Secure Shell (SSH) offers an approach to logging in to a remote device securely. By encryption and strong authentication, it protects devices against attacks such as IP spoofing and plain text password interception.

The device can not only work as an SSH server to support connections with SSH clients, but also work as an SSH client to allow users to establish SSH connections with a remote device acting as the SSH server.

NOTE:

· When acting as an SSH server, the device supports SSH2.0 and SSH1. When acting as an SSH client, the device supports SSH2.0 only.

· Unless otherwise noted, SSH in this document refers to SSH2.0.

How SSH works

To establish an SSH connection and communicate with each other through the connection, an SSH client and the SSH server go through the stages listed in Table 1.

Table 1 Stages in session establishment and interaction between an SSH client and the server

Stages	Description
Version negotiation	SSH1 and SSH2.0 are supported. The two parties negotiate a version to use.
Key and algorithm negotiation	SSH supports multiple algorithms. The two parties negotiate algorithms for communication, and use the DH key exchange algorithm to generate the same session key and session ID.
Authentication	The SSH server authenticates the client in response to the client’s authentication request.
Session request	After passing authentication, the client sends a session request to the server.
Interaction	After the server grants the request, the client and the server start to communicate with each other.

Version negotiation

1. The server opens port 22 to listen to connection requests from clients.

2. The client sends a TCP connection request to the server.

3. After the TCP connection is established, the server sends a packet that carries a version information string to the client. The version information string is in the format SSH-<primary protocol version number>.<secondary protocol version number>-<software version number>. The primary and secondary protocol version numbers constitute the protocol version number. The software version number is used for debugging.

4. Upon receiving the packet, the client resolves the packet and compares the server’s protocol version number with that of its own. If the server’s protocol version is lower and supportable, the client uses the protocol version of the server; otherwise, the client uses its own protocol version. In either case, the client sends a packet to the server to notify the server of the protocol version that it decides to use.

5. The server compares the version number carried in the packet with that of its own. If the server supports the version, the server and the client proceed with key and algorithm negotiation. Otherwise, the negotiation fails, and the server breaks the TCP connection.

NOTE:

All the packets involved in the preceding steps are transferred in plain text.

Key and algorithm negotiation

1. The server and the client send algorithm negotiation packets to each other, notifying the peer of the supported public key algorithms, encryption algorithms, Message Authentication Code (MAC) algorithms, and compression algorithms.

2. Based on the received algorithm negotiation packets, the server and the client figure out the algorithms to be used. If the negotiation of any type of algorithm fails, the algorithm negotiation fails and the server tears down the connection with the client.

3. The server and the client use the DH key exchange algorithm and parameters such as the host key pair to generate the session key and session ID, and the client authenticates the identity of the server.

Through the steps, the server and the client get the same session key and session ID. The session key will be used to encrypt and decrypt data exchanged between the server and client later. The session ID will be used to identify the session established between the server and client and will be used in the authentication stage.

CAUTION:

Before the key and algorithm negotiation, the server must have already generated a DSA or RSA key pair, which is not only used for generating the session key and session ID, but also used by the client to authenticate the identity of the server. For more information about DSA and RSA key pairs, see the chapter “Managing public keys.”

Authentication

SSH supports the following authentication methods:

· Password authentication—The SSH server uses AAA for authentication of the client. During password authentication, the SSH client encrypts its username and password, encapsulates them into a password authentication request, and sends the request to the server. After receiving the request, the SSH server decrypts the username and password, checks the validity of the username and password locally or by a remote AAA server, and then informs the client of the authentication result. If the remote AAA server requires the user for a password re-authentication, it carries a prompt in the authentication response to send to the device. The prompt is transparently transmitted to the client, and displayed on the client to notify the user to enter a specified password. After the user enters the correct password and passes validity check by the remote AAA server, the device returns an authentication success message to the client.

· Publickey authentication—The server authenticates the client by the digital signature. During publickey authentication, the client sends the server a publickey authentication request that contains its username, public key, and public key algorithm information. The server checks whether the public key is valid. If the public key is invalid, the authentication fails. Otherwise, the server authenticates the client by the digital signature. Finally, the server sends a message to the client to inform the authentication result. The device supports using the public key algorithms RSA and DSA for digital signature.

An SSH2.0 server might require the client to pass both password authentication and publickey authentication or either of them. However, if the client is running SSH1, the client only needs to pass either authentication, regardless of the requirement of the server.

The following gives the steps of the authentication stage:

1. The client sends the server an authentication request, which includes the username, the authentication method, and the information related to the authentication method (for example, the password in the case of password authentication).

2. The server authenticates the client. If the authentication fails, the server informs the client by sending a message, which includes a list of available methods for re-authentication.

3. The client selects a method from the list to initiate another authentication.

4. The preceding process repeats until the authentication succeeds or the number of failed authentication attempts exceeds the maximum of authentication attempts. In the latter case, the server tears the session down.

NOTE:

Only clients running SSH2.0 or a later version support password re-authentication that is initiated by the device acting as the SSH server.

Session request

After passing authentication, the client sends a session request to the server, and the server listens to and processes the request from the client. If the server successfully processes the request, the server sends an SSH_SMSG_SUCCESS packet to the client and goes on to the interaction stage with the client. Otherwise, the server sends an SSH_SMSG_FAILURE packet to the client to indicate that the processing has failed or it cannot resolve the request.

Interaction

In this stage, the server and the client exchanges data as follows:

1. The client encrypts and sends the command to be executed to the server.

2. The server decrypts and executes the command, and then encrypts and sends the result to the client.

3. The client decrypts and displays the result on the terminal.

NOTE:

· In the interaction stage, you can execute commands from the client by pasting the commands in text format (the text must be within 2000 bytes). The commands must be available in the same view. Otherwise, the server might not be able to perform the commands correctly.

· If the command text exceeds 2000 bytes, you can execute the commands by saving the text as a configuration file, uploading the configuration file to the server through Secure FTP (SFTP), and then using the configuration file to restart the server.

SSH connection across VPNs

With this function, you can configure the device as an SSH client to establish connections with SSH servers in different MPLS VPNs.

As shown in Figure 1, the hosts in VPN 1 and VPN 2 access the MPLS backbone through PEs, with the services of the two VPNs isolated. After a PE is enabled with the SSH client function, it can establish SSH connections with CEs in different VPNs that are enabled with the SSH server function to implement secure access to the CEs and secure transfer of log file.

