H3C S3100-52P Bedienungsanleitung

Operation Manual – SSH Terminal Service

H3C S3100-52P Ethernet Switch Table of Contents

Table of Contents

Chapter 1 SSH Terminal Service..................................................................................................1-1

1.1 SSH Terminal Service .......................................................................................................1-1

1.1.1 Introduction to SSH.................................................................................................1-1

1.1.2 SSH Server Configuration.......................................................................................1-3

1.1.3 SSH Client Configuration......................................................................................1-10

1.1.4 Configuring the Device as an SSH Client............................................................. 1-17

1.1.5 Displaying SSH Configuration...............................................................................1-19

1.1.6 SSH Server Configuration Example...................................................................... 1-19

1.1.7 Configuring the Device as an SSH Client Configuration Example........................1-21

1.2 SFTP Service...................................................................................................................1-23

1.2.1 Introduction to SFTP.............................................................................................1-23

1.2.2 SFTP Server Configuration...................................................................................1-23

1.2.3 SFTP Client Configuration on the Switch.............................................................. 1-24

1.2.4 SFTP Configuration Example................................................................................1-28

Operation Manual – SSH Terminal Service

H3C S3100-52P Ethernet Switch Chapter 1 SSH Terminal Service

1-1

Chapter 1 SSH Terminal Service

1.1 SSH Terminal Service

1.1.1 Introduction to SSH

Secure shell (SSH) provides secure communication and powerful authentication for

remote user login to a switch over an insecure network, thus preventing assaults such

as IP address spoofing, plain-text password interception.

Currently, the S3100-52PEthernet Switches support SSH2.0.Acting as an SSH server,

a switch allows for the connections of multiple SSH clients. Through SSH Client, a user

can establish a connection to a switch or UNIX host running SSH Server.

Figure 1-1 and Figure 1-2 shows two ways to establish SSH connection between client

and server.

zEstablishing SSH connection through a LAN

100BASE-TX

Server

Ethernet

Workstation

Laptop

SSH

Switch

SSH

100BASE-TX

Server

Ethernet

Workstation

Laptop

SSH Client

Switch

SSH Server

100BASE-TX

Server

Ethernet

Workstation

Laptop

SSH

Switch

SSH

100BASE-TX

Server

100BASE-TX

Server

Ethernet

Workstation

Laptop

SSH

Switch

SSH

100BASE-TX

Server

Ethernet

Workstation

Laptop

SSH Client

Switch

SSH Server

Figure 1-1 Establish SSH connection through a LAN

zEstablishing SSH connection through a WAN

Operation Manual – SSH Terminal Service

H3C S3100-52P Ethernet Switch Chapter 1 SSH Terminal Service

1-2

Local switch

Local Ethernet

WANServer PC

SSH

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

Workstation

Rem

Remote sw itch

SSH ote Ethernet

Server

WANServer PC

SSH

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

Workstation

Rem

SSH ote Ethernet

Server

Local switch

Local Ethernet

WANServer PC

SSH

Laptop

Local switch

Local Ethernet

WANServer PC

SSH

Laptop

Workstation

Remote Ethernet

Server

WAN

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

Server PC

SSH

Laptop

Workstation

Rem

Remote sw itch

SSH ote Ethernet

Server

WANServer PC

SSH

Workstation

Rem

Remote sw itch

SSH ote Ethernet

Server

WANServer PC

SSH

Laptop

Workstation

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

WANServer PC

SSH Client

Laptop

Workstation

Rem

SSH Server ote Ethernet

Server

Local switch

Local Ethernet

WANServer PC

SSH

Laptop

Local switch

Local Ethernet

WANServer PC

SSH

Laptop

Workstation

Remote Ethernet

Server

WAN

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

Server PC

SSH

Laptop

Workstation

Rem

Remote sw itch

SSH ote Ethernet

Server

WANServer PC

SSH

Workstation

Rem

Remote sw itch

SSH ote Ethernet

Server

WANServer PC

SSH

Laptop

Workstation

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

Workstation

Rem

SSH ote Ethernet

Server

Local switch

Local Ethernet

WANServer PC

SSH

Laptop

Local switch

Local Ethernet

WANServer PC

SSH

Laptop

Workstation

Remote Ethernet

Server

WAN

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

Server PC

SSH

Laptop

Workstation

Rem

Remote sw itch

SSH ote Ethernet

Server

WANServer PC

SSH

Workstation

Rem

Remote sw itch

SSH ote Ethernet

Server

WANServer PC

SSH

Laptop

Workstation

Laptop

Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop Workstation

Remote Ethernet

Server

WANServer PC

SSH

Laptop

WANServer PC

SSH

Laptop

WANServer PC

SSH Client

Laptop

Workstation

Rem

SSH Server ote Ethernet

Server

Figure 1-2 Establish SSH connection through a WAN

The communication process between a SSH client and server goes through the

following five stages.

