Tech Specs - Reflection for Secure IT Client for UNIX

Secure Shell Access

Secure File Transfer

SCP and SFTP special features
- Smart Copy (to eliminate redundant copying of identical source and target files)
- File transfer resume after interrupted downloads
- Recursive directory copying
- Remote-to-remote transfers (SCP)
- Automatic ASCII mode for specified file extension types (SFTP)

Tunneling

Standards Support

Compliance with IETF Secsh Internet drafts and RFCs 4250–4254, 4256, 4462, 4345, and 4716

Cryptographic Library Validation

Algorithms

Ciphers
- AES (128-, 192-, and 256-bit CBC)
- AES (128-, 192-, and 256-bit CTR)
- 3DES (3 56-bit key EDE)
- Blowfish (128-bit)
- CAST (128-bit)
- Arcfour (128- and 256-bit)
Key exchange
- Diffie-Hellm
- GSS-API key exchange
- RSA
- DSA

MACS
- HMAC-MD5
- HMAC-MD5-96
- HMAC-SHA1
- HMAC-SHA1-96
- HMAC-SHA256
- HMAC-SHA512
- RIPEMD160
- Meets DoD requirements for SHA-2

Authentication

Reflection PKI Services Manager
- Centralized configuration and management of PKI functions across Reflection for Secure IT Server for Windows, Server for UNIX, and Client for UNIX
- Standalone service module supported on most platforms supported by Reflection for Secure IT Server for Windows and Server for UNIX
- DoD PKI certified
- FIPS 140-2 Level 1-validated for most supported platforms (Certificate #2058)
- RFCs 2253, 2560, and 3280
- X.509 certificates for server and client authentication (X.509 versions 1-3)
- Version 2 X.509 CRL
- OCSP revocation checks
- HSPD-12 support
- Support for LDAP and HTTP certificate and CRL repositories
- Certificate extensions supported
  - CDP
  - IDP
  - AIA
  - Policy constraints
  - Basic constraints
  - Name constraints
  - Extended key usage
- Customizable configuration on per trust anchor basis
- Fully customizable mapping of SSH user account names to certificates
- SOCKS proxy support
- PKI client command line utility for querying services availability and certificate validity

Server authentication
- Public key (RSA and DSA)
- PKI X.509 certificates
- Kerberos (gssapi-keyex)
User authentication
- Password
- Public key
  - RSA and DSA user keys
  - Key agent utility for private key management
  - Agent forwarding
  - Host name aliasing for host key storage
  - PKCS#11 smart card support on Solaris 10 SPARC platforms
- Keyboard interactive
  - RSA SecurID
  - RADIUS
  - Keyboard-interactive password
- PKI X.509 certificates
- Kerberos (gssapi-with-mic)

Accounting and Auditing

Performance

High Performance Enabled (HPN) support leverages dynamic TCP windows for improved file transfer performance

Operating Systems

*Customizable installation directory available for Solaris and Linux platforms

System Requirements

For all Itanium systems, the library libunwind is required (HP-UX, Red Hat Enterprise Linux, and SUSE Linux Enterprise Server)
Network interface card

Any system that meets the minimum requirements for the UNIX/Linux operating system
Oracle Solaris UltraSPARC CPU

Tech Specs for Reflection for Secure IT Client for UNIX