H3C H3C S3600 Series Bedienungsanleitung

Operation Manual – SSH Terminal Service

H3C S3600 Series Ethernet Switches-Release 1510 Table of Contents

Table of Contents

Chapter 1 SSH Terminal Service..................................................................................................1-1

1.1 SSH Terminal Service .......................................................................................................1-1

1.1.1 Introduction to SSH.................................................................................................1-1

1.1.2 SSH Server Configuration.......................................................................................1-3

1.1.3 Configuring the SSH Client................................................................................... 1-11

1.1.4 Configuring the Device as an SSH Client............................................................. 1-19

1.1.5 Displaying SSH Configuration...............................................................................1-21

1.1.6 SSH Server Configuration Example...................................................................... 1-22

1.1.7 SSH Client Configuration Example.......................................................................1-25

Chapter 2 SFTP Service................................................................................................................ 2-1

2.1 SFTP Service.....................................................................................................................2-1

2.1.1 Introduction to SFTP...............................................................................................2-1

2.1.2 SFTP Server Configuration.....................................................................................2-1

2.1.3 SFTP Client Configuration ...................................................................................... 2-2

2.1.4 SFTP Configuration Example..................................................................................2-6

Operation Manual – SSH Terminal Service

H3C S3600 Series Ethernet Switches-Release 1510 Chapter 1 SSH Terminal Service

1-1

Chapter 1 SSH Terminal Service

1.1 SSH Terminal Service

1.1.1 Introduction to SSH

Secure shell (SSH) provides secure communication and powerful authentication for

remote user login to a switch over an insecure network, thus preventing assaults such

as IP address spoofing, plain-text password interception.

Acting as an SSH server, a switch allows for the connections of multiple SSH clients.

Through SSH Client, a user can establish a connection to a switch or UNIX host

running SSH Server.

Figure 1-1 and Figure 1-2 shows two ways to establish SSH connection between client

and server.

zEstablishing SSH connection through a LAN

100BASE-TX

Server

Ethernet

Workstation

Laptop

SSH

Switch

SSH

100BASE-TX

Server

Ethernet

Workstation

Laptop

SSH Client

Switch

SSH Server

100BASE-TX

Server

Ethernet

Workstation

Laptop

SSH

Switch

SSH

100BASE-TX

Server

100BASE-TX

Server

Ethernet

Workstation

Laptop

SSH

Switch

SSH

100BASE-TX

Server

Ethernet

Workstation

Laptop

SSH Client

Switch

SSH Server

Figure 1-1 Establish SSH connection through a LAN

zEstablishing SSH connection through a WAN

Operation Manual – SSH Terminal Service

H3C S3600 Series Ethernet Switches-Release 1510 Chapter 1 SSH Terminal Service

1-2

Local switch

Local Ethernet

WANServer PC

SSH

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

Workstation

Rem

Remote sw itch

SSH ote Ethernet

Server

WANServer PC

SSH

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

Workstation

Rem

SSH ote Ethernet

Server

Local switch

Local Ethernet

WANServer PC

SSH

Laptop

Local switch

Local Ethernet

WANServer PC

SSH

Laptop

Workstation

Remote Ethernet

Server

WAN

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

Server PC

SSH

Laptop

Workstation

Rem

Remote sw itch

SSH ote Ethernet

Server

WANServer PC

SSH

Workstation

Rem

Remote sw itch

SSH ote Ethernet

Server

WANServer PC

SSH

Laptop

Workstation

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

WANServer PC

SSH Client

Laptop

Workstation

Rem

SSH Server ote Ethernet

Server

Local switch

Local Ethernet

WANServer PC

SSH

Laptop

Local switch

Local Ethernet

WANServer PC

SSH

Laptop

Workstation

Remote Ethernet

Server

WAN

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

Server PC

SSH

Laptop

Workstation

Rem

Remote sw itch

SSH ote Ethernet

Server

WANServer PC

SSH

Workstation

Rem

Remote sw itch

SSH ote Ethernet

Server

WANServer PC

SSH

Laptop

Workstation

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

Workstation

Rem

SSH ote Ethernet

Server

Local switch

Local Ethernet

WANServer PC

SSH

Laptop

Local switch

Local Ethernet

WANServer PC

SSH

Laptop

Workstation

Remote Ethernet

Server

WAN

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

Server PC

SSH

Laptop

Workstation

Rem

Remote sw itch

SSH ote Ethernet

Server

WANServer PC

SSH

Workstation

Rem

Remote sw itch

SSH ote Ethernet

Server

WANServer PC

SSH

Laptop

Workstation

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

WANServer PC

SSH Client

Laptop

Workstation

Rem

SSH Server ote Ethernet

Server

Figure 1-2 Establish SSH connection through a WAN

Note:

At present, the device supports two SSH versions: SSH2 and SSH1. Unless otherwise

noted, SSH refers to SSH2 throughout this document.

