H3C S5500-EI Series Security Configuration Manual page 16

Setting the SSH management parameters ········································································································ 321
Setting the DSCP value for packets sent by the SSH server ············································································ 322
Configuring the switch as an SSH client ··················································································································· 322
SSH client configuration task list ························································································································ 322
Specifying a source IP address/interface for the SSH client ·········································································· 323
Configuring whether first-time authentication is supported ············································································· 323
Establishing a connection between the SSH client and server ······································································· 324
Setting the DSCP value for packets sent by the SSH client ············································································· 325
Displaying and maintaining SSH ······························································································································· 325
SSH server configuration examples ··························································································································· 326
When the switch acts as a server for password authentication ····································································· 326
When the switch acts as a server for publickey authentication ····································································· 328
SSH client configuration examples ····························································································································· 333
When switch acts as client for password authentication ················································································ 333
When switch acts as client for publickey authentication ················································································ 336
Configuring SFTP ····················································································································································· 339
Overview ······································································································································································· 339
FIPS compliance ··························································································································································· 339
Configuring the switch as an SFTP server ················································································································· 339
Enabling the SFTP server ···································································································································· 339
Configuring the SFTP connection idle timeout period ····················································································· 340
Configuring the switch as an SFTP client ··················································································································· 340
Specifying a source IP address or interface for the SFTP client ······································································ 340
Establishing a connection to the SFTP server ···································································································· 340
Working with SFTP directories ··························································································································· 341
Working with SFTP files ······································································································································ 342
Displaying help information ······························································································································· 343
Terminating the connection to the remote SFTP server ···················································································· 343
Setting the DSCP value for packets sent by the SFTP client ············································································ 343
SFTP client configuration example ····························································································································· 344
SFTP server configuration example ···························································································································· 347
Configuring SCP ······················································································································································ 350
Overview ······································································································································································· 350
FIPS compliance ··························································································································································· 350
Configuring the switch as an SCP server ·················································································································· 350
Configuring the switch as the SCP client ··················································································································· 351
SCP client configuration example ······················································································································ 352
SCP server configuration example ···················································································································· 353
Configuring SSL ······················································································································································· 355
Overview ······································································································································································· 355
SSL security mechanism ······································································································································ 355
SSL protocol stack ··············································································································································· 355
FIPS compliance ··························································································································································· 356
Configuration task list ·················································································································································· 356
Configuring an SSL server policy ······························································································································· 356
SSL server policy configuration example ·········································································································· 358
Configuring an SSL client policy ································································································································ 360
Displaying and maintaining SSL ································································································································· 360
Troubleshooting SSL ····················································································································································· 361
Configuring TCP attack protection ························································································································· 362
Overview ······································································································································································· 362
Enabling the SYN Cookie feature ······························································································································ 362
viii