Figure 1 Network diagram

Configuring the device as an SSH server

SSH server configuration task list

Complete the following tasks to configure an SSH server:

Task	Remarks
Generating DSA or RSA key pairs	Required
Enabling the SSH server function	Required
Configuring the user interfaces for SSH clients	Required
Configuring a client public key	Required for publickey authentication users and optional for password authentication users
Configuring an SSH user	Optional
Setting the SSH management parameters	Optional

Generating DSA or RSA key pairs

In the key and algorithm negotiation stage, the DSA or RSA key pair is required to generate the session key and session ID and for the client to authenticate the server.

To generate DSA or RSA key pairs on the SSH server:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Generate DSA or RSA key pairs.	public-key local create { dsa \| rsa }	By default, neither DSA nor RSA key pairs exist.

NOTE:

· For more information about the public-key local create command, see Security Command Reference.

· To support SSH clients that use different types of key pairs, generate both DSA and RSA key pairs on the SSH server.

· The public-key local create rsa command generates a server RSA key pair and a host RSA key pair. Each of the key pairs consists of a public key and a private key. The public key in the server key pair of the SSH server is used in SSH1 to encrypt the session key for secure transmission of the key. As SSH2.0 uses the DH algorithm to generate the session key on the SSH server and client respectively, no session key transmission is required in SSH2.0 and the server key pair is not used.

· The length of the modulus of RSA server keys and host keys must be in the range 512 to 2048 bits. Some SSH2.0 clients require that the length of the key modulus be at least 768 bits on the SSH server side.

· The public-key local create dsa command generates only the host key pair. SSH1 does not support the DSA algorithm.

· The length of the modulus of DSA host keys must be in the range 512 to 2048 bits. Some SSH2.0 clients require that the length of the key modulus be at least 768 bits on the SSH server side.

Enabling the SSH server function

To enable the SSH server function:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable the SSH server function.	ssh server enable	Disabled by default

Configuring the user interfaces for SSH clients

An SSH client accesses the device through a VTY user interface. Therefore, you need to configure the user interfaces for SSH clients to allow SSH login. The configuration takes effect only for clients that log in after the configuration.

To configure the protocols for a user interface to support:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter user interface view of one or more user interfaces.	user-interface vty number [ ending-number ]	N/A
3. Set the login authentication mode to scheme.	authentication-mode scheme	By default, the authentication mode is password.
4. Configure the user interface(s) to support SSH login.	protocol inbound { all \| ssh }	Optional. All protocols are supported by default.

CAUTION:

· For more information about the authentication-mode and protocol inbound commands, see Fundamentals Command Reference.

· If you configure a user interface to support SSH, be sure to configure the corresponding authentication mode with the authentication-mode scheme command.

· For a user interface configured to support SSH, you cannot change the authentication mode. To change the authentication mode, undo the SSH support configuration first.

Configuring a client public key

NOTE:

This configuration task is only necessary for SSH users using publickey authentication.

For each SSH user that uses publickey authentication to log in, you must configure the client’s DSA or RSA host public key on the server, and configure the client to use the corresponding host private key.

To configure the public key of an SSH client, you can configure it manually or import it from the public key file:

· Configure it manually. You can type or copy the public key to the SSH server. The public key must have not been converted and be in the Distinguished Encoding Rules (DER) encoding format.

· Import it from the public key file. During the import process, the system will automatically convert the public key to a string coded by using the Public Key Cryptography Standards (PKCS). Before importing the public key, you must upload the public key file (in binary) to the server through FTP or TFTP.

NOTE:

· H3C recommends you to configure a client public key by importing it from a public key file.

· You can configure up to 20 client public keys on an SSH server.

Configuring a client public key manually

To configure the client public key manually:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter public key view.	public-key peer keyname	N/A
3. Enter public key code view.	public-key-code begin	N/A
4. Configure a client public key.	Enter the content of the public key	Spaces and carriage returns are allowed between characters.
5. Return from public key code view to public key view.	public-key-code end	When you exit public key code view, the system automatically saves the public key.
6. Return from public key view to system view.	peer-public-key end	N/A

Importing a client public key from a public key file

To import a public key from a public key file:

Step	Command
1. Enter system view.	system-view
2. Import the public key from a public key file.	public-key peer keyname import sshkey filename

NOTE:

For more information about client public key configuration, see the chapter “Managing public keys.”

Configuring an SSH user

To configure an SSH user that uses publickey authentication, you must perform the procedure in this section.

To configure an SSH user that uses password authentication, whether together with publickey authentication or not, you must configure a local user account by using the local-user command in the chapter "AAA" for local authentication, or configure an SSH user account on an authentication server, for example, a RADIUS server, for remote authentication.

For password-only SSH users, you do not need to perform the procedure in this section to configure them unless you want to use the display ssh user-information command to display all SSH users, including the password-only SSH users, for centralized management.

Configuration guidelines

When you perform the procedure in this section to configure an SSH user, follow these guidelines:

· You can set the service type to Stelnet or SFTP. For more information about Stelnet and SFTP, see “SSH overview“ and the chapter “Configuring SFTP.”

· You can enable one of the following authentication modes for the SSH user:

¡ password—The user must pass password authentication.

¡ publickey authentication—The user must pass publickey authentication.

¡ password-publickey authentication—As an SSH2.0 user, the user must pass both password and publickey authentication. As an SSH1 user, the user must pass either password or publickey authentication.

¡ any—The user can use either password authentication or publickey authentication.

· If publickey authentication, whether with password authentication or not, is used, the command level accessible to the user is set by the user privilege level command on the user interface. If only password authentication is used, the command level accessible to the user is authorized by AAA.

· SSH1 does not support SFTP. For an SSH1 client, you must set the service type to stelnet or all.

· For an SFTP SSH user, the working folder depends on the authentication method:

¡ If only password authentication is used, the working folder is authorized by AAA.

¡ If publickey authentication, whether with password authentication or not, is used, the working folder is set by using the ssh user command.

If you change the authentication mode or public key for an SSH user that has been logged in, the change can take effect only at the next login of the user.

Configuration procedure

To configure an SSH user and specify the service type and authentication method:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create an SSH user, and specify the service type and authentication method.	· For Stelnet users: ssh user username service-type stelnet authentication-type { password \| { any \| password-publickey \| publickey } assign publickey keyname } · For all users or SFTP users: ssh user username service-type { all \| sftp } authentication-type { password \| { any \| password-publickey \| publickey } assign publickey keyname work-directory directory-name }	Use either command.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Create an SSH user, and specify the service type and authentication method.

