Chapter 4. Securing Administration; Secure Shell And Secure Copy - IBM RackSwitch G8000 Application Manual

Chapter 4. Securing Administration

Secure Shell and Secure Copy

© Copyright IBM Corp. 2011
Secure switch management is needed for environments that perform significant
management functions across the Internet. Common functions for secured
management are described in the following sections:
• "Secure Shell and Secure Copy" on page 55
• "End User Access Control" on page 60
Note: SNMP read and write functions are enabled by default. For best security
practices, if SNMP is not needed for your network, it is recommended that
you disable these functions prior to connecting the switch to the network
(see "Using Simple Network Management Protocol" on page
Because using Telnet does not provide a secure connection for managing a G8000,
Secure Shell (SSH) and Secure Copy (SCP) features have been included for G8000
management. SSH and SCP use secure tunnels to encrypt and secure messages
between a remote administrator and the switch.
SSH is a protocol that enables remote administrators to log securely into the G8000
over a network to execute management commands.
SCP is typically used to copy files securely from one machine to another. SCP uses
SSH for encryption of data on the network. On a G8000, SCP is used to download
and upload the switch configuration via secure channels.
Although SSH and SCP are disabled by default, enabling and using these features
provides the following benefits:
• Identifying the administrator using Name/Password
• Authentication of remote administrators
• Authorization of remote administrators
• Determining the permitted actions and customizing service for individual admin-
istrators
• Encryption of management messages
• Encrypting messages between the remote administrator and switch
• Secure copy support
IBM Networking OS implements the SSH version 2.0 standard and is confirmed to
work with SSH version 2.0-compliant clients such as the following:
• OpenSSH_5.4p1 for Linux
• Secure CRT Version 5.0.2 (build 1021)
• Putty SSH release 0.60
30).
55