security ssh profile

security ssh profile(1) 				BIG-IP TMSH Manual				   security ssh profile(1)

NAME
       profile - Configures ssh profile.

MODULE
       security ssh

SYNTAX
       Modify the profile component within the security ssh module using the syntax shown in the following sections.

   CREATE/MODIFY
	create profile [name]
	modify profile [name]
	 options:
	  description [string]
	  rules [add | delete | modify | replace-all-with] {
	     [ [name] ] {
	       options:
		actions [add | delete | modify] {
		  [ [name] ] {
		    shell-action { control [allow | disallow | terminate] log [no | yes] }
		    sub-system-action { control [allow | disallow | terminate] log [no | yes] }
		    sftp-up-action { control [allow | disallow | terminate] log [no | yes] }
		    sftp-down-action { control [allow | disallow | terminate] log [no | yes] }
		    scp-up-action { control [allow | disallow | terminate] log [no | yes] }
		    scp-down-action { control [allow | disallow | terminate] log [no | yes] }
		    rexec-action { control [allow | disallow | terminate] log [no | yes] }
		    local-forward-action { control [allow | disallow | terminate] log [no | yes] }
		    remote-forward-action { control [allow | disallow | terminate] log [no | yes] }
		    x11-forward-action { control [allow | disallow | terminate] log [no | yes] }
		    agent-action { control [allow | disallow | terminate] log [no | yes] }
		    other-action { control [allow | disallow | terminate] log [no | yes] }
		  }
		}
		description [string]
		identity-users [add | delete | replace-all-with] {
		  [identity user list names...]
		}
		identity-groups [add | delete | replace-all-with] {
		  [identity group list names...]
		}
	     }
	  }
	  rules none
	  actions [add | delete | modify] {
	     [ [name] ] {
	       options:
		 shell-action { control [allow | disallow | terminate] log [no | yes] }
		 sub-system-action { control [allow | disallow | terminate] log [no | yes] }
		 sftp-up-action { control [allow | disallow | terminate] log [no | yes] }
		 sftp-down-action { control [allow | disallow | terminate] log [no | yes] }
		 scp-up-action { control [allow | disallow | terminate] log [no | yes] }
		 scp-down-action { control [allow | disallow | terminate] log [no | yes] }
		 rexec-action { control [allow | disallow | terminate] log [no | yes] }
		 local-forward-action { control [allow | disallow | terminate] log [no | yes] }
		 remote-forward-action { control [allow | disallow | terminate] log [no | yes] }
		 x11-forward-action { control [allow | disallow | terminate] log [no | yes] }
		 agent-action { control [allow | disallow | terminate] log [no | yes] }
		 other-action { control [allow | disallow | terminate] log [no | yes] }
	     }
	  }
	  auth-info [add | delete | modify] {
	     [ [name] ] {
	       options:
		 proxy-server-auth {
		   private-key [string]
		   public-key [string]
		}
		proxy-client-auth {
		  private-key [string]
		  public-key [string]
		}
		real-server-auth {
		  public-key [string]
		}
	     }
	  }
	  timeout [integer]
	  lang-env-tolerance [any | common | default-value | none]

	edit profile
	  options:
	    all-properties
	    non-default-properties

   DISPLAY
	list profile
	show running-config profile
	 options:
	   all-properties
	   non-default-properties
	   one-line

DESCRIPTION
       You can use the profile component to configure a shareable and reusable set of ssh profile rules.

EXAMPLES
       create profile profile1 auth-info add {
	 auth1 {
	   proxy-server-auth {
	     private-key "abcd"
	     public-key "1234"
	   }
	   proxy-client-auth {
	     private-key "efgh"
	     public-key "5678"
	   }
	 } }

       Creates a ssh profile with auth-info of client facing auth and server facing auth.

       modify profile profile1 actions add {
	 action1 {
	   sftp-up-action {
	     control disallow log yes
	   }
	   shell-action {
	     control terminate log yes
	   }
	 } }

       Modify existing profile by adding default actions of shell action and sftp action.

       modify profile profile1 rules add {
	 rule1 {
	   actions add {
	     action1 {
	       sftp-up-action {
		 control disallow log yes
	       }
	       shell-action {
		 control terminate log yes
	       }
	     }
	   }
	   identity-groups add {
	     "grp1" "grp2"
	   }
	   identity-users add {
	     "usr1" "usr2"
	   }
	   description "rule1 and action1"
	 } }

       Modify existing profile by adding rule1 to it with command actions and user and group identity info.

       list profile

       Displays the current list of profile rules.