· For Stelnet users:
ssh user username service-type stelnet authentication-type { password | { any | password-publickey | publickey } assign publickey keyname }

· For all users or SFTP users:
ssh user username service-type { all | sftp } authentication-type { password | { any | password-publickey | publickey } assign publickey keyname work-directory directory-name }

Use either command.

Setting the SSH management parameters

SSH management includes:

· Enabling the SSH server to be compatible with SSH1 client

· Setting the RSA server key pair update interval, applicable to users using SSH1 client

· Setting the SSH user authentication timeout period

· Setting the maximum number of SSH authentication attempts

Setting these parameters can help avoid malicious guessing at and cracking of the keys and usernames, securing your SSH connections.

To set the SSH management parameters:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable the SSH server to support SSH1 clients.	ssh server compatible-ssh1x enable	Optional. By default, the SSH server supports SSH1 clients.
3. Set the RSA server key pair update interval.	ssh server rekey-interval hours	Optional. 0 by default. That is, the RSA server key pair is not updated.
4. Set the SSH user authentication timeout period.	ssh server authentication-timeout time-out-value	Optional. 60 seconds by default.
5. Set the maximum number of SSH authentication attempts.	ssh server authentication-retries times	Optional. 3 by default.

NOTE:

Authentication will fail if the number of authentication attempts (including both publickey and password authentication) exceeds that specified in the ssh server authentication-retries command.

Configuring the device as an SSH client

SSH client configuration task list

Complete the following tasks to configure an SSH client:

Task	Remarks
Specifying a source IP address/interface for the SSH client	Optional
Configuring whether first-time authentication is supported	Optional
Establishing a connection between the SSH client and server	Required

Specifying a source IP address/interface for the SSH client

This configuration task allows you to specify a source IP address or interface for the client to access the SSH server, improving service manageability.

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Specify a source IP address or interface for the SSH client.	· Specify a source IPv4 address or interface for the SSH client: ssh client source { ip ip-address \| interface interface-type interface-number } · Specify a source IPv6 address or interface for the SSH client: ssh client ipv6 source { ipv6 ipv6-address \| interface interface-type interface-number }	Use either command. By default, an SSH client uses the IP address of the outbound interface defined by the route to the SSH server to access the SSH server.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Specify a source IP address or interface for the SSH client.

· Specify a source IPv4 address or interface for the SSH client:
ssh client source { ip ip-address | interface interface-type interface-number }

· Specify a source IPv6 address or interface for the SSH client:
ssh client ipv6 source { ipv6 ipv6-address | interface interface-type interface-number }

Use either command.

By default, an SSH client uses the IP address of the outbound interface defined by the route to the SSH server to access the SSH server.

Configuring whether first-time authentication is supported

When the device connects to the SSH server as an SSH client, you can configure whether the device supports first-time authentication.

· With first-time authentication, when an SSH client not configured with the server host public key accesses the server for the first time, the user can continue accessing the server, and save the host public key on the client. When accessing the server again, the client will use the saved server host public key to authenticate the server.

· Without first-time authentication, a client not configured with the server host public key will refuse to access the server. To enable the client to access the server, you must configure the server host public key and specify the public key name for authentication on the client in advance.

Enabling the device to support first-time authentication

To enable the device to support first-time authentication:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable the device to support first-time authentication.	ssh client first-time enable	Optional. By default, first-time authentication is supported on a client.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Enable the device to support first-time authentication.

ssh client first-time enable

Optional.

By default, first-time authentication is supported on a client.

Disabling first-time authentication

For successful authentication of an SSH client not supporting first-time authentication, the server host public key must be configured on the client and the public key name must be specified.

To disable first-time authentication:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Disable first-time authentication support.	undo ssh client first-time	By default, first-time authentication is supported on a client.
3. Configure the server host public key.	See “Configuring a client public key“	The method for configuring the server host public key on the client is similar to that for configuring client public key on the server.
4. Specify the host public key name of the server.	ssh client authentication server server assign publickey keyname	N/A

Establishing a connection between the SSH client and server

To establish the connection between the SSH client and the server:

Task	Command	Remarks
Establish a connection between the SSH client and the server.	· For an IPv4 server: ssh2 server [ port-number ] [ vpn-instance vpn-instance-name ] [ identity-key { dsa \| rsa } \| prefer-ctos-cipher { 3des \| aes128 \| des } \| prefer-ctos-hmac { md5 \| md5-96 \| sha1 \| sha1-96 } \| prefer-kex { dh-group-exchange \| dh-group1 \| dh-group14 } \| prefer-stoc-cipher { 3des \| aes128 \| des } \| prefer-stoc-hmac { md5 \| md5-96 \| sha1 \| sha1-96 } ] * · For an IPv6 server: ssh2 ipv6 server [ port-number ] [ vpn-instance vpn-instance-name ] [ identity-key { dsa \| rsa } \| prefer-ctos-cipher { 3des \| aes128 \| des } \| prefer-ctos-hmac { md5 \| md5-96 \| sha1 \| sha1-96 } \| prefer-kex { dh-group-exchange \| dh-group1 \| dh-group14 } \| prefer-stoc-cipher { 3des \| aes128 \| des } \| prefer-stoc-hmac { md5 \| md5-96 \| sha1 \| sha1-96 } ] *	Use either command in user view.

Task

Command

Remarks

Establish a connection between the SSH client and the server.

· For an IPv4 server:
ssh2 server [ port-number ] [ vpn-instance vpn-instance-name ] [ identity-key { dsa | rsa } | prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] *

· For an IPv6 server:
ssh2 ipv6 server [ port-number ] [ vpn-instance vpn-instance-name ] [ identity-key { dsa | rsa } | prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] *

Use either command in user view.

Displaying and maintaining SSH

Task	Command	Remarks
Display the source IP address or interface set for the SFTP client.	display sftp client source [ \| { begin \| exclude \| include } regular-expression ]	Available in any view
Display the source IP address or interface information on an SSH client.	display ssh client source [ \| { begin \| exclude \| include } regular-expression ]	Available in any view
Display SSH server status information or session information on an SSH server.	display ssh server { status \| session } [ \| { begin \| exclude \| include } regular-expression ]	Available in any view
Display the mappings between SSH servers and their host public keys on an SSH client.	display ssh server-info [ \| { begin \| exclude \| include } regular-expression ]	Available in any view
Display information about one or all SSH users on an SSH server.	display ssh user-information [ username ] [ \| { begin \| exclude \| include } regular-expression ]	Available in any view
Display the public keys of the local key pairs.	display public-key local { dsa \| rsa } public [ \| { begin \| exclude \| include } regular-expression ]	Available in any view
Display the public keys of the SSH peers.	display public-key peer [ brief \| name publickey-name ] [ \| { begin \| exclude \| include } regular-expression ]	Available in any view

NOTE:

For more information about the display public-key local and display public-key peer commands, see Security Command Reference.

