Login
- Table of Contents
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 08-SSH2.0 Configuration | 384.2 KB |
Configuring the AP as an SSH Server
SSH Server Configuration Task List
Generating an ECDSA or RSA Key Pair
Configuring the User Interfaces for SSH Clients
Configuring a Client Public Key
Setting the SSH Management Parameters
Configuring the AP as an SSH Client
SSH Client Configuration Task List
Specifying a Source IP address/Interface for the SSH client
Configuring Whether First-time Authentication is Supported
Establishing a Connection Between the SSH Client and the Server
Displaying and Maintaining SSH
SSH Server Configuration Examples
When AP Acts as Server for Password Authentication
When AP Acts as Server for Publickey Authentication
SSH Client Configuration Examples
When AP Acts as Client for Password Authentication
When AP Acts as Client for Publickey Authentication
Configuring the SFTP Connection Idle Timeout Period
Specifying a Source IP Address or Interface for the SFTP Client
Establishing a Connection to the SFTP Server
Working with the SFTP Directories
Terminating the Connection to the Remote SFTP Server
SFTP Client Configuration Example
SFTP Server Configuration Example
l Support of the H3C WA series WLAN access points (APs) for features may vary by AP model. For more information, see Feature Matrix.
l The interface types and the number of interfaces vary by AP model.
l The term AP in this document refers to common APs, wireless bridges, and mesh APs.
l The models listed in this document are not applicable to all regions. Please consult your local sales office for the models applicable to your region.
This chapter includes these sections:
l Configuring the AP as an SSH Server
l Configuring the AP as an SSH Client
l Displaying and Maintaining SSH
l SSH Server Configuration Examples
l SSH Client Configuration Examples
SSH2.0 Overview
Introduction to SSH2.0
Secure Shell (SSH) offers an approach to logging into a remote device securely. By encryption and strong authentication, it protects devices against attacks such as IP spoofing and plain text password interception.
The AP can not only work as an SSH server to support connections with SSH clients, but also work as an SSH client to allow users to establish SSH connections with a remote device acting as the SSH server.
Currently, when acting as an SSH server, the AP supports two SSH versions: SSH2.0 and SSH1. When acting as an SSH client, the AP supports SSH2.0 only.
Operation of SSH
The session establishment and interaction between an SSH client and the SSH server involves the following five stages:
Table 1-1 Stages in session establishment and interaction between an SSH client and the server
|
Stages |
Description |
|
SSH1 and SSH2.0 are supported. The two parties negotiate a version to use. |
|
|
SSH supports multiple algorithms. The two parties negotiate an algorithm for communication. |
|
|
The SSH server authenticates the client in response to the client’s authentication request. |
|
|
After passing authentication, the client sends a session request to the server. |
|
|
After the server grants the request, the client and server start to communicate with each other. |
Version negotiation
1) The server opens port 22 to listen to connection requests from clients.
2) The client sends a TCP connection request to the server. After the TCP connection is established, the server sends the first packet to the client, which includes a version identification string in the format of “SSH-<primary protocol version number>.<secondary protocol version number>-<software version number>”. The primary and secondary protocol version numbers constitute the protocol version number, while the software version number is used for debugging.
3) The client receives and resolves the packet. If the protocol version of the server is lower but supportable, the client uses the protocol version of the server; otherwise, the client uses its own protocol version.
4) The client sends to the server a packet that contains the number of the protocol version it decides to use. The server compares the version carried in the packet with that of its own. If the server supports the version, the server and client will use the version. Otherwise, the negotiation fails.
5) If the negotiation is successful, the server and the client proceed with key and algorithm negotiation; otherwise, the server breaks the TCP connection.
All the packets involved in the above steps are transferred in plain text.
Key and algorithm negotiation
l The server and the client send algorithm negotiation packets to each other, which include the supported public key algorithms list, encryption algorithms list, Message Authentication Code (MAC) algorithms list, and compression algorithms list.
l Based on the received algorithm negotiation packets, the server and the client figure out the algorithms to be used. If the negotiation of any type of algorithm fails, the algorithm negotiation fails and the server tears down the connection with the client.
l The server and the client use the DH key exchange algorithm and parameters such as the host key pair to generate the session key and session ID, and the client authenticates the identity of the server.
Through the above steps, the server and client get the same session key and session ID. The session key will be used to encrypt and decrypt data exchanged between the server and client later, and the session ID will be used to identify the session established between the server and client and will be used in the authentication stage.
Before the negotiation, the server must have already generated an ECDSA or RSA key pair, which is not only used for generating the session key, but also used by the client to authenticate the identity of the server. For more information about ECDSA and RSA key pairs, see Public Key in the Security Configuration Guide.
Authentication
SSH provides two authentication methods: password authentication and publickey authentication.
l Password authentication: The server uses AAA for authentication of the client. During password authentication, the client encrypts its username and password, encapsulates them into a password authentication request, and sends the request to the server. Upon receiving the request, the server decrypts the username and password, checks the validity of the username and password locally or by a remote AAA server, and then informs the client of the authentication result.
l Publickey authentication: The server authenticates the client by the digital signature. During publickey authentication, the client sends to the server a publickey authentication request that contains its username, public key, and publickey algorithm information. The server checks whether the public key is valid. If the public key is invalid, the authentication fails; otherwise, the server authenticates the client by the digital signature. Finally, the server sends a message to the client to inform the success or failure of the authentication. Currently, the AP supports two publickey algorithms for digital signature: RSA and ECDSA.
The following gives the steps of the authentication stage:
1) The client sends to the server an authentication request, which includes the username, authentication method (password authentication or publickey authentication), and information related to the authentication method (for example, the password in the case of password authentication).
2) The server authenticates the client. If the authentication fails, the server informs the client by sending a message, which includes a list of available methods for re-authentication.
