Secure Shell (SSH) is a network security protocol. Using encryption and authentication, SSH can implement secure remote access and file transfer over an insecure network.

SSH uses the typical client-server model to establish a channel for secure data transfer based on TCP.

SSH includes two versions: SSH1.x and SSH2.0 (hereinafter referred to as SSH1 and SSH2), which are not compatible. SSH2 is better than SSH1 in performance and security.

Use this MIB to configure the SSH service.

Root object

iso(1).org(3).dod(6).internet(1).private(4).enterprises(1).hh3c(25506).hh3cCommon(2).hh3cSSH(22)

Scalar objects

hh3cSSHServerVersion (1.3.6.1.4.1.25506.2.22.1.1.1.1)

Object (OID)	Access	Syntax	Value range	Description	Implementation
hh3cSSHServerVersion (1.3.6.1.4.1.25506.2.22.1.1.1.1)	read-only	DisplayString	Standard MIB values.	The SSH protocol version of the SSH server.	The default value is 2.00. It is not compatible with SSH 1.x versions.

hh3cSSHServerCompatibleSSH1x (1.3.6.1.4.1.25506.2.22.1.1.1.2)

Object (OID)

Access

Syntax

Value range

Description

Implementation

hh3cSSHServerCompatibleSSH1x (1.3.6.1.4.1.25506.2.22.1.1.1.2)

read-write

INTEGER

enableCompatibleSSH1x(1),

disableCompatibleSSH1x(2)

Compatibility with SSH 1.x versions.

The default value is disableCompatibleSSH1x(2).

hh3cSSHServerRekeyInterval (1.3.6.1.4.1.25506.2.22.1.1.1.3)

Object (OID)

Access

Syntax

Value range

Description

Implementation

hh3cSSHServerRekeyInterval (1.3.6.1.4.1.25506.2.22.1.1.1.3)

read-write

Integer32

Standard MIB values.

Time interval at which the SSH server key is regenerated.

Value range: 0 to 24.

The default value is 0, meaning that the key will not be refreshed.

hh3cSSHServerAuthRetries (1.3.6.1.4.1.25506.2.22.1.1.1.4)

Object (OID)

Access

Syntax

Value range

Description

Implementation

hh3cSSHServerAuthRetries (1.3.6.1.4.1.25506.2.22.1.1.1.4)

read-write

Integer32

Standard MIB values.

Maximum number of SSH server authentication retries.

Range from 1 to 5.

The default value is 3.

hh3cSSHServerAuthTimeout (1.3.6.1.4.1.25506.2.22.1.1.1.5)

Object (OID)

Access

Syntax

Value range

Description

Implementation

hh3cSSHServerAuthTimeout (1.3.6.1.4.1.25506.2.22.1.1.1.5)

read-write

Integer32

Standard MIB values.

SSH server authentication timeout time.

Range from 1 to 120.

The default value is 60.

hh3cSFTPServerIdleTimeout (1.3.6.1.4.1.25506.2.22.1.1.1.6)

Object (OID)

Access

Syntax

Value range

Description

Implementation

hh3cSFTPServerIdleTimeout (1.3.6.1.4.1.25506.2.22.1.1.1.6)

read-write

Integer32

Standard MIB values.

SFTP connection idle timeout time.

Range from 1 to 35791.

The default value is 10.

hh3cSSHServerEnable (1.3.6.1.4.1.25506.2.22.1.1.1.7)

Object (OID)

Access

Syntax

Value range

Description

Implementation

hh3cSSHServerEnable (1.3.6.1.4.1.25506.2.22.1.1.1.7)

read-write

INTEGER

enableSSHServer(1),

disableSSHServer(2)

Enable or disable the SSH server.

The default value is disableSSHServer(2).

hh3cSFTPServerEnable (1.3.6.1.4.1.25506.2.22.1.1.1.8)

Object (OID)

Access

Syntax

Value range

Description

Implementation

hh3cSFTPServerEnable (1.3.6.1.4.1.25506.2.22.1.1.1.8)

read-write

INTEGER

enableSFTPService(1),

disableSFTPService(2)

Enable or disable the SFTP server.

The default value is disableSFTPService(2).

hh3cSTelnetServerEnable (1.3.6.1.4.1.25506.2.22.1.1.1.9)

Object (OID)

Access

Syntax

Value range

Description

Implementation

hh3cSTelnetServerEnable (1.3.6.1.4.1.25506.2.22.1.1.1.9)

read-write

INTEGER

enableSTelnetService(1),

disableSTelnetService(2)

Enable or disable Stelnet server.

As per the MIB.

hh3cSCPServerEnable (1.3.6.1.4.1.25506.2.22.1.1.1.10)

Object (OID)

Access

Syntax

Value range

Description

Implementation

hh3cSCPServerEnable (1.3.6.1.4.1.25506.2.22.1.1.1.10)

read-write

INTEGER

enableSCPServer(1),

disableSCPServer(2)

Enable or disable SCP server.