The communication process between a SSH client and server goes through the

following five stages.

1) Version negotiation stage:

zThe client sends a TCP connection request to the server.

zWhen a TCP connection is established, the two ends begin to negotiate an SSH

version.

zIf they get a successful negotiation, they go to the key negotiation stage.

Otherwise the server terminates the TCP connection.

2) Key and algorithm negotiation stage:

zThe server and the client send key algorithm negotiation packets to each other,

which include the supported server-side public key algorithm list, encryption

algorithm list, MAC algorithm list, and compression algorithm list.

zBased on the received algorithm negotiation packets, the server and the client

figure out the algorithms to be used.

zThe server and the client use the DH key exchange algorithm and parameters

such as the host key pair to generate the session key and session ID.

Operation Manual – SSH Terminal Service

H3C S3600 Series Ethernet Switches-Release 1510 Chapter 1 SSH Terminal Service

1-3

Through the above steps, the server and the client get the same session key, which is

to be used to encrypt and decrypt data exchanged between the server and the client

later. The server and the client use session ID in the authentication stage.

3) Authentication negotiation stage:

zThe client sends its username information to the server.

zThe server starts to authenticate the user. If the user is configured as having no

authentication on the server, the following step is skipped and the session request

stage starts directly.

zThe server authenticates the user in some way (see the following note), till the

authentication succeeds or the connection is terminated due to authentication

timeout.

Note:

SSH provides two kinds of authentication: password authentication and RSA

authentication.

(1) Password authentication works as follows:

zThe client sends the username and password to the server.

zThe server compares the received username and password against those

configured locally. The user passes the authentication if the server finds a match for

both username and password.

(2) RSA authentication works as follows:

zConfigure the RSA public key of the client at the server.

zThe client sends the member module of its RSA public key to the server.

zThe server checks the validity of the member module. If it is valid, the server

generates a random number, which is sent to the client after being encrypted with

RSA public key of the client.

zBoth the server and the client calculate authentication data by using the random

number and session ID.

zThe client sends the authentication data it calculates to the server.

zThe server compares the received authentication data with the authentication data

on itself. If they are identical, the authentication succeeds.

4) Session request stage. The client sends a session request to the server, which

processes the request and establish a session.

5) Interactive session stage. Both ends exchange data till the session ends.

1.1.2 SSH Server Configuration

The following table describes SSH Server configuration tasks.

Operation Manual – SSH Terminal Service

H3C S3600 Series Ethernet Switches-Release 1510 Chapter 1 SSH Terminal Service

1-4

Table 1-1 SSH2.0 Server configuration tasks

Operation Command Related section

Configure user interface(s) to

support specified protocol(s) protocol inbound

Section “Configuring

user interface(s) to

support specified

protocol(s)"

Generate local RSA key pairs rsa local-key-pair create

Destroy local RSAkey pairs rsa local-key-pair

destroy

Section “Generating

or destroying local

RSA key pairs"

Create an SSH user ssh user username Section “Create an

SSH user”

Specify a default

authentication type for SSH

users

ssh authentication-type

default

Configure authentication type

for an SSH user ssh user username

authentication-type

Section”Configuring

authentication type for

a user"

Set SSH authentication

timeout time ssh server timeout

Set SSH authentication retry

times ssh server

authentication-retries

Set server key update interval ssh server

rekey-interval

Configure SSH server to be

compatible with SSH1.x

clients

ssh server

compatible-ssh1x

enable

Section “Configuring

SSH management

Configure a client public key

for an SSH user ssh user username

assign rsa-key keyname

Section “Configuring a

client public key for a

user"

I. Configuring user interface(s) to support specified protocol(s)

Table 1-2 Configure user interface(s) to support specified protocol(s)

Operation Command Description

Enter system view system-view —

Enter the view of one or

multiple user interfaces

user-interface

[ type-keyword ] number

[ ending-number ]Required

Set the login

authentication method

authentication-mode

scheme

[ command-authorizatio

Required

Operation Manual – SSH Terminal Service

H3C S3600 Series Ethernet Switches-Release 1510 Chapter 1 SSH Terminal Service

1-5

Operation Command Description

Configure the user

interface(s) to support

specified protocol(s)

protocol inbound {all

|ssh |telnet }

Optional

By default, both Telnet

and SSH are supported.

Caution:

zIf you have configured a user interface to support SSH protocol, to ensure a

successful login to the user interface, you must configure AAA authentication for the

user interface by using the authentication-mode scheme command.

zFor a user interface, if you have executed the authentication-mode password or

authentication-mode none command, the protocol inbound ssh command

cannot be executed; if you have executed the protocol inbound ssh command,

neither of the authentication-mode password and authentication-mode none

commands can be executed.

