Setting The Ssh Management Parameters - HP FlexFabric 5930 Series Security Configuration Manual

If the authentication method is password, the user role is authorized by the remote AAA server
or the local device.
If the authentication method is publickey or password-publickey, the user role is specified by
the authorization-attribute command in the associated local user view.
If you change the authentication method or public key for an SSH user that has been logged in, the
•
change can take effect only on the user at next login.
Except password authentication, the other authentication methods require a client's host public key
•
or digital certificate to be specified.
If a client directly sends the user's public key information to the server, you must specify the
client's public key on the server and the specified public key must already exist. For more
information about public keys, see
If a client sends the user's public key information to the server through a digital certificate, you
must specify the PKI domain for verifying the client certificate on the server. To make sure the
authorized SSH users can pass the authentication, the specified PKI domain must have the
correct CA certificate. For more information about configuring a PKI domain, see
PKI."
For information about configuring local users and remote authentication, see
•
Configuration procedure
To configure an SSH user, and specify the service type and authentication method:
Step
1. Enter system view.
2. Create an SSH user, and
specify the service type and
authentication method.

Setting the SSH management parameters

Setting the SSH management parameters can improve the security of SSH connections. The SSH
management parameters include:
• Whether the SSH server is compatible with SSH1 clients.
RSA server key pair update interval, applicable to users using SSH1 clients.
•
SSH user authentication timeout period. You can set this parameter to reject a connection if the
•
authentication for the connection has not been finished when the timeout period expires.
• Maximum number of SSH authentication attempts. You can set this parameter to prevent malicious
password cracking. If the authentication method is any, the total number of both publickey and
password authentication attempts cannot exceed the configured upper limit.
ACL for SSH clients. You can configure an ACL to filter SSH clients which initiate connections with
•
the SSH server.
• DSCP value in the packets that are sent by the SSH server. This field determines the transmission
priority of the packet.
SFTP connection idle timeout period. When the idle period of an SFTP connection exceeds the
•
specified threshold, the system automatically tears the connection down.
"Configuring a client's host public
Command
system-view
ssh user username service-type { all | scp | sftp | stelnet }
authentication-type { password | { any | password-publickey |
publickey } assign { pki-domain domain-name | publickey keyname } }
109
key."
"Configuring
"Configuring AAA."