SSH server configuration examples

Password authentication enabled SSH server configuration example

Network requirements

As shown in Figure 2, a host (the SSH client) and a router (the SSH server) are directly connected through Ethernet interfaces. Configure an SSH user on the router so that the host can securely log in to the router after passing password authentication. Configure a username and password for the user on the router.

Figure 2 Network diagram

Configuration procedure

1. Configure the SSH server:

# Generate the RSA key pair and DSA key pair, and enable the SSH server.

<Router> system-view

[Router] public-key local create rsa

[Router] public-key local create dsa

[Router] ssh server enable

# Configure an IP address for interface GigabitEthernet 3/1/1, which the SSH client will use as the destination for SSH connection.

[Router] interface GigabitEthernet 3/1/1

[Router-GigabitEthernet3/1/1] ip address 192.168.1.40 255.255.255.0

[Router-GigabitEthernet3/1/1] quit

# Set the authentication mode for the user interfaces to AAA.

[Router] user-interface vty 0 4

[Router-ui-vty0-4] authentication-mode scheme

# Enable the user interfaces to support SSH.

[Router-ui-vty0-4] protocol inbound ssh

[Router-ui-vty0-4] quit

# Create local user client001, and set the user command privilege level to 3.

[Router] local-user client001

[Router-luser-client001] password simple aabbcc

[Router-luser-client001] service-type ssh

[Router-luser-client001] authorization-attribute level 3

[Router-luser-client001] quit

# Specify the service type for user client001 as Stelnet, and the authentication method as password. This step is optional.

[Router] ssh user client001 service-type stelnet authentication-type password

2. Establish a connection between the SSH client and SSH server:

NOTE:

The device supports a variety of SSH client software, such as PuTTY, and OpenSSH. The following is an example of configuring SSH client that uses PuTTY Version 0.58.

# Establish a connection to the SSH server.

Launch PuTTY.exe to enter the following interface. In the Host Name (or IP address) text box, enter the IP address of the server.

Figure 3 Specifying the host name (or IP address)

In the window shown in Figure 3, click Open to connect to the server. If the connection is normal, you will be prompted to enter the username and password. After entering the username (client001) and password (aabbcc), you can enter the configuration interface of the server.

Publickey authentication enabled SSH server configuration example

Network requirements

As shown in Figure 4, a host (the SSH client) and a router (the SSH server) are directly connected through Ethernet interfaces. Configure an SSH user on the router so that the host can securely log in to the router after passing publickey authentication. Use the RSA public key algorithm.

Figure 4 Network diagram

Configuration procedure

NOTE:

During SSH server configuration, the client public key is required. Use the client software to generate RSA key pairs on the client before configuring the SSH server.

1. Configure the SSH client:

# Generate the RSA key pairs.

Run PuTTYGen.exe, select SSH-2 RSA and click Generate.

Figure 5 Generating a key pair on the client

When the generator is generating the key pair, you must move the mouse continuously and keep the mouse off the green process bar shown in Figure 6. Otherwise, the process bar stops moving and the key pair generating process will be stopped.

Figure 6 Generating process

After the key pair is generated, click Save public key and specify the file name as key.pub to save the public key.

Figure 7 Saving a key pair on the client

Likewise, to save the private key, click Save private key. A warning window pops up to prompt you whether to save the private key without any protection. Click Yes and enter the name of the file for saving the key (private.ppk in this case).

Then, you need to transmit the public key file to the server through FTP or TFTP.

2. Configure the SSH server:

# Generate RSA and DSA key pairs and enable SSH server.

<Router> system-view

[Router] public-key local create rsa

[Router] public-key local create dsa

[Router] ssh server enable

# Configure an IP address for interface GigabitEthernet 3/1/1, which the SSH client will use as the destination for SSH connection.

[Router] interface GigabitEthernet 3/1/1

[Router-GigabitEthernet3/1/1] ip address 192.168.1.40 255.255.255.0

[Router-GigabitEthernet3/1/1] quit

# Set the authentication mode for the user interfaces to AAA.

[Router] user-interface vty 0 4

[Router-ui-vty0-4] authentication-mode scheme

# Enable the user interfaces to support SSH.

[Router-ui-vty0-4] protocol inbound ssh

# Set the user command privilege level to 3.

[Router-ui-vty0-4] user privilege level 3

[Router-ui-vty0-4] quit

# Import the client’s public key from file key.pub and name it Router001.

[Router] public-key peer Router001 import sshkey key.pub

# Specify the authentication method for user client002 as publickey, and assign the public key Router001 to the user.

[Router] ssh user client002 service-type stelnet authentication-type publickey assign publickey Router001

3. Establish a connection between the SSH client and the SSH server:

# Specify the private key file and establish a connection to the SSH server

Launch PuTTY.exe to enter the following interface. In the Host Name (or IP address) text box, enter the IP address of the server (192.168.1.40).

Figure 8 Specifying the host name (or IP address)

Select Connection > SSH > Auth from the navigation tree. The following window appears. Click Browse… to bring up the file selection window, navigate to the private key file (private.ppk) and click OK.

Figure 9 Specifying the private key file

In the window shown in Figure 9, click Open to connect to the server. If the connection is normal, you will be prompted to enter the username. After entering the username (client002), you can enter the configuration interface of the server.

SSH client configuration examples

Password authentication enabled SSH client configuration example

Network requirements

As shown in Figure 10, Router A (the SSH client) must pass password authentication to log in to Router B (the SSH server) through the SSH protocol. Configure the username client001 and the password aabbcc, for the SSH client on Router A.

Figure 10 Network diagram

Configuration procedure

1. Configure the SSH server:

# Generate the RSA and DSA key pairs, and enable the SSH server.

<RouterB> system-view

[RouterB] public-key local create rsa

[RouterB] public-key local create dsa

[RouterB] ssh server enable

# Configure an IP address for interface GigabitEthernet 3/1/1, which the SSH client will use as the destination for SSH connection.