3) The client selects a method from the list to initiate another authentication.
4) The above process repeats until the authentication succeeds or the failed authentication times exceed the maximum of authentication attempts and the session is torn down.
Besides password authentication and publickey authentication, SSH2.0 provides another two authentication methods:
l password-publickey: Performs both password authentication and publickey authentication if the client is using SSH2.0 and performs either if the client is running SSH1.
l any: Performs either password authentication or publickey authentication.
Session request
After passing authentication, the client sends a session request to the server, while the server listens to and processes the request from the client. After successfully processing the request, the server sends back to the client an SSH_SMSG_SUCCESS packet and goes on to the interactive session stage with the client. Otherwise, the server sends back to the client an SSH_SMSG_FAILURE packet, indicating that the processing fails or it cannot resolve the request.
Interaction
In this stage, the server and the client exchanges data in the following way:
l The client encrypts and sends the command to be executed to the server.
l The server decrypts and executes the command, and then encrypts and sends the result to the client.
l The client decrypts and displays the result on the terminal.
l In the interaction stage, you can execute commands from the client by pasting the commands in text format (the text must be within 2000 bytes). It is recommended that the commands are in the same view; otherwise, the server may not be able to perform the commands correctly.
l If the command text exceeds 2000 bytes, you can execute the commands by saving the text as a configuration file, uploading the configuration file to the server through SFTP, and then using the configuration file to restart the server.
Configuring the AP as an SSH Server
SSH Server Configuration Task List
Complete the following tasks to configure an SSH server:
|
Task |
Remarks |
|
Required |
|
|
Required |
|
|
Required |
|
|
Required for publickey authentication users and optional for password authentication users |
|
|
Optional |
|
|
Optional |
Generating an ECDSA or RSA Key Pair
The ECDSA or RSA key pair will be used to generate the session ID in the key and algorithm negotiation stage and used by the client to authenticate the server.
Follow these steps to generate an ECDSA or RSA key pair on the SSH server:
|
To do… |
Use the command… |
Remarks |
|
Enter system view |
system-view |
— |
|
Generate an ECDSA or RSA key pair |
public-key local create { ecdsa | rsa } |
Required By default, there is neither ECDSA key pair nor RSA key pair. |
l For more information about the public-key local create command, see Public Key in the Security Command Reference.
l To ensure that all SSH clients can log into the SSH server successfully, you are recommended to generate both ECDSA and RSA key pairs on the SSH server. This is because different SSH clients may use different publickey algorithms, though a single client usually uses only one type of publickey algorithm.
l The public-key local create rsa command generates two RSA key pairs: a server key pair and a host key pair. Each of the key pairs consists of a public key and a private key. The public key in the server key pair of the SSH server is used in SSH1 to encrypt the session key for secure transmission of the key. As SSH2 uses the DH algorithm to generate the session key on the SSH server and client respectively, no session key transmission is required in SSH2 and the server key pair is not used.
l The length of the modulus of RSA server keys and host keys must be in the range 512 to 2048 bits. Some SSH2 clients require that the length of the key modulus be at least 768 bits on the SSH server side.
l The maximum length of the modulus of ECDSA host key is 192 bits.
Enabling SSH Server
Follow these steps to enable SSH server:
|
To do… |
Use the command… |
Remarks |
|
Enter system view |
system-view |
— |
|
Enable the SSH server function |
ssh server enable |
Required Disabled by default |
Configuring the User Interfaces for SSH Clients
An SSH client accesses the AP through a VTY user interface. Therefore, you need to configure the user interfaces for SSH clients to allow SSH login. Note that the configuration takes effect only for clients logging in after the configuration.
Follow these steps to configure the protocols for the current user interface to support:
|
To do… |
Use the command… |
Remarks |
|
Enter system view |
system-view |
— |
|
Enter user interface view of one or more user interfaces |
user-interface vty number [ ending-number ] |
— |
|
Set the login authentication mode to scheme |
authentication-mode scheme |
Required By default, the authentication mode is password. |
|
Configure the user interface(s) to support SSH login |
protocol inbound { all | ssh } |
Optional All protocols are supported by default. |
l For more information about the authentication-mode and protocol inbound commands, see Logging In to the AP in the Fundamentals Command Reference.
l If you configure a user interface to support SSH, be sure to configure the corresponding authentication method with the authentication-mode scheme command.
l For a user interface configured to support SSH, you cannot change the authentication mode. To change the authentication mode, undo the SSH support configuration first.
Configuring a Client Public Key
This configuration task is only necessary for SSH users using publickey authentication.
For each SSH user that uses publickey authentication to login, you must configure the client’s RSA host public key on the server, and configure the client to use the corresponding RSA private key.
To configure the public key of an SSH client, you can:
l Configure it manually: You can input or copy the public key to the local host. The copied public key must have not been converted and be in the distinguished encoding rules (DER) encoding format.
l Import it from the public key file: During the import process, the system will automatically convert the public key to a string coded using the Public Key Cryptography Standards (PKCS). Before importing the public key, you must upload the public key file (in binary) to the local host through FTP or TFTP.
l You are recommended to configure a client public key by importing it from a public key file.
l You can configure at most 20 client pubic keys on an SSH server.
Configuring a client public key manually
Follow these steps to configure the client public key manually:
|
To do… |
Use the command… |
Remarks |
|
Enter system view |
system-view |
— |
|
Enter public key view |
public-key peer keyname |
— |
|
Enter public key code view |
public-key-code begin |
— |
|
Configure a client public key |
Enter the content of the public key |
Required Spaces and carriage returns are allowed between characters. |
|
Return from public key code view to public key view |
public-key-code end |
— When you exit public key code view, the system automatically saves the public key. |
|
Return from public key view to system view |
peer-public-key end |
— |
Importing a client public key from a public key file
Follow these steps to import a public key from a public key file:
|
To do… |
Use the command… |
Remarks |
|
Enter system view |
system-view |
— |
|
Import the public key from a public key file |
public-key peer keyname import sshkey filename |
Required |
For information about client side public key configuration and the relevant commands, see Public Key in the Security Configuration Guide and the Security Command Reference.
