H3C S5100-SI Operation Manual page 603

With first-time authentication enabled, an SSH client that is not configured with the SSH server's host
public key saves the host public key sent by the server without authenticating the server. Attackers may
exploit the vulnerability to initiate man-in-middle attacks by acting as an SSH server. Therefore, it is
recommended to disable first-time authentication unless you are sure that the SSH server is reliable.
Specifying a source IP address/interface for the SSH client
You can configure a souce IP address or the souce IP address by specifying the corresponding
interface for the client to use to access the SSH server. This improves the service manageability when
the SSH client has multiple IP addresses and interfaces
Table 1-16 Follow these steps to specify a source IP address/interface for the SSH client:
To do...
Enter system view
Specify a source IP address for
the SSH client
Specify a source interface for
the SSH client
Establishing the connection between the SSH client and server
The client's method of establishing an SSH connection to the SSH server varies with authentication
types.
Table 1-17 Follow these steps to establish an SSH connection:
To do...
Enter system view
Start the client to establish a
connection with an SSH server
Use the command...
system-view
ssh2 source-ip ip-address
ssh2 source-interface
interface-type interface-number
Use the command...
system-view
ssh2 { host-ip | host-name }
[ port-num ] [ identity-key { dsa
| rsa } | prefer_kex
{ dh_group1 |
dh_exchange_group } |
prefer_ctos_cipher { des |
aes128 } | prefer_stoc_cipher
{ des | aes128 } |
prefer_ctos_hmac { sha1 |
sha1_96 | md5 | md5_96 } |
prefer_stoc_hmac { sha1 |
sha1_96 | md5 | md5_96 } ] *
1-22
Remarks
—
Optional
By default, no source IP
address is configured.
Optional
By default, no source interface
is configured.
Remarks
—
Required
In this command, you can also
specify the preferred key
exchange algorithm, encryption
algorithms and HMAC
algorithms between the server
and client.
HMAC: Hash-based message
authentication code
Note that:
The identity-key keyword is
unnecessary in password
authentication and optional in
public key authentication.