[RouterB] interface GigabitEthernet 3/1/1

[RouterB-GigabitEthernet3/1/1] ip address 10.165.87.136 255.255.255.0

[RouterB-GigabitEthernet3/1/1] quit

# Set the authentication mode for the user interfaces to AAA.

[RouterB] user-interface vty 0 4

[RouterB-ui-vty0-4] authentication-mode scheme

# Enable the user interfaces to support SSH.

[RouterB-ui-vty0-4] protocol inbound ssh

[RouterB-ui-vty0-4] quit

# Create local user client001.

[RouterB] local-user client001

[RouterB-luser-client001] password simple aabbcc

[RouterB-luser-client001] service-type ssh

[RouterB-luser-client001] authorization-attribute level 3

[RouterB-luser-client001] quit

# Specify the service type for user client001 as Stelnet, and the authentication method as password. This step is optional.

[RouterB] ssh user client001 service-type stelnet authentication-type password

2. Establish a connection between the SSH client and the SSH server:

# Configure an IP address for interface GigabitEthernet 3/1/1.

<RouterA> system-view

[RouterA] interface GigabitEthernet 3/1/1

[RouterA-GigabitEthernet3/1/1] ip address 10.165.87.137 255.255.255.0

[RouterA-GigabitEthernet3/1/1] quit

[RouterA] quit

¡ If the client supports first-time authentication, you can directly establish a connection from the client to the server.

# Establish an SSH connection to server 10.165.87.136.

<RouterA> ssh2 10.165.87.136

Username: client001

Trying 10.165.87.136 ...

Press CTRL+K to abort

Connected to 10.165.87.136 ...

The Server is not authenticated. Continue? [Y/N]:y

Do you want to save the server public key? [Y/N]:n

Enter password:

After you enter the correct password, you can log in to Router B successfully.

¡ If the client does not support first-time authentication, you need to perform the following configurations.

# Disable first-time authentication.

[RouterA] undo ssh client first-time

# Configure the host public key of the SSH server. You can get the server host public key by using the display public-key local dsa public command on the server.

[RouterA] public-key peer key1

[RouterA-pkey-public-key] public-key-code begin

[RouterA-pkey-key-code]308201B73082012C06072A8648CE3804013082011F0281810

0D757262C4584C44C211F18BD96E5F0

[RouterA-pkey-key-code]61C4F0A423F7FE6B6B85B34CEF72CE14A0D3A5222FE08CECE

65BE6C265854889DC1EDBD13EC8B274

[RouterA-pkey-key-code]DA9F75BA26CCB987723602787E922BA84421F22C3C89CB9B0

6FD60FE01941DDD77FE6B12893DA76E

[RouterA-pkey-key-code]EBC1D128D97F0678D7722B5341C8506F358214B16A2FAC4B3

68950387811C7DA33021500C773218C

[RouterA-pkey-key-code]737EC8EE993B4F2DED30F48EDACE915F0281810082269009E

14EC474BAF2932E69D3B1F18517AD95

[RouterA-pkey-key-code]94184CCDFCEAE96EC4D5EF93133E84B47093C52B20CD35D02

492B3959EC6499625BC4FA5082E22C5

[RouterA-pkey-key-code]B374E16DD00132CE71B020217091AC717B612391C76C1FB2E

88317C1BD8171D41ECB83E210C03CC9

[RouterA-pkey-key-code]B32E810561C21621C73D6DAAC028F4B1585DA7F42519718CC

9B09EEF0381840002818000AF995917

[RouterA-pkey-key-code]E1E570A3F6B1C2411948B3B4FFA256699B3BF871221CC9C5D

F257523777D033BEE77FC378145F2AD

[RouterA-pkey-key-code]D716D7DB9FCABB4ADBF6FB4FDB0CA25C761B308EF53009F71

01F7C62621216D5A572C379A32AC290

[RouterA-pkey-key-code]E55B394A217DA38B65B77F0185C8DB8095522D1EF044B465E

8716261214A5A3B493E866991113B2D

[RouterA-pkey-key-code]485348

[RouterA-pkey-key-code] public-key-code end

[RouterA-pkey-public-key] peer-public-key end

# Specify the host public key for the SSH server (10.165.87.136) as key1.

[RouterA] ssh client authentication server 10.165.87.136 assign publickey key1

[RouterA] quit

# Establish an SSH connection to SSH server 10.165.87.136.

<RouterA> ssh2 10.165.87.136

Username: client001

Trying 10.165.87.136

Press CTRL+K to abort

Connected to 10.165.87.136...

Enter password:

After you enter the correct username and password, you can log in to Router B successfully.

Publickey authentication enabled SSH client configuration example

Network requirements

As shown in Figure 11, Router A (the SSH client) must pass publickey authentication to log in to Router B (the SSH server) through the SSH protocol. Use the DSA public key algorithm.

Figure 11 Network diagram

Configuration procedure

NOTE:

During SSH server configuration, the client public key is required. Use the client software to generate a DSA key pair on the client before configuring the SSH server.

1. Configure the SSH client:

# Configure an IP address for interface GigabitEthernet 3/1/1.

<RouterA> system-view

[RouterA] interface GigabitEthernet 3/1/1

[RouterA-GigabitEthernet3/1/1] ip address 10.165.87.137 255.255.255.0

[RouterA-GigabitEthernet3/1/1] quit

# Generate a DSA key pair.

[RouterA] public-key local create dsa

# Export the DSA public key to file key.pub.

[RouterA] public-key local export dsa ssh2 key.pub

[RouterA] quit

Then, you need to transmit the public key file to the server through FTP or TFTP.

2. Configure the SSH server:

# Generate the RSA and DSA key pairs, and enable the SSH server.

<RouterB> system-view

[RouterB] public-key local create rsa

[RouterB] public-key local create dsa

[RouterB] ssh server enable

# Configure an IP address for interface GigabitEthernet 3/1/1, which the SSH client will use as the destination for SSH connection.

[RouterB] interface GigabitEthernet 3/1/1

[RouterB-GigabitEthernet3/1/1] ip address 10.165.87.136 255.255.255.0

[RouterB-GigabitEthernet3/1/1] quit

# Set the authentication mode for the user interfaces to AAA.

[RouterB] user-interface vty 0 4

[RouterB-ui-vty0-4] authentication-mode scheme

# Enable the user interfaces to support SSH.

[RouterB-ui-vty0-4] protocol inbound ssh

# Set the user command privilege level to 3.

[RouterB-ui-vty0-4] user privilege level 3

[RouterB-ui-vty0-4] quit

# Import the peer public key from the file key.pub.

[RouterB] public-key peer Router001 import sshkey key.pub

# Specify the authentication method for user client002 as publickey, and assign the public key Router001 to the user.

[RouterB] ssh user client002 service-type stelnet authentication-type publickey assign publickey Router001

3. Establish a connection between the SSH client and the SSH server:

# Establish an SSH connection to the server (10.165.87.136).

<RouterA> ssh2 10.165.87.136

Username: client002

Trying 10.165.87.136 ...