Configuring an SSH User
This configuration allows you to create an SSH user and specify the service type and authentication mode.
Follow these steps to configure an SSH user and specify the service type and authentication mode:
|
To do… |
Use the command… |
Remarks |
|
|
Enter system view |
system-view |
— |
|
|
Create an SSH user, and specify the service type and authentication mode |
For Stelnet users |
ssh user username service-type stelnet authentication-type { password | { any | password-publickey | publickey } assign publickey keyname } |
Required Use either command. |
|
For all users or SFTP users |
ssh user username service-type { all | sftp } authentication-type { password | { any | password-publickey | publickey } assign publickey keyname work-directory directory-name } |
||
l A user without an SSH account can still pass password authentication and log into the server through Stelnet or SFTP, as long as the user can pass AAA authentication and the service type is SSH.
l An SSH server supports up to 1024 SSH users.
l The service type of an SSH user can be Stelnet (Secure Telnet) or SFTP (Secure FTP). For information about Stelnet, see SSH2.0 Overview. For information about SFTP, see SFTP Overview.
l For successful login through SFTP, you must set the user service type to sftp or all.
l As SSH1 does not support service type sftp, if the client uses SSH1 to log into the server, you must set the service type to stelnet or all on the server. Otherwise, the client will fail to log in.
l The working folder of an SFTP user is subject to the user authentication method. For a user using only password authentication, the working folder is the AAA authorized one. For a user using only publickey authentication or using both the publickey and password authentication methods, the working folder is the one set by using the ssh user command.
l The configured authentication method takes effect only for users logging in after the configuration.
For users using publickey authentication:
l You must configure on the AP the corresponding username and public keys.
l After login, the commands available for a user are determined by the user privilege level, which is configured with the user privilege level command on the user interface.
For users using password authentication:
l You can configure the accounting information either on the AP or on the remote authentication server (such as RADIUS authentication server).
l After login, the commands available to a user are determined by AAA authorization.
Setting the SSH Management Parameters
SSH management includes:
l Enabling the SSH server to be compatible with SSH1 client
l Setting the server key pair update interval, applicable to users using SSH1 client
l Setting the SSH user authentication timeout period
l Setting the maximum number of SSH authentication attempts
Setting the above parameters can help avoid malicious guess at and cracking of the keys and usernames, securing your SSH connections.
Follow these steps to set the SSH management parameters:
|
To do… |
Use the command… |
Remarks |
|
Enter system view |
system-view |
— |
|
Enable the SSH server to support SSH1 clients |
ssh server compatible-ssh1x enable |
Optional By default, the SSH server supports SSH1 clients. |
|
Set the RSA server key pair update interval |
ssh server rekey-interval hours |
Optional 0 by default, that is, the RSA server key pair is not updated. |
|
Set the SSH user authentication timeout period |
ssh server authentication-timeout time-out-value |
Optional 60 seconds by default |
|
Set the maximum number of SSH authentication attempts |
ssh server authentication-retries times |
Optional 3 by default |
Authentication will fail if the number of authentication attempts (including both publickey and password authentication) exceeds that specified in the ssh server authentication-retries command.
Configuring the AP as an SSH Client
SSH Client Configuration Task List
Complete the following tasks to configure an SSH client:
|
Task |
Remarks |
|
Optional |
|
|
Optional |
|
|
Establishing a Connection Between the SSH Client and the Server |
Required |
Specifying a Source IP address/Interface for the SSH client
This configuration task allows you to specify a source IP address or interface for the client to access the SSH server, improving service manageability.
|
To do… |
Use the command… |
Remarks |
|
|
Enter system view |
system-view |
— |
|
|
Specify a source IP address or interface for the SSH client |
Specify a source IPv4 address or interface for the SSH client |
ssh client source { ip ip-address | interface interface-type interface-number } |
Required By default, the address of the interface decided by the routing is used to access the SSH server |
|
Specify a source IPv6 address or interface for the SSH client |
ssh client ipv6 source { ipv6 ipv6-address | interface interface-type interface-number } |
||
Configuring Whether First-time Authentication is Supported
When the AP connects to the SSH server as an SSH client, you can configure whether the AP supports first-time authentication.
l With first-time authentication, when an SSH client not configured with the server host public key accesses the server for the first time, the user can continue accessing the server, and save the host public key on the client. When accessing the server again, the client will use the saved server host public key to authenticate the server.
l Without first-time authentication, a client not configured with the server host public key will deny to access the server. To access the server, a user must configure in advance the server host public key locally and specify the public key name for authentication.
Enabling the AP to support first-time authentication
Follow these steps to enable the AP to support first-time authentication:
|
To do... |
Use the command… |
Remarks |
|
Enter system view |
system-view |
— |
|
Enable the AP to support first-time authentication |
ssh client first-time enable |
Optional By default, first-time authentication is supported on a client. |
Disabling first-time authentication
For successful authentication of an SSH client not supporting first-time authentication, the server host public key must be configured on the client and the public key name must be specified.