II. Generating or destroying local RSA key pairs

This configuration task is used to generate or destroy the server's RSAkey pairs, which

are named in the format of switch name plus "_Host", and switch name plus "_Server",

for example, H3C_Host and H3C_Server.

After you issue the rsa local-key-pair create command, the system prompts you to

input a key length.

zIn SSH1.x, the key length is in the range of 512 to 2,048 (bits).

zIn SSH2.0, the key length is in the range of 1024 to 2048 (bits). To keep

compatible with SSH1.x, SSH2.0 allows client keys to be 512 to 2,048 bits in

length. But the server's key length must not be shorter than 1,024 bits; otherwise,

clients cannot be authenticated.

Table 1-3 Generate or destroy local RSA key pairs

Operation Command Description

Enter system view system-view —

Generate local RSA key pairs rsa local-key-pair create Required

Destroy local RSAkey pairs rsa local-key-pair destroy Optional

Operation Manual – SSH Terminal Service

H3C S3600 Series Ethernet Switches-Release 1510 Chapter 1 SSH Terminal Service

1-6

Caution:

zFor a successful SSH login, you must first generate the RSA key pairs of the server.

zYou just need to execute the rsa local-key-pair create command once, and need

not execute the command again after the system is rebooted.

zIf you re-execute the rsa local-key-pair create command, the system will ask

whether you want to replace the original key pairs with new ones.

zFor a fabric made up of multiple devices, you need to execute the rsa

local-key-pair create command on the management device to ensure that all

devices in the fabric have the same local RSA key pairs.

Note:

After the rsa local-key-pair create command is executed, you can execute the

display rsa local-key-pair public command, which will display:

zTwo public keys (in H3C_Host and H3C_Server) if the switch works in

SSH1.x-compatible mode.

zOnly one public key (in H3C_Host) if the switch works in SSH2.0 mode.

III. Create an SSH user

Table 1-4 Create an SSH user

Operation Command Description

Enter system view system-view —

Create an SSH user ssh user username Required

For an SSH user created by using this command, if you do not specify an

authentication type by using the ssh user authentication-type command for this user,

this SSH user adopts the default authentication type. On the other hand, if the default

authentication type is not specified, you need to specify an authentication type for this

SSH user.

IV. Configuring authentication type for a user

For a new user, you must specify the authentication type. Otherwise, the user cannot

access the switch.

Operation Manual – SSH Terminal Service

H3C S3600 Series Ethernet Switches-Release 1510 Chapter 1 SSH Terminal Service

1-7

Table 1-5 Configure authentication type for a user

Operation Command Description

Enter system view system-view —

Specify a default

authentication type for

SSH users

ssh authentication-type

default {password |rsa

|password-publickey |

all }

Configure authentication

type for an SSH user

ssh user username

authentication-type

{ password |

password-publickey |

rsa| all }

At least one required;

By default, no

authentication type is

specified for an SSH user,

and the user can not

access the switch.

Note that:

zThe ssh authentication-type default command is used to configure the default

authentication type for all SSH users.

zThe ssh user username authentication-type command is used to configure an

authentication type for a specific SSH user.

zWhen both commands are configured with different authentication types, for the

specific user (user specified by the username argument), the authentication type

specified by the ssh user username authentication-type command will take

effect instead of that specified for all SSH users.

Operation Manual – SSH Terminal Service

H3C S3600 Series Ethernet Switches-Release 1510 Chapter 1 SSH Terminal Service

1-8

Caution:

zIf RSA authentication type is configured for a user, the RSA public key of the client

user must be configured on the switch.

zBy default, no authentication type is specified for a new user, and the new user

cannot access the switch.

zFor the password-publickey authentication type: SSH1 client users can access

the switch as long as they pass any of the two kinds of authentications. SSH2 client

users can access the switch only when they pass both kinds of authentications.

zFor the password authentication type, username should be consistent with the

valid user name defined in AAA; for the RSA authentication type, username is the

SSH local user name, so that there is no need to configure a local user in AAA.

zIf the default authentication type for SSH users is password and local AAA

authentication is adopted, you need not use the ssh user command to create an

SSH user. Instead, you can use the local-user command to create a user name

and its password and then set the service type of the user to SSH.

zIf the default authentication type for SSH users is password and remote

authentication (RADIUS authentication, for example) is adopted, you need not use

the ssh user command to create an SSH user, because it is created on the remote

server. And the user can use its username and password configured on the remote

server to access the network.

zIf you use the ssh user username authentication-type command to specify an

authentication type for an inexistent SSH user, the system will create the SSH user

automatically.

zIf the RSA authentication type is specified, you can use the user privilege level

command to set the level of the commands available to the SSH users logging into

the server. Additionally, the command levels accessible to the users adopting RSA

authentication are the same.

zIf the password authentication type is specified, the command levels accessible to

SSH users logging into the server are determined through AAA. In this case, the

command level may vary with users.