Press CTRL+K to abort

Connected to 10.165.87.136 ...

The Server is not authenticated. Continue? [Y/N]:y

Do you want to save the server public key? [Y/N]:n

Then, you can log in to Router B successfully.

Configuring SFTP

SFTP overview

The Secure File Transfer Protocol (SFTP) is a new feature in SSH2.0.

SFTP uses the SSH connection to provide secure data transfer. The device can serve as the SFTP server, allowing a remote user to log in to the SFTP server for secure file management and transfer. The device can also serve as an SFTP client, enabling a user to log in from the device to a remote device for secure file transfer.

With SSH connection across VPNs, you can configure the device as an SFTP client to establish connections with SFTP servers in different MPLS VPNs. For more information about this function, see the chapter “Configuring SSH.”

Configuring the device as an SFTP server

Configuration prerequisites

Before you configure this task, complete the following tasks:

· Configure the SSH server.

· Use the ssh user service-type command to set the service type of SSH users to sftp or all.

For more information about the configuration procedures, see the chapter “Configuring SSH.”

Enabling the SFTP server

This configuration task will enable the SFTP service so that a client can log in to the SFTP server through SFTP.

To enable the SFTP server:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enable the SFTP server.	sftp server enable	Disabled by default

NOTE:

When the device functions as the SFTP server, only one client can access the SFTP server at a time. If the SFTP client uses WinSCP, a file on the server cannot be modified directly; it can only be downloaded to a local place, modified, and then uploaded to the server.

Configuring the SFTP connection idle timeout period

Once the idle period of an SFTP connection exceeds the specified threshold, the system automatically tears the connection down.

To configure the SFTP connection idle timeout period:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Configure the SFTP connection idle timeout period.	sftp server idle-timeout time-out-value	Optional 10 minutes by default

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Configure the SFTP connection idle timeout period.

sftp server idle-timeout time-out-value

Optional

10 minutes by default

Configuring the device as an SFTP client

Specifying a source IP address or interface for the SFTP client

You can configure a client to use only a specified source IP address or interface to access the SFTP server, enhancing the service manageability.

To specify a source IP address or interface for the SFTP client:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Specify a source IP address or interface for the SFTP client.	· Specify a source IPv4 address or interface for the SFTP client: sftp client source { ip ip-address \| interface interface-type interface-number } · Specify a source IPv6 address or interface for the SFTP client: sftp client ipv6 source { ipv6 ipv6-address \| interface interface-type interface-number }	Use either command. By default, an SFTP client uses the IP address of the interface specified by the route of the device to access the SFTP server.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Specify a source IP address or interface for the SFTP client.

· Specify a source IPv4 address or interface for the SFTP client:
sftp client source { ip ip-address | interface interface-type interface-number }

· Specify a source IPv6 address or interface for the SFTP client:
sftp client ipv6 source { ipv6 ipv6-address | interface interface-type interface-number }

Use either command.

By default, an SFTP client uses the IP address of the interface specified by the route of the device to access the SFTP server.

Establishing a connection to the SFTP server

This configuration task will enable the SFTP client to establish a connection to the remote SFTP server and enter SFTP client view.

To enable the SFTP client:

Task	Command	Remarks
Establish a connection to the remote SFTP server and enter SFTP client view.	· Establish a connection to the remote IPv4 SFTP server and enter SFTP client view: sftp server [ port-number ] [ vpn-instance vpn-instance-name ] [ identity-key { dsa \| rsa } \| prefer-ctos-cipher { 3des \| aes128 \| des } \| prefer-ctos-hmac { md5 \| md5-96 \| sha1 \| sha1-96 } \| prefer-kex { dh-group-exchange \| dh-group1 \| dh-group14 } \| prefer-stoc-cipher { 3des \| aes128 \| des } \| prefer-stoc-hmac { md5 \| md5-96 \| sha1 \| sha1-96 } ] * · Establish a connection to the remote IPv6 SFTP server and enter SFTP client view: sftp ipv6 server [ port-number ] [ vpn-instance vpn-instance-name ] [ identity-key { dsa \| rsa } \| prefer-ctos-cipher { 3des \| aes128 \| des } \| prefer-ctos-hmac { md5 \| md5-96 \| sha1 \| sha1-96 } \| prefer-kex { dh-group-exchange \| dh-group1 \| dh-group14 } \| prefer-stoc-cipher { 3des \| aes128 \| des } \| prefer-stoc-hmac { md5 \| md5-96 \| sha1 \| sha1-96 } ] *	Use either command in user view.

Task

Command

Remarks

Establish a connection to the remote SFTP server and enter SFTP client view.

· Establish a connection to the remote IPv4 SFTP server and enter SFTP client view:
sftp server [ port-number ] [ vpn-instance vpn-instance-name ] [ identity-key { dsa | rsa } | prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] *

· Establish a connection to the remote IPv6 SFTP server and enter SFTP client view:
sftp ipv6 server [ port-number ] [ vpn-instance vpn-instance-name ] [ identity-key { dsa | rsa } | prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] *

Use either command in user view.

Working with SFTP directories

SFTP directory operations include:

· Changing or displaying the current working directory

· Displaying files under a specified directory or the directory information

· Changing the name of a specified directory on the server

· Creating or deleting a directory

To work with the SFTP directories:

Step	Command	Remarks
1. Enter SFTP client view.	For more information, see “Establishing a connection to the SFTP server.“	Use the command in user view.
2. Change the working directory of the remote SFTP server.	cd [ remote-path ]	Optional.
3. Return to the upper-level directory.	cdup	Optional.
4. Display the current working directory of the remote SFTP server.	pwd	Optional.
5. Display files under a specified directory.	· dir [ -a \| -l ] [ remote-path ] · ls [ -a \| -l ] [ remote-path ]	Optional. The dir command functions as the ls command.
6. Change the name of a specified directory on the SFTP server.	rename oldname newname	Optional.
7. Create a new directory on the remote SFTP server.	mkdir remote-path	Optional.
8. Delete one or more directories from the SFTP server.	rmdir remote-path&<1-10>	Optional.