As per the MIB.

hh3cSSHAttemptUserName (1.3.6.1.4.1.25506.2.22.1.2.1)

Object (OID)	Access	Syntax	Value range	Description	Implementation
hh3cSSHAttemptUserName (1.3.6.1.4.1.25506.2.22.1.2.1)	accessible-for-notify	DisplayString	Standard MIB values.	Name of the user who failed to connect to the server.	Length: 1 to 255 characters.

hh3cSSHAttemptIpAddrType (1.3.6.1.4.1.25506.2.22.1.2.2)

Object (OID)

Access

Syntax

Value range

Description

Implementation

hh3cSSHAttemptIpAddrType (1.3.6.1.4.1.25506.2.22.1.2.2)

accessible-for-notify

InetAddressType

INTEGER{

unknown(0),

ipv4(1),

ipv6(2),

dns(16)

}

Address type of the user who failed to connect to the server.

As per the MIB.

hh3cSSHAttemptIpAddr (1.3.6.1.4.1.25506.2.22.1.2.3)

Object (OID)	Access	Syntax	Value range	Description	Implementation
hh3cSSHAttemptIpAddr (1.3.6.1.4.1.25506.2.22.1.2.3)	accessible-for-notify	InetAddress	OCTET STRING (0..255)	Address of user who failed to connect to the server.	As per the MIB.

hh3cSSHUserAuthFailureReason (1.3.6.1.4.1.25506.2.22.1.2.4)

Object (OID)

Access

Syntax

Value range

Description

Implementation

hh3cSSHUserAuthFailureReason (1.3.6.1.4.1.25506.2.22.1.2.4)

accessible-for-notify

INTEGER

exceedRetries(1),

authTimeout(2),

otherReason(3)

Reason for the connection failure.

As per the MIB.

(1.3.6.1.4.1.25506.2.22.1.2.10)

Object (OID)

Access

Syntax

Value range

Description

Implementation

hh3cSSHStatisticPeriod

(1.3.6.1.4.1.25506.2.22.1.2.10)

accessible-for-notify

Unsigned32

(1..120)

Authentication failure statistics period.

As per the MIB.

Tabular objects

hh3cSSHUserConfigTable

About this table

Use this table to configure or obtain SSH user information.

Support for operations

Create：Supported

Edit/Modify：Supported

Delete：Supported

Read：Supported

Columns

The table index is hh3cSSHUserName.

Object (OID)	Access	Syntax	Value range	Description	Implementation
hh3cSSHUserName (1.3.6.1.4.1.25506.2.22.1.1.2.1.1.1)	not-accessible	DisplayString	Standard MIB values.	Name of an SSH user.	Length: 1 to 255 characters.
hh3cSSHUserServiceType (1.3.6.1.4.1.25506.2.22.1.1.2.1.1.2)	read-create	INTEGER	invalid(1), all(2), stelnet(3), sftp(4), scp(5), netconf(6)	Service type of the SSH user.	The default value is invalid(1).
hh3cSSHUserAuthType (1.3.6.1.4.1.25506.2.22.1.1.2.1.1.3)	read-create	INTEGER	invalid(1), password(2), publicKey(3), any(4), publicKeyPassword(5), keyboardInteractive(6)	Authentication type for the SSH user.	The default value is invalid(1). If the value is password, the user must pass password authentication of AAA. If the value is publicKey, the user must pass the public key authentication of PKEY module. If the value is any, the user must pass password or public key authentication. If the value is publicKeyPassword, the user must pass both public key authentication and password authentication.
hh3cSSHUserPublicKeyName (1.3.6.1.4.1.25506.2.22.1.1.2.1.1.4)	read-create	DisplayString	Standard MIB values.	Name of the public key used for authentication of the SSH user.	Length: 1 to 64 characters. The default value is a zero-length string. The value for this object is obtained from the public key generated in the PKEY module.
hh3cSSHUserWorkDirectory (1.3.6.1.4.1.25506.2.22.1.1.2.1.1.5)	read-create	DisplayString	Standard MIB values.	Work directory of the SSH user.	Not supported.
hh3cSSHUserRowStatus (1.3.6.1.4.1.25506.2.22.1.1.2.1.1.6)	read-create	RowStatus	active(1), notInService(2), notReady(3), createAndGo(4), createAndWait(5), destroy(6)	Row status.	When the hh3cSSHUserRowStatus is set to active(1), no objects in the conceptual row can be modified. In particular, a newly created user row which uses public key authentication cannot be made active(1) until the corresponding instance of `hh3cSSHUserAuthType' is 'publicKey' or 'publicKeyPassword', and the 'hh3cSSHUserPublicKeyName' or at least one of the 'hh3cSSHUserPublicKeyName[2-6]' is configured appropriately.
hh3cSSHUserPublicKeyName2 (1.3.6.1.4.1.25506.2.22.1.1.2.1.1.7)	read-create	DisplayString	Standard MIB values.	Name of the public key used for authentication of the SSH user.	Length: 1 to 64 characters. The default value is a zero-length string. The value for this object is obtained from the public key generated in the PKEY module.
hh3cSSHUserPublicKeyName3 (1.3.6.1.4.1.25506.2.22.1.1.2.1.1.8)	read-create	DisplayString	Standard MIB values.	Name of the public key used for authentication of the SSH user.	Length: 1 to 64 characters. The default value is a zero-length string. The value for this object is obtained from the public key generated in the PKEY module.
hh3cSSHUserPublicKeyName4 (1.3.6.1.4.1.25506.2.22.1.1.2.1.1.9)	read-create	DisplayString	Standard MIB values.	Name of the public key used for authentication of the SSH user.	Length: 1 to 64 characters. The default value is a zero-length string. The value for this object is obtained from the public key generated in the PKEY module.
hh3cSSHUserPublicKeyName5 (1.3.6.1.4.1.25506.2.22.1.1.2.1.1.10)	read-create	DisplayString	Standard MIB values.	Name of the public key used for authentication of the SSH user.	Length: 1 to 64 characters. The default value is a zero-length string. The value for this object is obtained from the public key generated in the PKEY module.
hh3cSSHUserPublicKeyName6 (1.3.6.1.4.1.25506.2.22.1.1.2.1.1.11)	read-create	DisplayString	Standard MIB values.	Name of the public key used for authentication of the SSH user.	Length: 1 to 64 characters. The default value is a zero-length string. The value for this object is obtained from the public key generated in the PKEY module.