Follow these steps to disable first-time authentication:
|
To do... |
Use the command… |
Remarks |
|
Enter system view |
system-view |
— |
|
Disable first-time authentication support |
undo ssh client first-time |
Optional By default, first-time authentication is supported on a client. |
|
Configure the server public key |
Required The method of configuring server public key on the client is similar to that of configuring client public key on the server. |
|
|
Specify the host public key name of the server |
ssh client authentication server server assign publickey keyname |
Required |
Establishing a Connection Between the SSH Client and the Server
Follow these steps to establish the connection between the SSH client and the server:
|
To do... |
Use the command… |
Remarks |
|
|
Establish a connection between the SSH client and server, and specify the public key algorithm, preferred encryption algorithms, preferred HMAC algorithms and preferred key exchange algorithm |
For an IPv4 server |
ssh2 server [ port-number ] [ prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] * |
Required Use either command in user view. |
|
For an IPv4 IPv6 server |
ssh2 ipv6 server [ port-number ] [ prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] * |
||
Displaying and Maintaining SSH
|
To do… |
Use the command… |
Remarks |
|
Display the source IP address or interface currently set for the SFTP client |
display sftp client source |
Available in any view |
|
Display the source IP address or interface currently set for the SSH client |
display ssh client source |
Available in any view |
|
Display SSH server status information or session information on an SSH server |
display ssh server { status | session } |
Available in any view |
|
Display the mappings between SSH servers and their host public keys saved on an SSH client |
display ssh server-info |
Available in any view |
|
Display information about a specified or all SSH users on the SSH server |
display ssh user-information [ username ] |
Available in any view |
|
Display the public keys of the local key pairs |
display public-key local { ecdsa | rsa } public |
Available in any view |
|
Display the public keys of the SSH peers |
display public-key peer [ brief | name publickey-name ] |
Available in any view |
For information about the display public-key local and display public-key peer commands, see Public Key in the Security Command Reference.
SSH Server Configuration Examples
When AP Acts as Server for Password Authentication
Network requirements
l As shown in Figure 1-1, a local SSH connection is established between the host (the SSH client) and the AP (the SSH server) for secure data exchange.
l Password authentication is required. The username and password are saved on the AP.
Figure 1-1 AP acts as server for password authentication
Configuration procedure
1) Configure the SSH server
# Generate RSA and ECDSA key pairs and enable the SSH server.
<AP> system-view
[AP] public-key local create rsa
[AP] public-key local create ecdsa
[AP] ssh server enable
# Configure an IP address for VLAN interface 1. This address will serve as the destination of the SSH connection.
[AP] interface vlan-interface 1
[AP-Vlan-interface1] ip address 192.168.1.40 255.255.255.0
[AP-Vlan-interface1] quit
# Set the authentication mode for the user interfaces to AAA.
[AP] user-interface vty 0 4
[AP-ui-vty0-4] authentication-mode scheme
# Set the protocol that a remote user uses for login as SSH.
[AP-ui-vty0-4] protocol inbound ssh
[AP-ui-vty0-4] quit
# Create local user client001, and set the user command privilege level to 3
[AP] local-user client001
[AP-luser-client001] password simple aabbcc
[AP-luser-client001] service-type ssh
[AP-luser-client001] authorization-attribute level 3
[AP-luser-client001] quit
# Specify the service type for user client001 as Stelnet, and the authentication mode as password. This step is optional.
[AP] ssh user client001 service-type stelnet authentication-type password
2) Configure the SSH client
There are many kinds of SSH client software, such as PuTTY, and OpenSSH. The following is an example of configuring SSH client using Putty Version 0.58.
# Establish a connection with the SSH server
Launch PuTTY.exe to enter the following interface. In the Host Name (or IP address) text box, enter the IP address of the server (192.168.1.40).
Figure 1-2 SSH client configuration interface
In the window shown in Figure 1-2, click Open. If the connection is normal, you will be prompted to enter the username and password. After entering the correct username (client001) and password (aabbcc), you can enter the configuration interface.
When AP Acts as Server for Publickey Authentication
Network requirements
l As shown in Figure 1-3, a local SSH connection is established between the host (the SSH client) and the AP (the SSH server) for secure data exchange.
l Publickey authentication is used, the algorithm is RSA.
Figure 1-3 AP acts as server for publickey authentication
Configuration procedure
1) Configure the SSH server
# Generate RSA and ECDSA key pairs and enable SSH server.
<AP> system-view
[AP] public-key local create rsa
[AP] public-key local create ecdsa
[AP] ssh server enable
# Configure an IP address for VLAN interface 1. This address will serve as the destination of the SSH connection.
[AP] interface vlan-interface 1
[AP-Vlan-interface1] ip address 192.168.1.40 255.255.255.0
[AP-Vlan-interface1] quit
# Set the authentication mode for the user interfaces to AAA.
[AP] user-interface vty 0 4
[AP-ui-vty0-4] authentication-mode scheme
# Set the protocol that a remote user uses for login as SSH.
[AP-ui-vty0-4] protocol inbound ssh
# Set the user command privilege level to 3.
[AP-ui-vty0-4] user privilege level 3
[AP-ui-vty0-4] quit
Before performing the following tasks, you must use the client software to generate an RSA key pair on the client, save the public key in a file named key.pub, and then upload the file to the SSH server through FTP or TFTP. For more information, see Configure the SSH client below.
# Import the client’s public key from file key.pub and name it AP001.
[AP] public-key peer AP001 import sshkey key.pub
# Specify the authentication type for user client002 as publickey, and assign the public key AP001 to the user.
[AP] ssh user client002 service-type stelnet authentication-type publickey assign publickey AP001
# Generate an RSA key pair.
Run PuTTYGen.exe, select SSH-2 RSA and click Generate.
Figure 1-4 Generate a client key pair 1)
While generating the key pair, you must move the mouse continuously and keep the mouse off the green process bar shown in Figure 1-5. Otherwise, the process bar stops moving and the key pair generating process will be stopped.
Figure 1-5 Generate a client key pair 2)
After the key pair is generated, click Save public key and specify the file name as key.pub to save the public key.
Figure 1-6 Generate a client key pair 3)
Likewise, to save the private key, click Save private key. A warning window pops up to prompt you whether to save the private key without any protection. Click Yes and enter the name of the file for saving the key (private in this case).
