Generating Local Key Pairs; Specifying The Source Ip Address For Sftp Packets; Establishing A Connection To An Sftp Server - HPE FlexNetwork 10500 Series Security Configuration Manual

Generating local key pairs

Generate local key pairs on the SFTP client when the SFTP server uses the authentication method
publickey, password-publickey, or any.
Configuration restrictions and guidelines
When you generate local key pairs on an SFTP client, follow these restrictions and guidelines:
•
Local DSA, ECDSA, and RSA key pairs for SSH use default names. You cannot assign names
to the key pairs.
•
The SFTP client operating in FIPS mode supports only ECDSA and RSA key pairs.
•
The key modulus length must be less than 2048 bits when you generate a DSA key pair.
Configuration procedure
To generate local key pairs on the SFTP client:
Step
1. Enter system view.
2. Generate local key pairs.

Specifying the source IP address for SFTP packets

As a best practice, specify the IP address of the loopback interface as the source address of SFTP
packets for the following purposes:
•
Ensuring the communication between the SFTP client and the SFTP server.
•
Improving the manageability of SFTP clients in authentication service.
To specify the source IP address for SFTP packets:
Step
1. Enter system view.
2. Specify the source
address for SFTP
packets.

Establishing a connection to an SFTP server

When you try to access an SFTP server, the device must use the server's host public key to
authenticate the server. If the server's host public key is not configured on the device, the device will
notify you to confirm whether to continue with the access.
Command
system-view
public-key local create { dsa |
ecdsa { secp256r1 | secp384r1 }
| rsa }
Command
system-view
•
Specify the source IPv4 address
for SFTP packets:
sftp client source { ip ip-address
| interface interface-type
interface-number }
•
Specify the source IPv6 address
for SFTP packets:
sftp client ipv6 source { ipv6
ipv6-address | interface
interface-type interface-number }
414
Remarks
N/A
By default, no local key pairs exist
on an SFTP client.
Remarks
N/A
By default, the source IP address
for SFTP packets is not
configured. For IPv4 SFTP
packets, the device uses the
primary IPv4 address of the
output interface specified in the
routing entry as the source
address of the packets. For IPv6
SFTP packets, the device
automatically selects an IPv6
address as the source address of
the packets in compliance with
RFC 3484.