H3C S7500 Series Operation Manual page 827

Operation Manual – SSH Terminal Service
H3C S7500 Series Ethernet Switches
When the two commands are configured simultaneously, and the authentication
types configured for the user (specified by username) are different from each other,
comply with the configuration of the ssh user username authentication-type
command.
Caution:
If the RSA authentication type is specified, then the RSA public key of the client user
must be configured on the switch.
For the password-publickey authentication type: SSH1 client users can access
the switch as long as they pass one of the two authentications. SSH2 client users
can access the switch only when they pass both the authentications.
For the password authentication, the username argument should be consistent
with the effective user name defined in AAA; for the RSA authentication, the
username argument is the local SSH user name, so that there is no need to
configure a local user in AAA.
V. Configuring SSH attributes for the server
Configuring SSH authentication timeout time, retry times, server key update interval
and SSH compatible mode for the server can effectively assure security of SSH
connections by avoiding illegal actions such as malicious password guessing.
Table 1-6 Configure SSH attributes for the server
To do...
Enter system view
Set SSH
authentication
timeout time
Set SSH
authentication retry
times
Set server key update
interval
Set the SSH server to
be compatible with
SSH1.x clients
Chapter 1 SSH Terminal Service Configuration
Use the command...
system-view
ssh server timeout
seconds
ssh server
authentication-retries
times
ssh server
rekey-interval hours
ssh server
compatible-ssh1x
enable
1-6
Remarks
—
Optional
The authentication timeout time
defaults to 60 seconds.
Optional
The authentication retry times
defaults to 3.
Optional
By default, the system does not
update server keys.
Optional
By default, the SSH server is
compatible with SSH1.x clients.