Ssh Authentication Methods - HP VSR1000 Security Configuration Manual

Stages
Algorithm negotiation
Key exchange
Authentication
Session request
Interaction

SSH authentication methods

When the device acts as an SSH server, it supports the following authentication methods:
Password authentication—The SSH server authenticates a client through the AAA mechanism. In a
•
password authentication, an SSH client encrypts and encapsulates its username and password into
an authentication request, and sends the request to the server. After receiving the request, the SSH
server performs the following operations:
a. Decrypts the request to get the username and password in plain text.
b. Examines the validity of the username and password locally or through remote AAA
authentication.
c. Informs the client of the authentication result.
If the remote AAA server requires the user to enter a password for secondary authentication, it
send the SSH server an authentication response carrying a prompt. The prompt is transparently
transmitted to the client to notify the user to enter a specific password. When the user enters the
correct password, the AAA sever examines the password validity. If the password is valid, the SSH
server returns an authentication success message to the client.
For more information about AAA, see
Description
SSH supports multiple algorithms. Based on the local algorithms, the two
parties determine to use the following algorithms:
•
Key exchange algorithm for generating session keys.
•
Encryption algorithm for encrypting data.
•
Public key algorithm for digital signature and authentication.
•
HMAC algorithm for protecting data integrity.
The two parties use the DH exchange algorithm to dynamically generate
the session keys and session ID:
•
Session keys are used for protecting data transfer.
•
The session ID is used for identifying the SSH connection.
In this stage, the client also authenticates the server.
The SSH server authenticates the client in response to the client's
authentication request.
After passing the authentication, the client sends a session request to the
server to request the establishment of a session (or request the Stelnet,
SFTP, or SCP service).
After the server grants the request, the client and the server start to
communicate with each other in the session.
In this stage, you can paste commands in text format and execute them
at the CLI. The text pasted at one time must be no more than 2000 bytes.
To execute the commands successfully, HP recommends that you paste
commands that are in the same view.
To execute commands of more than 2000 bytes, save the commands in
a configuration file, upload it to the server through SFTP, and use it to
restart the server.
"Configuring AAA."
246