Configuring The Ssh Server On The Device - HP 830 Series Configuration Manual

Configuring the SSH server on the device

When scheme authentication is used, you can choose to configure the command authorization and
command accounting functions.
If command authorization is enabled, a command is available only if the user has the commensurate user
privilege level and is authorized by the AAA scheme to use the command.
Command accounting allows the HWTACACS server to record all commands executed by users,
regardless of command execution results. This function helps control and monitor user behaviors on the
device. If command accounting is enabled and command authorization is not enabled, every executed
command is recorded on the HWTACACS server. If both command accounting and command
authorization are enabled, only the authorized and executed commands are recorded on the
HWTACACS server.
Follow these guidelines when you configure the SSH server:
• To make the command authorization or command accounting function take effect, apply an
HWTACACS scheme to the intended ISP domain. This scheme must specify the IP address of the
authorization server and other authorization parameters.
If the local authentication scheme is used, use the authorization-attribute level level command in
•
local user view to set the user privilege level on the device.
If a RADIUS or HWTACACS authentication scheme is used, set the user privilege level on the
•
RADIUS or HWTACACS server.
The SSH client authentication method is password in this configuration procedure. For more information
about SSH and publickey authentication, see Security Configuration Guide.
To configure the SSH server on the device:
Step
1. Enter system view.
2. Create local key pairs.
3. Enable SSH server.
4. Enter one or multiple VTY user
interface views.
5. Enable scheme
authentication.
6. Enable the user interfaces to
support Telnet, SSH, or both.
7. Enable command
authorization.
Command
system-view
public-key local create { ecdsa |
rsa }
ssh server enable
user-interface vty first-number
[ last-number ]
authentication-mode scheme
protocol inbound { all | ssh |
telnet }
command authorization
38
Remarks
N/A
By default, no local key pairs are
created.
By default, SSH server is disabled.
N/A
By default, password
authentication is enabled on VTY
user interfaces.
Optional.
By default, both Telnet and SSH
are supported.
Optional.
By default, command authorization
is disabled. The commands
available for a user only depend
on the user privilege level.