Figure 1-7 Generate a client key pair 4)
After generating a key pair on a client, you need to transmit the saved public key file to the server through FTP or TFTP and have the configuration on the server done before continuing configuration of the client.
# Specify the private key file and establish a connection with the SSH server
Launch PuTTY.exe to enter the following interface. In the Host Name (or IP address) text box, enter the IP address of the server (192.168.1.40).
Figure 1-8 SSH client configuration interface 1)
Select Connection/SSH/Auth from the navigation tree. The following window appears. Click Browse… to bring up the file selection window, navigate to the private key file and click OK.
Figure 1-9 SSH client configuration interface 2)
In the window shown in Figure 1-9, click Open. If the connection is normal, you will be prompted to enter the username. After entering the correct username (client002), you can enter the configuration interface.
SSH Client Configuration Examples
When AP Acts as Client for Password Authentication
Network requirements
l As shown in Figure 1-10, the AP (the SSH client) needs to log into the Switch (the SSH server) through the SSH protocol.
l The username of the SSH client is client001 and the password is aabbcc. Password authentication is required.
Figure 1-10 AP acts as client for password authentication
Configuration procedure
1) Configure the SSH server
# Create RSA and ECDSA key pairs and enable the SSH server.
<Switch> system-view
[Switch] public-key local create rsa
[Switch] public-key local create ecdsa
[Switch] ssh server enable
# Create an IP address for VLAN interface 1, which the SSH client will use as the destination for SSH connection.
[Switch] interface vlan-interface 1
[Switch-Vlan-interface1] ip address 10.165.87.136 255.255.255.0
[Switch-Vlan-interface1] quit
# Set the authentication mode for the user interfaces to AAA.
[Switch] user-interface vty 0 4
[Switch-ui-vty0-4] authentication-mode scheme
# Set the protocol that a remote user uses for login as SSH.
[Switch-ui-vty0-4] protocol inbound ssh
[Switch-ui-vty0-4] quit
# Create local user client001.
[Switch] local-user client001
[Switch-luser-client001] password simple aabbcc
[Switch-luser-client001] service-type ssh
[Switch-luser-client001] authorization-attribute level 3
[Switch-luser-client001] quit
# Specify the service type for user client001 as Stelnet, and the authentication type as password. This step is optional.
[Switch] ssh user client001 service-type stelnet authentication-type password
2) Configure the SSH client
# Configure an IP address for VLAN interface 1.
<AP> system-view
[AP] interface vlan-interface 1
[AP-Vlan-interface1] ip address 10.165.87.137 255.255.255.0
[AP-Vlan-interface1] quit
[AP] quit
l If the client support first-time authentication, you can directly establish a connection from the client to the server.
# Establish an SSH connection to server 10.165.87.136.
<AP> ssh2 10.165.87.136
Username: client001
Trying 10.165.87.136 ...
Press CTRL+K to abort
Connected to 10.165.87.136 ...
The Server is not authenticated. Continue? [Y/N]:y
Do you want to save the server public key? [Y/N]:n
Enter password:
After you enter the correct username, you can log into Switch B successfully.
l If the client does not support first-time authentication, you need to perform the following configurations.
# Disable first-time authentication.
[AP] undo ssh client first-time
# Configure the host public key of the SSH server. You can get the server host public key by using the display public-key local rsa public command on the server.
[AP] public-key peer key1
[AP-pkey-public-key] public-key-code begin
[AP-pkey-key-code]308201B73082012C06072A8648CE3804013082011F0281810
0D757262C4584C44C211F18BD96E5F0
[AP-pkey-key-code]61C4F0A423F7FE6B6B85B34CEF72CE14A0D3A5222FE08CECE
65BE6C265854889DC1EDBD13EC8B274
[AP-pkey-key-code]DA9F75BA26CCB987723602787E922BA84421F22C3C89CB9B0
6FD60FE01941DDD77FE6B12893DA76E
[AP-pkey-key-code]EBC1D128D97F0678D7722B5341C8506F358214B16A2FAC4B3
68950387811C7DA33021500C773218C
[AP-pkey-key-code]737EC8EE993B4F2DED30F48EDACE915F0281810082269009E
14EC474BAF2932E69D3B1F18517AD95
[AP-pkey-key-code]94184CCDFCEAE96EC4D5EF93133E84B47093C52B20CD35D02
492B3959EC6499625BC4FA5082E22C5
[AP-pkey-key-code]B374E16DD00132CE71B020217091AC717B612391C76C1FB2E
88317C1BD8171D41ECB83E210C03CC9
[AP-pkey-key-code]B32E810561C21621C73D6DAAC028F4B1585DA7F42519718CC
9B09EEF0381840002818000AF995917
[AP-pkey-key-code]E1E570A3F6B1C2411948B3B4FFA256699B3BF871221CC9C5D
F257523777D033BEE77FC378145F2AD
[AP-pkey-key-code]D716D7DB9FCABB4ADBF6FB4FDB0CA25C761B308EF53009F71
01F7C62621216D5A572C379A32AC290
[AP-pkey-key-code]E55B394A217DA38B65B77F0185C8DB8095522D1EF044B465E
8716261214A5A3B493E866991113B2D
[AP-pkey-key-code]485348
[AP-pkey-key-code] public-key-code end
[AP-pkey-public-key] peer-public-key end
# Specify the host public key for the SSH server (10.165.87.136) as key1.
[AP] ssh client authentication server 10.165.87.136 assign publickey key1
[AP] quit
# Establish an SSH connection to server 10.165.87.136.
<AP> ssh2 10.165.87.136
Username: client001
Trying 10.165.87.136
Press CTRL+K to abort
Connected to 10.165.87.136...
