Chapter 7. The ThinLinc Client
Description of security tab settings
Here follows detailed description of the settings available in the security tab.
SSH Port
This option selects the TCP/IP port to use when the client tries to establish an SSH connection with
the ThinLinc server. The normal SSH port is 22, which also is the default selection for this option.
There can be reasons to use another port on some occasions. If you for example need to use
ThinLinc over the Internet, from a location where port 22 is blocked by a firewall. Then you can
select a port that is let open. Port 80 which is used for HTTP, the protocol used for transport when
surfing the WWW is one port that often is open. To be able to use a port other than 22 you need to
make sure that the SSH daemon (sshd), which runs on the ThinLinc server, listens to the port you
want to use. The SSH daemon can be told to listen to any wanted ports. In the client interface you
can select between the default port 22, port 80 and an arbitrary port number which you can enter by
yourself.
Note about SSH host key updates: If the SSH host key on the server changes, e.g. due to an
upgrade of the OS or SSH server software, the client will note this fact. It will then, at the next
login, open a dialog and let the user confirm that the new host key is valid. If the user clicks OK ,
then the host key on the client for this particular server is updated on disk.
The administrator can disallow this by manually setting the parameter ALLOW_HOSTKEY_UPDATE
to 0. See Section 7.7 for more information.
Password
This option makes the client try to authenticate using a regular password.
Public key
This option makes the client try to authenticate using public key encryption. The user will be asked
to provide a private encryption key instead of a text password.
Smart card
This option makes the client try to authenticate using public key encryption, but with the private key
securely stored on a smart card. The user will be asked to select a certificate on the smart card and
to provide the passphrase for it.
Note: Smart card authentication requires that the smart card is readable by your PKCS#11
library. The library included by default supports PKCS#15 compliant smart cards and relies on
the PC/SC interface. This is always present on Windows systems and is usually installed by
default on Linux systems. On Solaris this is a third-party add-on.
The "Details..." button lets you change the options for smart card usage and managing the certificate
filters which are used to match accepted certificates for authentication.
56
Comentarios a estos manuales