Configuring Ssh Authentication - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

Configuring SSH authentication

Incoming authentication is used when the remote host needs to authenticate to the switch. Outgoing
authentication is used when the switch needs to authenticate to a server or remote host and is more
commonly used for the configUpload command. Both password and public key authentication can
coexist on the switch.
After the allowed-user is configured, the remaining setup steps must be completed by the allowed-user.
1. Log in to the switch as the default admin.
2. Change the allowed-user's role to admin, if applicable.
switch:admin>
where username is the name of the user you want to perform SSH public key authentication, import,
export, and delete keys.
3. Set up the allowed-user by typing the following command:
switch:admin>
where username is the name of the user you want to perform SSH public key authentication, import,
export, and delete keys.
4. Generate a key pair for host-to-switch (incoming) authentication by logging in to your host as admin,
verifying that SSH v2 is installed and working (see your host's documentation as necessary), and
typing the following command:
ssh-keygen -t dsa
If you need to generate a key pair for outgoing authentication, skip steps 4 and 5 and proceed to step
6.
Example: RSA/DSA key pair generation
alloweduser@mymachine:
Generating public/private dsa key pair.
Enter file in which to save the key (
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /users/alloweduser/.ssh/id_dsa.
Your public key has been saved in /users/alloweduser/.ssh/id_dsa.pub.
The key fingerprint is:
32:9f:ae:b6:7f:7e:56:e4:b5:7a:21:f0:95:42:5c:d1 alloweduser@mymachine
5. Import the public key to the switch by logging in to the switch as the allowed-user and entering the
following command:
sshUtil importpubkey
Respond to the prompts as follows:
IP address
remote directory
public key name
login name
password
Example: Adding the public key to the switch
106 Configuring standard security features
userconfig --change username -r admin
sshutil allowuser username
ssh-keygen -t dsa
Enter the IP address of the switch. IPv6 is supported by sshUtil.
Enter the path to the remote directory where the public key is stored.
Enter the name of the public key.
Enter the name of the user granted access to the host.
Enter the password for the host.
/users/alloweduser/.ssh/id_dsa
):