OPTIONS
       description
	    User defined profile description.

       timeout
	    User defined timeout value.

       lang-env-tolerance
	    Set the tolerance level for LANG environment variable settings. Only applicable when "other-action" is set to
	    "disconnect" or "terminate". "common" allows only "en_US.UTF-8", while "any" allows any standard locale.

       rules
	    Adds, deletes, or replaces a profile rule.

	    description
		 User defined rule description.

	    actions
		 Specifies the rule actions that the system takes when a profile is applied.

		 shell-action
		      Specifies the rule shell action info.

		 sub-system-action
		      Specifies the rule sub system info.

		 sftp-up-action
		      Specifies the rule sftp up action info.

		 sftp-down-action
		      Specifies the rule sftp up action info.

		 scp-up-action
		      Specifies the rule scp up action info.

		 scp-down-action
		      Specifies the rule scp up action info.

		 rexec-action
		      Specifies the rule rexec action info.

		 local-forward-action
		      Specifies the rule local forward action info.

		 remote-forward-action
		      Specifies the rule local forward action info.

		 x11-forward-action
		      Specifies the rule x11 forward action info.

		 agent-action
		      Specifies the rule agent action info.

		 other-action
		      Specifies the rule other action info.

	    identity-users
		 Specifies the rule users identity.

	    identity-groups
		 Specifies the rule groups identity.

       actions
	    Specifies the profile default actions that the system takes when a profile is applied.

	    shell-action
		 Specifies the rule shell action info.

	    sub-system-action
		 Specifies the rule sub system info.

	    sftp-up-action
		 Specifies the rule sftp up action info.

	    sftp-down-action
		 Specifies the rule sftp up action info.

	    scp-up-action
		 Specifies the rule scp up action info.

	    scp-down-action
		 Specifies the rule scp up action info.

	    rexec-action
		 Specifies the rule rexec action info.

	    local-forward-action
		 Specifies the rule local forward action info.

	    remote-forward-action
		 Specifies the rule local forward action info.

	    x11-forward-action
		 Specifies the rule x11 forward action info.

	    agent-action
		 Specifies the rule agent action info.

	    other-action
		 Specifies the rule other action info.

       auth-info
	    Specifies the authentication info of public key and private key for this profile.

	    proxy-server-auth
		 Specifies a set of private/public keys that can be used to authenticate proxy (BigIP) host server to the real
		 clients during the initial key exchange of the SSH session between real clients and BigIP acting as a proxy
		 server. A SSH Profile MUST have at least 1 set of private/public key configured for proxy server authentication.

		 private-key
		      Specifies the private key of the authentication algorithm (RSA, DSS etc) used for the proxy server
		      authentication.

		 public-key
		      Specifies the public key of the authentication algorithm (RSA, DSS etc) used for the proxy server
		      authentication.

	    proxy-client-auth
		 Specifies a set of private/public keys that can be used to support 'publicKey' based client authentication as
		 defined in RFC 4252 (The Secure Shell (SSH) Authentication Protocol). Note that this is optional in a SSH profile
		 and is only required to support 'publicKey' based client authentication (as defined in section 7 of the above
		 mentioned RFC).

		 private-key
		      Specifies the private key of the authentication algorithm (RSA, DSS etc) used for the proxy client
		      authentication.

		 public-key
		      Specifies the public key of the authentication algorithm (RSA, DSS etc) used for the proxy client
		      authentication.

	    real-server-auth
		 Specifies public key that can be used to authenticate real host server to the proxy (BigIP) client during the
		 initial key exchange of the SSH session between BigIP acting as a proxy client and a real ssh (backend) server.
		 If user does not configure any public key for the real server authentication in a SSH profile, all (backend) real
		 servers are always trusted.

		 public-key
		      Specifies the public key of the authentication algorithm (RSA, DSS etc) used for the real server
		      authentication.

COPYRIGHT
       No part of this program may be reproduced or transmitted in any form or by any means, electronic or mechanical, including
       photocopying, recording, or information storage and retrieval systems, for any purpose other than the purchaser's personal
       use, without the express written permission of F5 Networks, Inc.

       F5 Networks and BIG-IP (c) Copyright 2008, 2012-2016. All rights reserved.

BIG-IP							    2017-10-30					   security ssh profile(1)