Authentication Phase; Connection Phase; Using Secure Shell Public Key Authentication (Pka); Using Secure Shell - Alcatel-Lucent OmniSwitch AOS Release 7 Manual

Using Secure Shell

Authentication Phase

When the client tries to authenticate, the server determines the process used by telling the client which
authentication methods can be used. The client has the freedom to attempt several methods listed by the
server. The server will disconnect itself from the client if a certain number of failed authentications are
attempted or if a time-out period expires. Authentication is performed independent of whether the Secure
Shell interface or the SFTP file transfer protocol will be implemented.

Connection Phase

After successful authentication, both the client and the server process the Secure Shell connection
protocol.

Using Secure Shell Public Key Authentication (PKA)

Generating and copying Keys
The following procedure is used to set up Secure Shell PKA between an OmniSwitch and a client device.
The steps below use a userid of "new_ssh_user" on the OmniSwitch as an example:
Note: A comment must be provided when generating the public key (ex. remote_ssh_user@device) and
the key must be in the format show below.
<ssh-rsa | ssh-dsa> <encrypted key> <remote_ssh_user@device>
Example Key:
ssh-rsa AAAAB3NzaC1yc2EAAkjgnivubn9872435nsdg8dfsgfd8dfgfd7Rah1sqeyh6
v3v6Hji4sOXwn+jdhAHJTM2Iq1RjwccObEdYc67VM9+2ZwEipJI5HYl1qbYKTA0em0kwK
HNa+naIkWsTSwNj81HaAkaL21LMhcHnRytBfTeyySLgNHxy6VFX1ipMN3pdtQbJn0cfRI
evyxroMs7S+nMvhtr1lhrRzNaC3iW9OIskS9zNjKUd2Becj5+Bt1JHmlqu3Is9H67kySd
HeF1XTMVWHDo30n9msA1vB7Bqo1w26qzV3S97vbhrApQtYJAn0bIilVIAEasIYIbqrkTQ
/kmDO4uMpCDgZKta7bP+P3CjBrGmK1w98 remote_ssh_user@device
1
Use the ssh-keygen utility of the OpenSSH software suite to generate a private and public key pair as
show below:
#ssh-keygen -t rsa -C remote_ssh_user@device
2
Save the private key on the client device.
3
Copy the the public key to the switch in the preferred directory. Including the user id as part of the file-
name can help identify the different keys:
#scp ~/.ssh/new_ssh_user_rsa.pub admin@192.168.2.1:/flash/system
4
Verify that the userid that will use SSH is a valid user name on the OmniSwitch. If the username does
not already exist on the switch create the user name with the appropriate privileges.
5
Install the public key on the OmniSwitch for the specified user.
-> installsshkey new_ssh_user /flash/system/new_ssh_user_rsa.pub
page 1-12 OmniSwitch AOS Release 7 Switch Management Guide
Logging Into the Switch
March 2011