Security Concerns; Before You Configure Ssh; Ssh Configuration Tasks - Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - SYSTEM BASICS CONFIGURATION GUIDE 2010-10-04 Configuration Manual

JunosE 11.3.x System Basics Configuration Guide

Security Concerns

Before You Configure SSH

SSH Configuration Tasks

424
You might be concerned about security with the current support of SSH for the following
reasons:
Only RADIUS and TACACS+ user authentication methods are supported. If you disable
user authentication, all users are accepted if the client and server successfully complete
negotiation.
Because the load on the system CPU increases with use of SSH, you might be concerned
about denial-of-service attacks. However, the forwarding engine takes care of this
issue, because it limits the rate at which it sends packets to the system controller. A
flood of packets from a packet generator does not cause problems regardless of
whether SSH is enabled.
You must obtain and install a commercial SSH client on the host from which you want
to administer the system. Versions earlier than 2.0.12 of the SSH client are not supported.
Determine your Telnet policy before you configure SSH on your system. Effective use of
SSH implies that you should severely limit Telnet access to the system. To limit Telnet
access, create access control lists that prevent almost all Telnet usage, permitting only
trusted administrators to access the system through Telnet. For example, you might limit
access to administrators who need to Telnet to the system from a remote host that does
not have the SSH client installed.
You must install and configure a RADIUS server on a host machine before you configure
SSH on your router. Refer to your RADIUS server documentation for information about
choosing a host machine and installing the server software. You must also configure the
RADIUS client on your router. See JunosE Broadband Access Configuration Guide for more
information.
You configure SSH on individual virtual routers, rather than on the global system. To
configure SSH:
Access the context of the virtual router.
1.
Configure encryption.(Optional)
2.
Configure user authentication, including connection parameters.
3.
Configure message authentication.(Optional)
4.
Enable SSH.
5.
Display SSH to verify configuration.
6.
Copyright © 2010, Juniper Networks, Inc.