1) Version negotiation stage:

zThe client sends a TCP connection request to the server.

zWhen a TCP connection is established, the two ends begin to negotiate an SSH

version.

zIf they get a successful negotiation, they go to the key negotiation stage.

Otherwise the server terminates the TCP connection.

2) Key negotiation stage:

zThe server sends the public key in a randomly generated RSA key pair to the

client.

zThe client calculates a session key by using the public key received from the

server and a random number it generates randomly.

zThe client encrypts the random number with the public key from the server and

sends the result data to the server.

zThe server then decrypts the received data with the private key in the RSA key pair

to get the random number on the client.

zThe server calculates a session key by using the public key and the random

number through the same algorithm as the client.

Then, the server and the client get the same session key, and use it for data encryption

and decryption to secure their subsequent communication.

3) Authentication negotiation stage:

zThe client sends its username information to the server.

Operation Manual – SSH Terminal Service

H3C S3100-52P Ethernet Switch Chapter 1 SSH Terminal Service

1-3

zThe server starts to authenticate the user. If the user is configured as having no

authentication on the server, the following step is skipped and the session request

stage starts directly.

zThe server authenticates the user in some way (see the following note), till the

authentication succeeds or the connection is terminated due to authentication

timeout.

Note:

SSH provides two kinds of authentication: password authentication and RSA

authentication.

(1) Password authentication works as follows:

zThe client sends the username and password to the server.

zThe server compares the received username and password against those

configured locally. The user passes the authentication if the server finds a match for

both username and password.

(2) RSA authentication works as follows:

zConfigure the RSA public key of the client at the server.

zThe client sends the member module of its RSA public key to the server.

zThe server checks the validity of the member module. If it is valid, the server

generates a random number, which is sent to the client after being encrypted with

RSA public key of the client.

zBoth the server and the client calculate authentication data by using the random

number and session ID.

zThe client sends the authentication data it calculates to the server.

zThe server compares the received authentication data with the authentication data

on itself. If they are identical, the authentication succeeds.

4) Session request stage. The client sends a session request to the server, which

processes the request and establish a session.

5) Interactive session stage. Both ends exchange data till the session ends.

1.1.2 SSH Server Configuration

The following table describes SSH Server configuration tasks.

Operation Manual – SSH Terminal Service

H3C S3100-52P Ethernet Switch Chapter 1 SSH Terminal Service

1-4

Table 1-1 SSH2.0 Server configuration tasks

Operation Command Related section

Configure user interface(s) to

support specified protocol(s) protocol inbound

Section “Configuring

user interface(s) to

support specified

protocol(s)"

Generate local RSA key pair rsa local-key-pair create

Destroy local RSAkey pair rsa local-key-pair

destroy

Section “Generating

or destroying local

RSA key pair"

Specify a default

authentication type for SSH

users

ssh authentication-type

default

Configure authentication type

for an SSH user ssh user username

authentication-type

Section "Configuring

authentication type for

a user"

Set SSH authentication

timeout time ssh server timeout

Set SSH authentication retry

times ssh server

authentication-retries

Section “Configuring

SSH management

Configure a client public key

for an SSH user ssh user username

assign rsa-key keyname

Section “Configuring a

client public key for a

user"

I. Configuring user interface(s) to support specified protocol(s)

Table 1-2 Configure user interface(s) to support specified protocol(s)

Operation Command Description

Enter system view system-view —

Enter the view of one or

multiple user interfaces

user-interface

[ type-keyword ] number

[ ending-number ]Required

Configure the user

interface(s) to support

specified protocol(s)

protocol inbound {all

|ssh |telnet }

Optional

By default, both Telnet

and SSH are supported.

Operation Manual – SSH Terminal Service

H3C S3100-52P Ethernet Switch Chapter 1 SSH Terminal Service

1-5

Caution:

zIf you have configured a user interface to support SSH protocol, to ensure a

successful login to the user interface, you must configure AAA authentication for the

user interface by using the authentication-mode scheme command.

zFor a user interface, if you have executed the authentication-mode password or

authentication-mode none command, the protocol inbound ssh command

cannot be executed; if you have executed the protocol inbound ssh command,

neither of the authentication-mode password and authentication-mode none

commands can be executed.

II. Generating or destroying local RSA key pair

This configuration task is used to generate or destroy an RSA key pair on the server,

which is named in the format of switch name plus "_Host", for example, H3C_host.

