Table of Contents
Advertisement
When the client authenticates the server's host key, it begins the transport key
exchange process by sending the key data required by the negotiated set of
algorithms. The server responds by sending its own key data set. If both sides agree
that the keys are consistent and authentic, the keys are applied so that all subsequent
messages between client and server are encrypted, authenticated, and compressed
according to the negotiated algorithms.
User Authentication
User authentication begins after the transport keys are applied. The client typically
asks the server which authentication methods it supports. The server responds with
a list of supported methods with no preference.
The system software currently supports RADIUS and TACACS+ password
authentication. RADIUS authentication is enabled by default. Based on the
authentication protocol that a user enables, the RADIUS or TACACS+ server validates
the username and password from its database. If user authentication is disabled,
then all SSH clients that pass protocol negotiation are accepted.
Connection
The SSH connection layer creates the user session when the user is authenticated.
The server waits for a connection request. The router currently supports only shell
requests, which the server interprets as a request for entry into a CLI session. The
server ignores any other requests, such as X11 or TCP/IP tunneling.
Key Management
The E Series router implementation of SSH provides for management of user keys
and host keys.
User Key Management
Key administration is still under development for the server environment.
Host Key Management
You create a host key for the SSH server with the crypto key generate dss command.
If a host key already exists, this command replaces it with a new key and terminates
all ongoing SSH sessions. Any SSH clients that previously accepted the old host key
reject the new key the next time the client and server connect. The client then
typically instructs the end user to delete the locally cached host key and to try to
connect again.
CAUTION: Use caution issuing the crypto key generate dss command from an SSH
client. Issuing this command will terminate that SSH session; it will be the last
command you send from that session.
Chapter 7: Passwords and Security
Secure System Administration with SSH
437
Advertisement
Table of Contents
Troubleshooting