Enter password:
After you enter the correct username and password, you can log into the Switch successfully.
When AP Acts as Client for Publickey Authentication
Network requirements
l As shown in Figure 1-11, the AP (the SSH client) needs to log into the Switch (the SSH server) through the SSH protocol.
l Publickey authentication is used, and the public key algorithm is ECDSA.
Figure 1-11 AP acts as client for publickey authentication
Configuration procedure
1) Configure the SSH server
# Generate RSA and ECDSA key pairs and enable SSH server.
<Switch> system-view
[Switch] public-key local create rsa
[Switch] public-key local create ecdsa
[Switch] ssh server enable
# Configure an IP address for VLAN interface 1, which the SSH client will use as the destination for SSH connection.
[Switch] interface vlan-interface 1
[Switch-Vlan-interface1] ip address 10.165.87.136 255.255.255.0
[Switch-Vlan-interface1] quit
# Set the authentication mode for the user interfaces to AAA.
[Switch] user-interface vty 0 4
[Switch-ui-vty0-4] authentication-mode scheme
# Set the protocol that a remote user uses for login as SSH.
[Switch-ui-vty0-4] protocol inbound ssh
# Set the user command privilege level to 3.
[Switch-ui-vty0-4] user privilege level 3
[Switch-ui-vty0-4] quit
Before performing the following tasks, you must use the client software to generate an ECDSA key pair on the client, save the public key in a file named key.pub, and then upload the file to the SSH server through FTP or TFTP. For more information, see Configure the SSH client below.
# Import the peer public key from the file key.pub.
[Switch] public-key peer AP001 import sshkey key.pub
# Specify the authentication type for user client002 as publickey, and assign the public key AP001 to the user.
[Switch] ssh user client002 service-type stelnet authentication-type publickey assign publickey AP001
# Configure an IP address for Vlan interface 1.
<AP> system-view
[AP] interface vlan-interface 1
[AP-Vlan-interface1] ip address 10.165.87.137 255.255.255.0
[AP-Vlan-interface1] quit
# Generate an ECDSA key pair.
[AP] public-key local create ecdsa
# Export the ECDSA public key to the file key.pub.
[AP] public-key local export ecdsa ssh2 key.pub
[AP] quit
After generating a key pair on a client, you need to transmit the saved public key file to the server through FTP or TFTP and have the configuration on the server done before continuing configuration of the client.
# Establish an SSH connection to the server (10.165.87.136).
<AP> ssh2 10.165.87.136
Username: client002
Trying 10.165.87.136 ...
Press CTRL+K to abort
Connected to 10.165.87.136 ...
The Server is not authenticated. Continue? [Y/N]:y
Do you want to save the server public key? [Y/N]:n
Later, you will find that you have logged into the Switch successfully.
This chapter includes these sections:
l SFTP Client Configuration Example
l SFTP Server Configuration Example
SFTP Overview
The secure file transfer protocol (SFTP) is a new feature in SSH2.0.
SFTP uses the SSH connection to provide secure data transfer. The AP can serve as the SFTP server, allowing a remote user to log into the SFTP server for secure file management and transfer. The AP can also server as an SFTP client, enabling a user to login from the AP to a remote device for secure file transfer.
Configuring an SFTP Server
Configuration Prerequisites
l You have configured the SSH server. For the configuration procedure, see Configuring the AP as an SSH Server.
l You have used the ssh user service-type command to set the service type of SSH users to sftp or all. For the configuration procedure, see Configuring an SSH User.
Enabling the SFTP Server
This configuration task is to enable the SFTP service so that a client can log into the SFTP server through SFTP.
Follow these steps to enable the SFTP server:
|
To do… |
Use the command… |
Remarks |
|
Enter system view |
system-view |
— |
|
Enable the SFTP server |
sftp server enable |
Required Disabled by default |
When the AP functions as the SFTP server, only one client can access the SFTP server at a time. If the SFTP client uses WinSCP, a file on the server cannot be modified directly; it can only be downloaded to a local place, modified, and then uploaded to the server.
Configuring the SFTP Connection Idle Timeout Period
Once the idle period of an SFTP connection exceeds the specified threshold, the system automatically tears the connection down, so that a user cannot occupy a connection for nothing.
Follow these steps to configure the SFTP connection idle timeout period:
|
To do… |
Use the command… |
Remarks |
|
Enter system view |
system-view |
— |
|
Configure the SFTP connection idle timeout period |
sftp server idle-timeout time-out-value |
Optional 10 minutes by default |
Configuring an SFTP Client
Specifying a Source IP Address or Interface for the SFTP Client
You can configure a client to use only a specified source IP address or interface to access the SFTP server, thus enhancing the service manageability.
Follow these steps to specify a source IP address or interface for the SFTP client:
|
To do… |
Use the command… |
Remarks |
|
|
Enter system view |
system-view |
— |
|
|
Specify a source IP address or interface for the SFTP client |
Specify a source IPv4 address or interface for the SFTP client |
sftp client source { ip ip-address | interface interface-type interface-number } |
Required Use either command. By default, an SFTP client uses the interface address specified by the route of the AP to access the SFTP server. |
|
Specify a source IPv6 address or interface for the SFTP client |
sftp client ipv6 source { ipv6 ipv6-address | interface interface-type interface-number } |
||
Establishing a Connection to the SFTP Server
This configuration task is to enable the SFTP client to establish a connection with the remote SFTP server and enter SFTP client view.
