................... 5 Summary of changes to non-configuration files in /samples..................................................................... 6 Chapter 4. What's new or changed in z/OS Version 2 Release 2 OpenSSH................7 Summary of changes to commands............................................................................................................ 7 New and changed configuration files.......................................................................................................... 7 Changed environment variables..................................................................................................................8 Summary of changes to SYS1.MACLIB....................................................................................................... 9 Summary of changes to non-configuration files in /samples..................................................................... 9 Chapter 5. How does z/OS OpenSSH differ from the open source version?.............11 What z/OS OpenSSH supports.................................................................................................................. 11 What z/OS OpenSSH does not support..................................................................................................... 12 Chapter 6. Migrating to z/OS OpenSSH Version 2 Release 4...................................13 Key ring SAF/RACF access.........................................................................................................................13 Supported protocol and algorithm changes............................................................................................. 13 iii Cipher and MAC ICSF usage....................................................................................................................13 /etc/ssh/moduli configuration file.............................................................................................................13 DSA (ssh-dss) key support........................................................................................................................ 14 SSH server root login................................................................................................................................. 14 AuthorizedKeysFile option........................................................................................................................ 14 UseDNS option...........................................................................................................................................14 Other configuration options and sample configuration files.................................................................... 14 Chapter 7. For system administrators...................................................................15 Differences between sftp and FTP............................................................................................................ 15 What you need to verify before using OpenSSH....................................................................................... 15 Steps for verifying the prerequisites for using OpenSSH....................................................................15 Setting up the sshd daemon......................................................................................................................17 Steps for creating or editing configuration files.................................................................................. 18 Setting up server authentication..........................................................................................................20 Steps for setting up server authentication when keys are stored in UNIX files.................................20 Steps for setting up server authentication when keys are stored in key rings...................................22 Steps for setting up server authentication with GSS-API (Kerberos).................................................31 Step for creating the sshd privilege separation user...........................................................................31 Setting up the message catalog for z/OS OpenSSH ........................................................................... 32 Starting the sshd daemon..........................................................................................................................32 Starting sshd as a stand-alone daemon.............................................................................................. 33 Ways to start sshd as a stand-alone daemon......................................................................................33 Restarting the sshd daemon without bringing it down....................................................................... 35 Starting sshd as a daemon running under inetd..................................................................................35 Restarting the sshd daemon under inetd without bringing it down................................................... 36 Stopping the sshd daemon........................................................................................................................36 Running the sshd daemon in a multilevel-secure environment...............................................................37 Verifying security labels for directories............................................................................................... 37 Configuring sshd for multilevel security.............................................................................................. 38 Considerations for running the OpenSSH daemon when TERMINAL classes are defined................ 38 Limiting file system name space for sftp users ........................................................................................39