After you issue the rsa local-key-pair create command, the system prompts you to

input a key length.

In SSH2.0, the key length is in the range of 512 to 2,048 (bits).

Table 1-3 Generate or destroy local RSA key pair

Operation Command Description

Enter system view system-view —

Generate local RSA key pair rsa local-key-pair create Required

Destroy local RSAkey pair rsa local-key-pair destroy Optional

Caution:

zFor a successful SSH login, you must first generate the RSA key pair of the server.

zYou just need to execute the rsa local-key-pair create command once, and need

not execute the command again after the system is rebooted.

zIf you re-execute the rsa local-key-pair create command, the system will ask

whether you want to replace the original key pair with a new one.

Operation Manual – SSH Terminal Service

H3C S3100-52P Ethernet Switch Chapter 1 SSH Terminal Service

1-6

Note:

After the rsa local-key-pair create command is executed, you can execute the

display rsa local-key-pair public command to display information about the public

key (in H3C_host, for example).

III. Configuring authentication type for a user

For a new user, you must specify the authentication type. Otherwise, the user cannot

access the switch.

Table 1-4 Configure authentication type for a user

Operation Command Description

Enter system view system-view —

Specify a default

authentication type for

SSH users

ssh authentication-type

default {password |rsa

|password-publickey |

all }

Configure authentication

type for an SSH user

ssh user username

authentication-type

{ password |

password-publickey |

rsa| all }

At least one required;

By default, no

authentication type is

specified for an SSH user,

and the user can not

access the switch.

Note that:

zThe ssh authentication-type default command is used to configure the default

authentication type for all SSH users.

zThe ssh user username authentication-type command is used to configure an

authentication type for a specific SSH user.

zWhen both commands are configured with different authentication types, for the

specific user (user specified by the username argument), the authentication type

specified by the ssh user username authentication-type command will take

effect instead of that specified for all SSH users.

Operation Manual – SSH Terminal Service

H3C S3100-52P Ethernet Switch Chapter 1 SSH Terminal Service

1-7

Caution:

zIf RSA authentication type is configured for a user, the RSA public key of the client

user must be configured on the switch.

zBy default, no authentication type is specified for a new user, and the new user

cannot access the switch.

zFor the password-publickey authentication type, users can access the switch only

when they pass both kinds of authentications.

zFor the password authentication type, username should be consistent with the

valid user name defined in AAA; for the RSA authentication type, username is the

SSH local user name, so that there is no need to configure a local user in AAA.

zIf the default authentication type for SSH users is password and local AAA

authentication is adopted, you need not use the ssh user command to create an

SSH user. Instead, you can use the local-user command to create a user name and

its password and then set the service type of the user to SSH.

zIf the default authentication type for SSH users is password and remote

authentication (RADIUS authentication, for example) is adopted, you need not use

the ssh user command to create an SSH user, because it is created on the remote

server. And the user can use its username and password configured on the remote

server to access the network.

IV. Configuring SSH management

The configuration of SSH management includes the setting of authentication timeout

time, and authentication retry times. After the configuration, the SSH management

function is able to prevent illegal activities such as malicious password guessing, thus

ensure the security of SSH connections.

Table 1-5 Configure SSH management

Operation Command Description

Enter system view system-view —

Set SSH

authentication

timeout time ssh server timeout seconds Optional

By default, the timeout

time is 60 seconds.

Set SSH

authentication retry

times

ssh server

authentication-retries times

Optional

By default, the number of

retry times is 3.

Operation Manual – SSH Terminal Service

H3C S3100-52P Ethernet Switch Chapter 1 SSH Terminal Service

1-8

V. Configuring a client public key for a user

On the switch, you can configure a client public key (generated randomly on a client) for

a client user. This configuration is not required for password authentication type.

There are two methods to configure a client public key for a user.

1) Manual configuration

First, perform the following operations on a client:

zUse the SSH2.0 client software to randomly generate a RSA key pair.

zUse the SSHKEY.exe program to transform the public key in the RSA key pair to

PKCS (public-key cryptography standards) format.

Then, perform the following operations on the server:

Table 1-6 Configure client public key for a user

Operation Command Description

Enter system view system-view —

Enter public key view rsa peer-public-key

key-name Required

Enter public key edit

view to input a client

public key

public-key-code

begin

When you input the key data,

spaces are allowed between the

characters you input (because the

system can remove the spaces

automatically); you can also press

<Enter> to continue your input at

the next line. But the key you input

should be a hexadecimal digit

string coded in the public key

format.

Return to public key

view from public key

edit view

public-key-code

end

The system saves the public key

data you input when exiting public

key edit view.