Working with SFTP files

SFTP file operations include:

· Changing the name of a file

· Downloading a file

· Uploading a file

· Displaying a list of the files

· Deleting a file

To work with SFTP files:

Step	Command	Remarks
1. Enter SFTP client view.	For more information, see “Establishing a connection to the SFTP server.“	Use the command in user view.
2. Change the name of a specified file on the SFTP server.	rename old-name new-name	Optional.
3. Download a file from the remote server and save it locally.	get remote-file [ local-file ]	Optional.
4. Upload a local file to the remote SFTP server.	put local-file [ remote-file ]	Optional.
5. Display the files under a specified directory.	· dir [ -a \| -l ] [ remote-path ] · ls [ -a \| -l ] [ remote-path ]	Optional. The dir command functions as the ls command.
6. Delete one or more directories from the SFTP server.	· delete remote-file&<1-10> · remove remote-file&<1-10>	Optional. The delete command functions as the remove command.

Displaying help information

This configuration task will display a list of all commands or the help information of an SFTP client command, such as the command format and parameters.

To display a list of all commands or the help information of an SFTP client command:

Step	Command	Remarks
1. Enter SFTP client view.	For more information, see “Establishing a connection to the SFTP server.“	Use the command in user view.
2. Display a list of all commands or the help information of an SFTP client command.	help [ all \| command-name ]	N/A

Terminating the connection to the remote SFTP server

To terminate the connection to the remote SFTP server:

Step	Command	Remarks
1. Enter SFTP client view.	For more information, see “Establishing a connection to the SFTP server.“	Use the command in user view.
2. Terminate the connection to the remote SFTP server and return to user view.	· bye · exit · quit	Use any of the commands. These three commands function in the same way.

Step

Command

Remarks

1. Enter SFTP client view.

For more information, see “Establishing a connection to the SFTP server.“

Use the command in user view.

2. Terminate the connection to the remote SFTP server and return to user view.

· bye

· exit

· quit

Use any of the commands.

These three commands function in the same way.

SFTP client configuration example

Network requirements

As shown in Figure 12, an SSH connection is required between Router A and Router B. Router A, an SFTP client, needs to log in to Router B for file management and file transfer. Use publickey authentication and the RSA public key algorithm.

Figure 12 Network diagram

Configuration procedure

NOTE:

During SFTP server configuration, the client public key is required. Use the client software to generate RSA key pairs on the client before configuring the SFTP server.

1. Configure the SFTP client:

# Configure an IP address for interface GigabitEthernet 3/1/1.

<RouterA> system-view

[RouterA] interface GigabitEthernet 3/1/1

[RouterA-GigabitEthernet3/1/1] ip address 192.168.0.2 255.255.255.0

[RouterA-GigabitEthernet3/1/1] quit

# Generate the RSA key pair.

[RouterA] public-key local create rsa

The range of public key size is (512 ~ 2048).

NOTES: If the key modulus is greater than 512,

It will take a few minutes.

Press CTRL+C to abort.

Input the bits of the modulus[default = 1024]:

Generating Keys...

++++++++

++++++++++++++

+++++

++++++++

# Export the host public key to file pubkey.

[RouterA] public-key local export rsa ssh2 pubkey

[RouterA] quit

Then, you need to transmit the public key file to the server through FTP or TFTP.

2. Configure the SFTP server:

# Generate the RSA key pair.

<RouterB> system-view

[RouterB] public-key local create rsa

The range of public key size is (512 ~ 2048).

NOTES: If the key modulus is greater than 512,

It will take a few minutes.

Press CTRL+C to abort.

Input the bits of the modulus[default = 1024]:

Generating Keys...

++++++++

++++++++++++++

+++++

++++++++

# Generate a DSA key pair.

[RouterB] public-key local create dsa

The range of public key size is (512 ~ 2048).

NOTES: If the key modulus is greater than 512,

It will take a few minutes.

Press CTRL+C to abort.

Input the bits of the modulus[default = 1024]:

Generating Keys...

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

+++++++++++++++++++++++++++++++++++

# Enable the SSH server.

[RouterB] ssh server enable

# Enable the SFTP server.

[RouterB] sftp server enable

# Configure an IP address for interface GigabitEthernet 3/1/1, which the client will use as the destination for SSH connection.

[RouterB] interface GigabitEthernet 3/1/1

[RouterB-GigabitEthernet3/1/1] ip address 192.168.0.1 255.255.255.0

[RouterB-GigabitEthernet3/1/1] quit

# Set the authentication mode of the user interfaces to AAA.

[RouterB] user-interface vty 0 4

[RouterB-ui-vty0-4] authentication-mode scheme

# Enable the user interfaces to support SSH.

[RouterB-ui-vty0-4] protocol inbound ssh

[RouterB-ui-vty0-4] quit

# Import the peer public key from the file pubkey.

[RouterB] public-key peer Router001 import sshkey pubkey

# For user client001, set the service type as SFTP, authentication method as publickey, public key as Router001, and working folder as cf:/.

[RouterB] ssh user client001 service-type sftp authentication-type publickey assign publickey Router001 work-directory cf:/

3. Establish a connection between the SFTP client and the SFTP server:

# Establish a connection to the remote SFTP server and enter SFTP client view.

<RouterA> sftp 192.168.0.1 identity-key rsa

Input Username: client001

Trying 192.168.0.1 ...

Press CTRL+K to abort

Connected to 192.168.0.1 ...

The Server is not authenticated. Continue? [Y/N]:y

Do you want to save the server public key? [Y/N]:n

sftp-client>

# Display files under the current directory of the server, delete file z, and check that the file has been deleted successfully.

sftp-client> dir

-rwxrwxrwx 1 noone nogroup 1759 Aug 23 06:52 config.cfg

-rwxrwxrwx 1 noone nogroup 225 Aug 24 08:01 pubkey2

-rwxrwxrwx 1 noone nogroup 283 Aug 24 07:39 pubkey1

drwxrwxrwx 1 noone nogroup 0 Sep 01 06:22 new

-rwxrwxrwx 1 noone nogroup 225 Sep 01 06:55 pub

-rwxrwxrwx 1 noone nogroup 0 Sep 01 08:00 z

sftp-client> delete z

The following File will be deleted:

Are you sure to delete it? [Y/N]:y

This operation might take a long time.Please wait...

