Using Secure Shell - IBM RackSwitch G8000 Application Manual

Using Secure Shell

26
RackSwitch G8000: Application Guide
Once the switch is configured with an IP address and gateway, you can use Telnet
to access switch administration from any workstation connected to the management
network.
To establish a Telnet connection with the switch, run the Telnet program on your
workstation and issue the following Telnet command:
telnet <switch IPv4 or IPv6 address>
You will then be prompted to enter a password as explained
on page 33.
Although a remote network administrator can manage the configuration of a G8000
via Telnet, this method does not provide a secure connection. The Secure Shell
(SSH) protocol enables you to securely log into another device over a network to
execute commands remotely. As a secure alternative to using Telnet to manage
switch configuration, SSH ensures that all data sent over the network is encrypted
and secure.
The switch can do only one session of key/cipher generation at a time. Thus, a
SSH/SCP client will not be able to login if the switch is doing key generation at that
time. Similarly, the system will fail to do the key generation if a SSH/SCP client is
logging in at that time.
The supported SSH encryption and authentication methods are:
• Server Host Authentication: Client RSA-authenticates the switch when starting
each connection
• Key Exchange: RSA
• Encryption: 3DES-CBC, DES
• User Authentication: Local password authentication, RADIUS, TACACS+
IBM Networking OS implements the SSH version 2.0 standard and is confirmed to
work with SSH version 2.0-compliant clients such as the following:
• OpenSSH_5.4p1 for Linux
• Secure CRT Version 5.0.2 (build 1021)
• Putty SSH release 0.60
Using SSH to Access the Switch
By default, the SSH feature is disabled. Once the IP parameters are configured and
the SSH service is enabled, you can access the command line interface using an
SSH connection.
To establish an SSH connection with the switch, run the SSH program on your
workstation by issuing the SSH command, followed by the switch IPv4 or IPv6
address:
# ssh <switch IP address>
If SecurID authentication is required, use the following command:
# ssh -1 ace <switch IP address>
You will then be prompted to enter a password as explained
on page 33.
"Switch Login Levels"
"Switch Login Levels"