Cisco 350 Series Administration Manual page 573

Security: SSH Client
Overview
Cisco 350, 350X and 550X Series Managed Switches, Firmware Release 2.4, ver 0.4
- If a matching IP address/host name is found, but there is no matching fingerprint,
the search continues. If no matching fingerprint is found, the search is completed
and authentication fails.
- If no matching IP address/host name is found, the search is completed and
authentication fails.
• If the entry for the SSH server is not found in the list of trusted servers, the process
fails.
In order to support auto configuration of an out-of-box device (device with factory default
configuration), SSH server authentication is disabled by default.
SSH User Authentication
When a device (SSH client) attempts to establish a SSH session to a SSH server, the SSH
server uses various methods for client authentication. These are described below.
Passwords
To use the password method, first ensure that a username/password has been established on
the SSH server. This is not done through the device's management system, although, after a
username has been established on the server, the server password can be changed through the
device's management system.
The username/password must then be created on the device. When the device tries to establish
a SSH session to a SSH server, the username/password supplied by the device must match the
username/password on the server.
Data can be encrypted using a one-time symmetric key negotiated during the session.
Each device being managed must have its own username/password, although the same
username/password can be used for multiple switches.
The password method is the default method on the device.
Public/Private Keys
To use the public/private key method for client authentication by a SSH server, create a user
and generate/import a public/private key pair on the device which is a SSH client. Then
create the same user at the SSH server and copy the public key (or fingerprint) generated/
entered at the SSH client to the SSH server. The action of creating the user and copy the
public key (or fingerprint) to the SSH server is beyond the scope of this guide.
21
387