Configuring The Ssh Management Parameters - HPE FlexNetwork 10500 Series Security Configuration Manual

Configuration procedure
To configure an SSH user, and specify the service type and authentication method:
Step
1. Enter system view.
2. Create an SSH user, and
specify the service type and
authentication method.

Configuring the SSH management parameters

Step
1. Enter system view.
2. Enable the SSH server to
support SSH1 clients.
3. Set the minimum interval for
updating the RSA server key
pair.
4. Set the SSH user
authentication timeout timer.
5. Set the maximum number of
SSH authentication
attempts.
6. Specify an SSL login control
ACL to control SSH user
connections.
Command
system-view
•
In non-FIPS mode:
ssh user username service-type { all | netconf | scp | sftp |
stelnet } authentication-type { password | { any |
password-publickey | publickey } [ assign { pki-domain
domain-name | publickey keyname } ] }
•
In FIPS mode:
ssh user username service-type { all | netconf | scp | sftp |
stelnet } authentication-type { password |
password-publickey [ assign { pki-domain domain-name |
publickey keyname } ] }
Command
system-view
ssh server compatible-ssh1x
enable
ssh server rekey-interval
interval
ssh server
authentication-timeout
time-out-value
ssh server
authentication-retries retries
•
Control IPv4 SSH user
connections:
ssh server acl
{ advanced-acl-number |
basic-acl-number | mac
mac-acl-number }
•
Control IPv6 SSH user
connections:
ssh server ipv6 acl { ipv6
{ advanced-acl-number |
basic-acl-number } | mac
mac-acl-number }
407
Remarks
N/A
By default, the SSH server does
not support SSH1 clients.
This command is not available in
FIPS mode.
By default, the RSA server key
pair is not updated.
This command takes effect only
on SSH1 users.
This command is not available in
FIPS mode.
The default setting is 60 seconds.
If a user does not finish the
authentication when the timeout
timer expires, the connection
cannot be established.
The default setting is 3.
If the authentication method is
any, the total number of publickey
authentication attempts and
password authentication attempts
cannot exceed the upper limit.
By default, no ACLs are specified
and all SSH users can initiate
SSH connections to the server.