Huawei AR1200 Series User Configuration Manual page 197

Huawei AR1200 Series Enterprise Routers
Configuration Guide - Basic Configuration
[Huawei-rsa-key-code] 1D7E3E1B
[Huawei-rsa-key-code] 0203
[Huawei-rsa-key-code] 010001
[Huawei-rsa-key-code] public-key-code end
[Huawei-rsa-public-key] peer-public-key end
Step 3 Create SSH users.
Create users ssh1@ssh.com and ssh2@ssh.com on the RADIUS server. Specify the NAS's IP
address 10.164.39.222 and set the password to huawei. The NAS's IP address is the IP address
of the SSH server connected to the RADIUS server.
# Configure VTY user interfaces on the SSH server.
[Huawei] user-interface vty 0 4
[Huawei-ui-vty0-4] authentication-mode aaa
[Huawei-ui-vty0-4] protocol inbound ssh
[Huawei-ui-vty0-4] quit
# Create users ssh1@ssh.com and ssh2@ssh.com on the SSH server and set the authentication
mode.
[Huawei] aaa
[Huawei-aaa] local-user ssh1@ssh.com password cipher huawei
[Huawei-aaa] local-user ssh1@ssh.com service-type ssh
[Huawei-aaa] local-user ssh2@ssh.com password cipher huawei
[Huawei-aaa] local-user ssh2@ssh.com service-type ssh
[Huawei-aaa] local-user ssh2@ssh.com ftp-directory flash:
[Huawei-aaa]
[Huawei-aaa] quit
[Huawei] ssh user ssh1@ssh.com authentication-type password
[Huawei] ssh user ssh2@ssh.com authentication-type rsa
[Huawei] ssh user ssh2@ssh.com assign rsa-key RsaKey001
Step 4 Configure a RADIUS server template.
# Configure an authentication scheme newscheme and set the authentication mode to RADIUS
authentication.
[Huawei] aaa
[Huawei-aaa] authentication-scheme newscheme
[Huawei-aaa-authen-newscheme] authentication-mode radius
[Huawei-aaa-authen-newscheme] quit
# Configure a RADIUS server template ssh on the SSH server.
[Huawei] radius-server template ssh
# Specify the RADIUS server at 10.164.6.49 as the RADIUS authentication and set the
authentication port number to 1812.
[Huawei-radius-ssh] radius-server authentication 10.164.6.49 1812
# Set the shared key of the RADIUS server to huawei.
[Huawei-radius-ssh] radius-server shared-key cipher huawei
[Huawei-radius-ssh] quit
Step 5 Configure the RADIUS domain name on the SSH server.
# Set the RADIUS domain name to ssh.com and apply the authentication scheme newscheme
and RADIUS server template ssh to the RADIUS domain.
[Huawei] aaa
[Huawei-aaa] domain ssh.com
[Huawei-aaa-domain-ssh.com] authentication-scheme newscheme
[Huawei-aaa-domain-ssh.com] radius-server ssh
[Huawei-aaa-domain-ssh.com] quit
Issue 04 (2012-05-15) Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
8 Accessing Another Device
185