3Com Switch 7700 Configuration Manual page 380

372 C 11: S
HAPTER YSTEM
M
ANAGEMENT
Figure 9 Setting up SSH channels in LAN
3
1 Switch running SSH server
2 PC running SSH client
3 Ethernet LAN
In Figure 9, the VLAN for the Ethernet port must be configured with VLAN
interfaces and IP address.
The communication process between the server and client includes the following
five stages:
Version negotiation: The client sends the TCP connection requirement to the
■
server. When the TCP connection is established, both ends begin to negotiate
the SSH version. If they can work together, they enter the key algorithm
negotiation stage. Otherwise, the server clears the TCP connection.
Key negotiation: Both ends negotiate the key algorithm and compute session
■
key. The server randomly generates its RSA key and sends the public key to the
client. The client figures out the session key based on the public key from the
server and the random number generated locally. The client encrypts the
random number with the public key from the server and returns the result to
the server. The server then decrypts the received data with the server private
key to get the client random number. It then uses the same algorithm to work
out the session key based on server public key and the returned random
number. Then both ends get the same key without data transfer over the
network, while the key is used at both ends for encryption and description.
Authentication: The server authenticates the user at the client after obtaining
■
a session key. The client sends its username to the server. If the username has
been created and configured with no authentication, the authentication stage
is omitted for this user. Otherwise, the authentication process continues.
SSH supports two authentication types: password authentication and RSA
authentication. During password authentication, the server compares the
username and the password received with the username and password
configured locally. The user is allowed to log on to the switch if the usernames
and passwords match.
During RSA authentication, the RSA public key of the client user is configured
at the server. The client first sends the member modules of its RSA public key to
the server, which checks its validity. If it is valid, the server generates a random
number, which is sent to the client after being encrypted with RSA public key.
Both ends calculate authentication data based on the random number and
session ID. The client returns the calculated authentication data to the server,
1
2