Follow these steps to enable the SFTP client:
|
To do… |
Use the command… |
Remarks |
|
|
Establish a connection to the remote SFTP server and enter SFTP client view |
Establish a connection to the remote IPv4 SFTP server and enter SFTP client view |
sftp server [ port-number ] [ prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] * |
Required Use either command in user view. |
|
Establish a connection to the remote IPv6 SFTP server and enter SFTP client view |
sftp ipv6 server [ port-number ] [ prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] * |
||
Working with the SFTP Directories
SFTP directory operations include:
l Changing or displaying the current working directory
l Displaying files under a specified directory or the directory information
l Changing the name of a specified directory on the server
l Creating or deleting a directory
Follow these steps to work with the SFTP directories:
|
To do… |
Use the command… |
Remarks |
|
Enter SFTP client view |
sftp [ ipv6 ] server [ port-number ] [ prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] * |
Required Execute the command in user view. |
|
Change the working directory of the remote SFTP server |
cd [ remote-path ] |
Optional |
|
Return to the upper-level directory |
cdup |
Optional |
|
Display the current working directory of the remote SFTP server |
pwd |
Optional |
|
Display files under a specified directory |
dir [ -a | -l ] [ remote-path ] |
Optional The dir command functions as the ls command. |
|
ls [ -a | -l ] [ remote-path ] |
||
|
Change the name of a specified directory on the SFTP server |
rename oldname newname |
Optional |
|
Create a new directory on the remote SFTP server |
mkdir remote-path |
Optional |
|
Delete a directory from the SFTP server |
rmdir remote-path&<1-10> |
Optional |
Working with SFTP Files
l Changing the name of a file
l Downloading a file
l Uploading a file
l Displaying a list of the files
l Deleting a file
Follow these steps to work with SFTP files:
|
To do… |
Use the command… |
Remarks |
|
Enter SFTP client view |
sftp [ ipv6 ] server [ port-number ] [ prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] * |
Required Execute the command in user view. |
|
Change the name of a specified file or directory on the SFTP server |
rename old-name new-name |
Optional |
|
Download a file from the remote server and save it locally |
get remote-file [ local-file ] |
Optional |
|
Upload a local file to the remote SFTP server |
put local-file [ remote-file ] |
Optional |
|
Display the files under a specified directory |
dir [ -a | -l ] [ remote-path ] |
Optional The dir command functions as the ls command. |
|
ls [ -a | -l ] [ remote-path ] |
||
|
Delete a file from the SFTP server |
delete remote-file&<1-10> |
Optional The delete command functions as the remove command. |
|
remove remote-file&<1-10> |
Displaying Help Information
This configuration task is to display a list of all commands or the help information of an SFTP client command, such as the command format and parameters.
Follow these steps to display a list of all commands or the help information of an SFTP client command:
|
To do… |
Use the command… |
Remarks |
|
Enter SFTP client view |
sftp [ ipv6 ] server [ port-number ] [ prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] * |
Required Execute the command in user view. |
|
Display a list of all commands or the help information of an SFTP client command |
help [ all | command-name ] |
Required |
Terminating the Connection to the Remote SFTP Server
Follow these steps to terminate the connection to the remote SFTP server:
|
To do… |
Use the command… |
Remarks |
|
Enter SFTP client view |
sftp [ ipv6 ] server [ port-number ] [ prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] * |
Required Execute the command in user view. |
|
Terminate the connection to the remote SFTP server and return to user view |
bye |
Required. These three commands function in the same way. |
|
exit |
||
|
quit |
SFTP Client Configuration Example
Network requirements
As shown in Figure 2-1, an SSH connection is established between the AP and the Switch. The AP, an SFTP client, logs in to the Switch for file management and file transfer. An SSH user uses publickey authentication with the public key algorithm being RSA.
Figure 2-1 Network diagram for SFTP client configuration
Configuration procedure
1) Configure the SFTP server
# Generate RSA and ECDSA key pairs and enable the SSH server.
<Switch> system-view
[Switch] public-key local create rsa
[Switch] public-key local create ecdsa
[Switch] ssh server enable
# Enable the SFTP server.
[Switch] sftp server enable
# Configure an IP address for VLAN interface 1, which the SSH client uses as the destination for SSH connection.
[Switch] interface vlan-interface 1
[Switch-Vlan-interface1] ip address 192.168.0.1 255.255.255.0
[Switch-Vlan-interface1] quit
# Set the authentication mode on the user interfaces to AAA.
[Switch] user-interface vty 0 4
[Switch-ui-vty0-4] authentication-mode scheme
# Set the protocol that a remote user uses for login as SSH.
[Switch-ui-vty0-4] protocol inbound ssh
[Switch-ui-vty0-4] quit
Before performing the following tasks, you must generate use the client software to generate an RSA key pair on the client, save the host public key in a file named pubkey, and then upload the file to the SSH server through FTP or TFTP. For more information, see Configure the SFTP client below.
# Import the peer public key from the file pubkey.
[Switch] public-key peer AP001 import sshkey pubkey
# For user client001, set the service type as SFTP, authentication type as publickey, public key as AP001, and working folder as flash:/
[Switch] ssh user client001 service-type sftp authentication-type publickey assign publickey AP001 work-directory flash:/
# Configure an IP address for VLAN interface 1.
<AP> system-view
[AP] interface vlan-interface 1
[AP-Vlan-interface1] ip address 192.168.0.2 255.255.255.0
[AP-Vlan-interface1] quit
# Generate RSA key pairs.
[AP] public-key local create rsa
# Export the host public key to file pubkey.
[AP] public-key local export rsa ssh2 pubkey
[AP] quit
After generating key pairs on a client, you need to transmit the saved public key file to the server through FTP or TFTP and have the configuration on the server done before continuing configuration of the client.
# Establish a connection to the remote SFTP server and enter SFTP client view.
<AP> sftp 192.168.0.1 identity-key rsa
Input Username: client001
Trying 192.168.0.1 ...
Press CTRL+K to abort
Connected to 192.168.0.1 ...
