H3C S3100 Series Operation Manual page 746

Configuration procedure
Under the publickey authentication mode, either the RSA or DSA public key can be generated for the
server to authenticate the client. Here takes the RSA public key as an example.
Configure the SSH server
# Create a VLAN interface on the switch and assign an IP address, which the SSH client will use as the
destination for SSH connection.
<Switch> system-view
[Switch] interface vlan-interface 1
[Switch-Vlan-interface1] ip address 192.168.0.1 255.255.255.0
[Switch-Vlan-interface1] quit
Generating the RSA and DSA key pairs on the server is prerequisite to SSH login.
# Generate RSA and DSA key pairs.
[Switch] public-key local create rsa
[Switch] public-key local create dsa
# Set the authentication mode for the user interfaces to AAA.
[Switch] user-interface vty 0 4
[Switch-ui-vty0-4] authentication-mode scheme
# Enable the user interfaces to support SSH.
[Switch-ui-vty0-4] protocol inbound ssh
# Set the client's command privilege level to 3
[Switch-ui-vty0-4] user privilege level 3
[Switch-ui-vty0-4] quit
# Configure the authentication type of the SSH client named client 001 as publickey.
[Switch] ssh user client001 authentication-type publickey
Before performing the following steps, you must generate an RSA public key pair (using the client
software) on the client, save the key pair in a file named public, and then upload the file to the SSH
server through FTP or TFTP. For details, refer to Configuring the SSH Client.
1-32