File successfully Removed

sftp-client> dir

-rwxrwxrwx 1 noone nogroup 1759 Aug 23 06:52 config.cfg

-rwxrwxrwx 1 noone nogroup 225 Aug 24 08:01 pubkey2

-rwxrwxrwx 1 noone nogroup 283 Aug 24 07:39 pubkey1

drwxrwxrwx 1 noone nogroup 0 Sep 01 06:22 new

-rwxrwxrwx 1 noone nogroup 225 Sep 01 06:55 pub

# Add a directory named new1 and check that it has been created successfully.

sftp-client> mkdir new1

New directory created

sftp-client> dir

-rwxrwxrwx 1 noone nogroup 1759 Aug 23 06:52 config.cfg

-rwxrwxrwx 1 noone nogroup 225 Aug 24 08:01 pubkey2

-rwxrwxrwx 1 noone nogroup 283 Aug 24 07:39 pubkey1

drwxrwxrwx 1 noone nogroup 0 Sep 01 06:22 new

-rwxrwxrwx 1 noone nogroup 225 Sep 01 06:55 pub

drwxrwxrwx 1 noone nogroup 0 Sep 02 06:30 new1

# Rename the directory new1 to new2 and check that the directory name has been changed successfully.

sftp-client> rename new1 new2

File successfully renamed

sftp-client> dir

-rwxrwxrwx 1 noone nogroup 1759 Aug 23 06:52 config.cfg

-rwxrwxrwx 1 noone nogroup 225 Aug 24 08:01 pubkey2

-rwxrwxrwx 1 noone nogroup 283 Aug 24 07:39 pubkey1

drwxrwxrwx 1 noone nogroup 0 Sep 01 06:22 new

-rwxrwxrwx 1 noone nogroup 225 Sep 01 06:55 pub

drwxrwxrwx 1 noone nogroup 0 Sep 02 06:33 new2

# Download the pubkey2 file from the server and save it as local file public.

sftp-client> get pubkey2 public

Remote file:/pubkey2 ---> Local file: public

Downloading file successfully ended

# Upload a local file named pu to the server, save it as puk, and check that the file has been uploaded successfully.

sftp-client> put pu puk

Local file:pu ---> Remote file: /puk

Uploading file successfully ended

sftp-client> dir

-rwxrwxrwx 1 noone nogroup 1759 Aug 23 06:52 config.cfg

-rwxrwxrwx 1 noone nogroup 225 Aug 24 08:01 pubkey2

-rwxrwxrwx 1 noone nogroup 283 Aug 24 07:39 pubkey1

drwxrwxrwx 1 noone nogroup 0 Sep 01 06:22 new

drwxrwxrwx 1 noone nogroup 0 Sep 02 06:33 new2

-rwxrwxrwx 1 noone nogroup 283 Sep 02 06:35 pub

-rwxrwxrwx 1 noone nogroup 283 Sep 02 06:36 puk

sftp-client>

# Terminate the connection with the remote SFTP server.

sftp-client> quit

Bye

Connection closed.

SFTP server configuration example

Network requirements

As shown in Figure 13, an SSH connection is required between the host and the router. The host, an SFTP client, needs to log in to the router for file management and file transfer. Use password authentication and configure the username client002 and the password aabbcc for the client on the router.

Figure 13 Network diagram

Configuration procedure

1. Configure the SFTP server:

# Generate the RSA key pairs.

<Router> system-view

[Router] public-key local create rsa

The range of public key size is (512 ~ 2048).

NOTES: If the key modulus is greater than 512,

It will take a few minutes.

Press CTRL+C to abort.

Input the bits of the modulus[default = 1024]:

Generating Keys...

++++++++

++++++++++++++

+++++

++++++++

# Generate a DSA key pair.

[Router] public-key local create dsa

The range of public key size is (512 ~ 2048).

NOTES: If the key modulus is greater than 512,

It will take a few minutes.

Press CTRL+C to abort.

Input the bits of the modulus[default = 1024]:

Generating Keys...

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

+++++++++++++++++++++++++++++++++++

# Enable the SSH server.

[Router] ssh server enable

# Enable the SFTP server.

[Router] sftp server enable

# Configure an IP address for interface GigabitEthernet 3/1/1, which the client will use as the destination for SSH connection.

[Router] interface GigabitEthernet 3/1/1

[Router-GigabitEthernet3/1/1] ip address 192.168.1.45 255.255.255.0

[Router-GigabitEthernet3/1/1] quit

# Set the authentication mode of the user interfaces to AAA.

[Router] user-interface vty 0 4

[Router-ui-vty0-4] authentication-mode scheme

# Enable the user interfaces to support SSH.

[Router-ui-vty0-4] protocol inbound ssh

[Router-ui-vty0-4] quit

# Configure a local user named client002 with the password being aabbcc and the service type being SSH.

[Router] local-user client002

[Router-luser-client002] password simple aabbcc

[Router-luser-client002] service-type ssh

[Router-luser-client002] quit

# Configure the user authentication method as password and service type as SFTP.

[Router] ssh user client002 service-type sftp authentication-type password

2. Establish a connection between the SFTP client and the SFTP server:

NOTE:

· The device supports a variety of SSH client software. The following takes the PSFTP of PuTTY Version 0.58 as an example.

· The PSFTP supports only password authentication.

# Establish a connection to the remote SFTP server.

Run the psftp.exe to launch the client interface as shown in Figure 14, and enter the following command:

open 192.168.1.45

Enter username client002 and password aabbcc as prompted to log in to the SFTP server.

Figure 14 SFTP client interface

10-Security Configuration Guide

Configuring SSH

SSH overview

How SSH works

SSH connection across VPNs

Configuring the device as an SSH server

Generating DSA or RSA key pairs

Enabling the SSH server function

Configuring the user interfaces for SSH clients

Configuring a client public key

Configuring a client public key manually

Importing a client public key from a public key file

Configuring an SSH user

Configuration guidelines

Configuration procedure

Setting the SSH management parameters

Configuring the device as an SSH client

Disabling first-time authentication

Displaying and maintaining SSH

SSH server configuration examples

Network requirements

Configuration procedure

Network requirements

Configuration procedure

SSH client configuration examples

Network requirements

Configuration procedure

Publickey authentication enabled SSH client configuration example

Network requirements

Configuration procedure

Configuring SFTP

SFTP overview

Configuring the device as an SFTP server

Configuring the SFTP connection idle timeout period

Configuring the device as an SFTP client

Terminating the connection to the remote SFTP server

SFTP client configuration example

Network requirements

Configuration procedure

Network requirements

Configuration procedure

Cloud & AI

InterConnect

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Resources

Partner Business Management

Company Information

News & Events

Contact Us