V. Configuring SSH management

The configuration of SSH management includes the setting of authentication timeout

time, authentication retry times, server key update interval, and SSH compatible mode.

After the configuration, the SSH management function is able to prevent illegal

activities such as malicious password guessing, thus ensure the security of SSH

connections.

Operation Manual – SSH Terminal Service

H3C S3600 Series Ethernet Switches-Release 1510 Chapter 1 SSH Terminal Service

1-9

Table 1-6 Configure SSH management

Operation Command Description

Enter system view system-view —

Set SSH

authentication

timeout time

ssh server timeout

seconds

Optional

By default, the timeout time is 60

seconds.

Set SSH

authentication retry

times

ssh server

authentication-retri

es times

Optional

By default, the number of retry times

is 3.

Set server key

update interval ssh server

rekey-interval hours

Optional

By default, the system does not

update server keys.

Configure SSH

server to be

compatible with

SSH1.x clients

ssh server

compatible-ssh1x

enable

Optional

By default, SSH server is

compatible with SSH1.x clients.

VI. Configuring a client public key for a user

On the switch, you can configure a client public key (generated randomly on a client) for

a client user. This configuration is not required for password authentication type.

There are two methods to configure a client public key for a user.

1) Manual configuration

First, perform the following operations on a client:

zUse the SSH1.5/2.0 client software to randomly generate a RSA key pair.

zUse the SSHKEY.exe program to transform the public key in the RSA key pair to

PKCS (public-key cryptography standards) format.

Then, perform the following operations on the server:

Table 1-7 Configure client public key for a user

Operation Command Description

Enter system view system-view —

Enter public key view rsa peer-public-key

keyname Required

Enter public key edit

view to input a client

public key public-key-code begin —

Andere Handbücher für H3C S3600 Series

Inhaltsverzeichnis

Andere H3C Netzwerk-Router Handbücher

H3C

H3C SR6600 SPE-FWM Installationshandbuch

H3C

H3C AR 18-22-24 Bedienungsanleitung

H3C

H3C S9500 Series Montageanleitung

H3C

H3C SR6600 SPE-FWM Bedienungsanleitung

H3C

H3C SR6600 SPE-FWM Bedienungsanleitung

H3C

H3C MSR810 Installationshandbuch

H3C

H3C H3C S7503 S7506 AND S7506R SWITCH Bedienungsanleitung

H3C

H3C MSR 5600 Bedienungs- und Wartungshandbuch

H3C

H3C MSR810 Bedienungsanleitung

H3C

H3C S5500-SI Series Bedienungsanleitung

H3C

H3C MSR Series Bedienungsanleitung

H3C

H3C HIM-8FE Bedienungsanleitung

H3C

H3C MSR 2600 Series Bedienungsanleitung

H3C

H3C MSR 5660 Gebrauchs- und Pflegehandbuch

H3C

H3C S7502 Bedienungsanleitung

H3C

H3C S12500R Series Kurzanleitung

H3C

H3C S12516CR Bedienungs- und Wartungshandbuch

H3C

H3C S5500-SI Series Bedienungsanleitung

H3C

H3C AR 46-80 Bedienungsanleitung

H3C

H3C SR6600 SPE-FWM Bedienungsanleitung

H3C

H3C RA200 Bedienungsanleitung

H3C

H3C H3C S3600 Series Montageanleitung

H3C

H3C SR6602 Bedienungsanleitung

H3C

H3C SR6600 Series Bedienungsanleitung

Beliebte Netzwerk-Router Handbücher anderer Marken

Allnet

Allnet ALL0333AU Bedienungsanleitung

HomeSeer

HomeSeer HT-SEL Bedienungsanleitung

Sercomm

Sercomm Genesis OC3505D Bedienungsanleitung

Billion

Billion BIPAC 5102 Series Bedienungsanleitung

TP-Link

TP-Link TD-8817 Bedienungsanleitung

Motorola

Motorola MR1900 Bedienungsanleitung

Digi

Digi IX14 Bedienungsanleitung

Cisco

Cisco NCS 540 Handbuch

XAVi

XAVi X8821e Bedienungsanleitung

BEC

BEC 6200WZL Bedienungsanleitung

MikroTik

MikroTik hAP ac3 Series Bedienungsanleitung

Korenix

Korenix JetNet 5428G Series Bedienungsanleitung

NETGEAR

NETGEAR FS526T - Switch Bedienungsanleitung

Korenix

Korenix JetNet 5710G Series Bedienungsanleitung

Automated Logic

Automated Logic ZN551 Betriebsanleitung

Cisco

Cisco ASR 1000 Series Bedienerhandbuch

EnGenius

EnGenius ESR-9710 Bedienungsanleitung

Cisco

Cisco 805 Series Bedienungs- und Sicherheitshinweise