Enabling strict and global host-key checking using the CLI

Use the commands in this section to enable strict host-key checking, global host-key checking, or both.

With strict host-key checking, the connection will be allowed only if the local host-keys database for the remote user already has an entry that matches the key the Central Management System appliance sends.
With global host-key checking, the connection will be allowed only if the global File Protect host-keys database already has an entry that matches the key the Central Management System appliance sends.

Caution

When you enable global host-key authentication, any established connections will be broken until you explicitly add the host key to the global host-keys database. See Importing a global host key using the CLI for instructions.

Note

See the ssh and cmc commands in the CLI Command Reference for advanced authentication options.

To enable strict host-key checking:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Enable strict host-key checking:

hostname (config) # cmc auth ssh host-key strict

Verify your changes:
```
hostname (config) # show cmc auth ssh
```
Save your changes:
```
hostname (config) # write memory
```

To enable global host-key checking:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Enable global host-key checking:

hostname (config) # cmc auth ssh host-key global-only

Verify your changes:
```
hostname (config) # show cmc auth ssh
```
Save your changes:
```
hostname (config) # write memory
```

To disable strict or global host-key authentication:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Perform the following steps as needed.
- To disable strict host-key checking:
```
hostname (config) # no cmc auth ssh host-key strict
```
- To disable global host-key checking:
```
hostname (config) # no cmc auth ssh host-key global
```
Verify your changes:
```
hostname (config) # show cmc auth ssh
```
Save your changes:
```
hostname (config) # write memory
```

Example

This example enforces both strict and global host-key checking on a managed File Protect appliance.

hostname (config) # cmc auth ssh host-key strict
hostname (config) # cmc auth ssh host-key global-only
hostname (config) # show cmc auth ssh

CMC SSH configuration:
   Strict host key checking enabled:  yes
   Global only known hosts enabled:   yes
   Minimum protocol version:          2
   Cipher list:                       compatible
   Minimum key length:                1024 bits