Return to system

view from public key

view peer-public-key end —

Assign a client public

key to an SSH user

ssh user username

assign rsa-key

keyname

Required

Keyname is the name of an

existing public key. If the user has

already been assigned with a

public key, the newly assigned

public key overwrites the old one.

Operation Manual – SSH Terminal Service

H3C S3100-52P Ethernet Switch Chapter 1 SSH Terminal Service

1-9

Note:

The above method requires you to transform the format of the public key on the client,

and then manually configure the transformed public key on the server. So, the method

is relatively more complex.

2) Automatic configuration

First, perform the following operations on a client:

zUse the SSH2.0 client software to randomly generate a RSA key pair.

zUse FTP/TFTP to transfer the corresponding public key file to the Flash memory of

the server.

Then, perform the following operations on the server:

Table 1-7 Automatic configuration

Operation Command Description

Enter system view system-view —

Transform the format of the key

in a client public key file and

automatically configure a client

public key on the server

rsa peer-public-key

key-name import

sshkey file-name

filename must be

consistent with the name

of a public key file in the

Flash memory.

Note:

The above method does not require you to manually configure a public key. So the

method is relatively simple and is the recommended method.

VI. Specifying a source IP address/interface for the SSH server

You can perform the following configurations to specify a source IPaddress or a source

interface for the SSH server, thus enhancing traffic manageability.

Table 1-8 Specify a source IP address/interface for the SSH server

Operation Command Description

Enter system view system-view —

Specify a source IP address

for the SSH server ssh-server source-ip ip-address Optional

Specify a source interface

for the SSH server ssh-server source-interface

interface-type interface-number Optional

Andere Handbücher für S3100-52P

Inhaltsverzeichnis

Andere H3C Netzwerk-Router Handbücher

H3C

H3C S5800-60C-PWR Bedienungsanleitung

H3C

H3C MSR Series Bedienungsanleitung

H3C

H3C MSR 2600 Bedienungs- und Wartungshandbuch

H3C

H3C S3100-52P Bedienungsanleitung

H3C

H3C SR6602-X Bedienungsanleitung

H3C

H3C MSR 5660 Gebrauchs- und Pflegehandbuch

H3C

H3C S5150-EI Series Bedienungsanleitung

H3C

H3C S7500 Series Montageanleitung

H3C

H3C S3100-52P Bedienungsanleitung

H3C

H3C SR6602 Bedienungsanleitung

H3C

H3C S1016 Bedienungsanleitung

H3C

H3C S5500-EI series Bedienungsanleitung

H3C

H3C RA100 Bedienungsanleitung

H3C

H3C S3100-52P Bedienungsanleitung

H3C

H3C MSR Series Installationshandbuch

H3C

H3C CR16000-F Installationshandbuch

H3C

H3C SR8800-F Bedienungsanleitung

H3C

H3C S12500R Series Bedienungsanleitung

H3C

H3C SR8800-F Bedienungsanleitung

H3C

H3C S12500R Series Bedienungsanleitung

H3C

H3C SR6600-X Bedienungsanleitung

H3C

H3C MSR 930 Bedienungsanleitung

H3C

H3C S12500R Series Anwendungshandbuch

H3C

H3C SR6600 SPE-FWM Installationshandbuch

Beliebte Netzwerk-Router Handbücher anderer Marken

Allnet

Allnet ALL0333AU Bedienungsanleitung

HomeSeer

HomeSeer HT-SEL Bedienungsanleitung

Sercomm

Sercomm Genesis OC3505D Bedienungsanleitung

Billion

Billion BIPAC 5102 Series Bedienungsanleitung

TP-Link

TP-Link TD-8817 Bedienungsanleitung

Motorola

Motorola MR1900 Bedienungsanleitung

Digi

Digi IX14 Bedienungsanleitung

Cisco

Cisco NCS 540 Handbuch

XAVi

XAVi X8821e Bedienungsanleitung

BEC

BEC 6200WZL Bedienungsanleitung

MikroTik

MikroTik hAP ac3 Series Bedienungsanleitung

Korenix

Korenix JetNet 5428G Series Bedienungsanleitung

NETGEAR

NETGEAR FS526T - Switch Bedienungsanleitung

Korenix

Korenix JetNet 5710G Series Bedienungsanleitung

Automated Logic

Automated Logic ZN551 Betriebsanleitung

Cisco

Cisco ASR 1000 Series Bedienerhandbuch

EnGenius

EnGenius ESR-9710 Bedienungsanleitung

Cisco

Cisco 805 Series Bedienungs- und Sicherheitshinweise