The Server is not authenticated. Continue? [Y/N]:y
Do you want to save the server public key? [Y/N]:n
sftp-client>
# Display files under the current directory of the server, delete the file named z, and check if the file has been deleted successfully.
sftp-client> dir
-rwxrwxrwx 1 noone nogroup 1759 Aug 23 06:52 config.cfg
-rwxrwxrwx 1 noone nogroup 225 Aug 24 08:01 pubkey2
-rwxrwxrwx 1 noone nogroup 283 Aug 24 07:39 pubkey
drwxrwxrwx 1 noone nogroup 0 Sep 01 06:22 new
-rwxrwxrwx 1 noone nogroup 225 Sep 01 06:55 pub
-rwxrwxrwx 1 noone nogroup 0 Sep 01 08:00 z
sftp-client> delete z
The following File will be deleted:
/z
Are you sure to delete it? [Y/N]:y
This operation may take a long time.Please wait...
File successfully Removed
sftp-client> dir
-rwxrwxrwx 1 noone nogroup 1759 Aug 23 06:52 config.cfg
-rwxrwxrwx 1 noone nogroup 225 Aug 24 08:01 pubkey2
-rwxrwxrwx 1 noone nogroup 283 Aug 24 07:39 pubkey
drwxrwxrwx 1 noone nogroup 0 Sep 01 06:22 new
-rwxrwxrwx 1 noone nogroup 225 Sep 01 06:55 pub
# Add a directory named new1 and check if it has been created successfully.
sftp-client> mkdir new1
New directory created
sftp-client> dir
-rwxrwxrwx 1 noone nogroup 1759 Aug 23 06:52 config.cfg
-rwxrwxrwx 1 noone nogroup 225 Aug 24 08:01 pubkey2
-rwxrwxrwx 1 noone nogroup 283 Aug 24 07:39 pubkey
drwxrwxrwx 1 noone nogroup 0 Sep 01 06:22 new
-rwxrwxrwx 1 noone nogroup 225 Sep 01 06:55 pub
drwxrwxrwx 1 noone nogroup 0 Sep 02 06:30 new1
# Rename directory new1 to new2 and check if the directory has been renamed successfully.
sftp-client> rename new1 new2
File successfully renamed
sftp-client> dir
-rwxrwxrwx 1 noone nogroup 1759 Aug 23 06:52 config.cfg
-rwxrwxrwx 1 noone nogroup 225 Aug 24 08:01 pubkey2
-rwxrwxrwx 1 noone nogroup 283 Aug 24 07:39 pubkey
drwxrwxrwx 1 noone nogroup 0 Sep 01 06:22 new
-rwxrwxrwx 1 noone nogroup 225 Sep 01 06:55 pub
drwxrwxrwx 1 noone nogroup 0 Sep 02 06:33 new2
# Download the file pubkey2 from the server and change the name to public.
sftp-client> get pubkey2 public
Remote file:/pubkey2 ---> Local file: public
Downloading file successfully ended
# Upload the local file pu to the server, save it as puk, and check if the file has been uploaded successfully.
sftp-client> put pu puk
Local file:pu ---> Remote file: /puk
Uploading file successfully ended
sftp-client> dir
-rwxrwxrwx 1 noone nogroup 1759 Aug 23 06:52 config.cfg
-rwxrwxrwx 1 noone nogroup 225 Aug 24 08:01 pubkey2
-rwxrwxrwx 1 noone nogroup 283 Aug 24 07:39 pubkey
drwxrwxrwx 1 noone nogroup 0 Sep 01 06:22 new
drwxrwxrwx 1 noone nogroup 0 Sep 02 06:33 new2
-rwxrwxrwx 1 noone nogroup 283 Sep 02 06:35 pub
-rwxrwxrwx 1 noone nogroup 283 Sep 02 06:36 puk
sftp-client>
# Terminate the connection to the remote SFTP server.
sftp-client> quit
Bye
Connection closed.
<AP>
SFTP Server Configuration Example
Network requirements
As shown in Figure 2-2, an SSH connection is established between the host and the AP. The host, an SFTP client, logs into the AP for file management and file transfer. An SSH user uses password authentication with the username being client002 and the password being aabbcc. The username and password are saved on the switch.
Figure 2-2 Network diagram for SFTP server configuration
Configuration procedure
1) Configure the SFTP server
# Generate RSA and ECDSA key pairs and enable the SSH server.
<AP> system-view
[AP] public-key local create rsa
[AP] public-key local create ecdsa
[AP] ssh server enable
# Enable the SFTP server.
[AP] sftp server enable
# Configure an IP address for VLAN-interface 1, which the client will use as the destination for SSH connection.
[AP] interface vlan-interface 1
[AP-Vlan-interface1] ip address 192.168.1.45 255.255.255.0
[AP-Vlan-interface1] quit
# Set the authentication mode of the user interfaces to AAA.
[AP] user-interface vty 0 4
[AP-ui-vty0-4] authentication-mode scheme
# Set the protocol that a remote user uses for login as SSH.
[AP-ui-vty0-4] protocol inbound ssh
[AP-ui-vty0-4] quit
# Configure a local user named client002 with the password being aabbcc and the service type being SSH.
[AP] local-user client002
[AP-luser-client002] password simple aabbcc
[AP-luser-client002] service-type ssh
[AP-luser-client002] quit
# Configure the user authentication type as password and service type as SFTP.
[AP] ssh user client002 service-type sftp authentication-type password
2) Configure the SFTP client
l There are many kinds of SFTP client software. The following takes the PSFTP of Putty Version 0.58 as an example.
l The PSFTP supports only password authentication.
# Establish a connection with the remote SFTP server.
Run the psftp.exe to launch the client interface as shown in Figure 2-3, and enter the following command:
open 192.168.1.45
Enter username client002 and password aabbcc as prompted to log into the SFTP server.
Figure 2-3 SFTP client interface
