Enabling The Ssh Server Function; Configuring The User Interfaces For Ssh Clients - H3C S5500-EI Series Security Configuration Manual

Configuration guidelines
To support SSH clients that use different types of key pairs, generate both DSA and RSA key pairs
•
on the SSH server.
• When an SSH user logs in to the switch, RSA key pairs can be automatically generated if no local
DSA or RSA key pairs are configured on the switch.
The public-key local create rsa command generates a server RSA key pair and a host RSA key pair.
•
Each of the key pairs consists of a public key and a private key. The public key in the server key pair
of the SSH server is used in SSH1 to encrypt the session key for secure transmission of the key. As
SSH2.0 uses the DH algorithm to generate the session key on the SSH server and client, no session
key transmission is required in SSH2.0 and the server key pair is not used.
The public-key local create dsa command generates only the host key pair. SSH1 does not support
•
the DSA algorithm.
For more information about the public-key local create command, see Security Command
•
Reference.
Configuration procedure
To generate DSA or RSA key pairs on the SSH server:
Step
1. Enter system view.
2. Generate DSA or RSA key
pairs.

Enabling the SSH server function

Step
1. Enter system view.
2. Enable the SSH server
function.
NOTE:
When the device acts as an SCP server, only one SCP user is allowed to access to the SCP server at one
time.

Configuring the user interfaces for SSH clients

An SSH client accesses the switch through a VTY user interface. You must configure the user interfaces for
SSH clients to allow SSH login. The configuration takes effect only for clients that log in after the
configuration.
Configuration guidelines
If you configure a user interface to support SSH, be sure to configure the corresponding
•
authentication mode with the authentication-mode scheme command.
• For a user interface configured to support SSH, you cannot change the authentication mode. To
change the authentication mode, undo the SSH support configuration first.
Command
system-view
public-key local create { dsa | rsa }
Command
system-view
ssh server enable
318
Remarks
N/A
By default, neither DSA nor RSA
key pairs exist.
Remarks
N/A
Disabled by default