hh3cSSHSessionInfoTable

About this table

This table contains SSH session information.

Support for operations

Create：Not supported

Edit/Modify：Not supported

Delete：Not supported

Read：Supported

Columns

The table index is hh3cSSHSessionID.

Object (OID)	Access	Syntax	Value range	Description	Implementation
hh3cSSHSessionID (1.3.6.1.4.1.25506.2.22.1.1.3.1.1)	not-accessible	Integer32	Standard MIB values.	VTY number of an SSH session.	As per the MIB.
hh3cSSHSessionUserName (1.3.6.1.4.1.25506.2.22.1.1.3.1.2)	read-only	DisplayString	Standard MIB values.	User name of the SSH session.	Length: 1 to 255 characters.
hh3cSSHSessionUserIpAddrType (1.3.6.1.4.1.25506.2.22.1.1.3.1.3)	read-only	InetAddressType	INTEGER{ unknown(0), ipv4(1), ipv6(2), dns(16) }	User IP address type of the SSH session.	As per the MIB.
hh3cSSHSessionUserIpAddr (1.3.6.1.4.1.25506.2.22.1.1.3.1.4)	read-only	InetAddress	OCTET STRING (0..255)	User IP address of the SSH session.	As per the MIB.
hh3cSSHSessionClientVersion (1.3.6.1.4.1.25506.2.22.1.1.3.1.5)	read-only	DisplayString	Standard MIB values.	Client protocol version of the SSH session.	As per the MIB.
hh3cSSHSessionServiceType (1.3.6.1.4.1.25506.2.22.1.1.3.1.6)	read-only	INTEGER	invalid(1), stelnet(2), sftp(3), scp(4), netconf(5)	Service type of the SSH session.	As per the MIB.
hh3cSSHSessionEncry (1.3.6.1.4.1.25506.2.22.1.1.3.1.7)	read-only	INTEGER	invalid(1), aes128CBC(2), desCBC(3), des3CBC(4), aes128CTR(5), aes192CTR(6), aes256CTR(7), aes128GCM(8), aes256GCM(9), aes256CBC(10), other(11)	Encryption algorithm of the SSH session.	As per the MIB.
hh3cSSHSessionState (1.3.6.1.4.1.25506.2.22.1.1.3.1.8)	read-only	INTEGER	init(1), verExchange(2), keysExchange(3), authRequest(4), serviceRequest(5), established(6), disconnect(7)	Status of the SSH session.	As per the MIB.

Notifications

hh3cSSHUserAuthFailure

Basic information

OID	Event	Type	Severity	Recovery notification	Default status
1.3.6.1.4.1.25506.2.22.1.3.0.1	User authentication failure	Informational	Informational	N/A (N/A)	ON

Notification triggers

This notification is generated when the SSH user failed authentication.

This notification might be generated when the following events occur:

The authentication configuration on the SSH server is incorrect.

An unauthorized SSH client requests for authentication.

System impact

If this notification is generated frequently, illegal attacks might occur, which affects other users from coming online.

Status control

This notification cannot be disabled.

Object

OID (object name)	Description	Index	Type	Value range
1.3.6.1.4.1.25506.2.22.1.2.1 (hh3cSSHAttemptUserName)	Name of the user.	N/A	DisplayString	OCTET STRING(SIZE (0..255))
1.3.6.1.4.1.25506.2.22.1.2.2 (hh3cSSHAttemptIpAddrType)	Address type of the user.	N/A	InetAddressType	INTEGER{, unknown(0),, ipv4(1), , ipv6(2), , dns(16), }
1.3.6.1.4.1.25506.2.22.1.2.3 (hh3cSSHAttemptIpAddr)	Address of the user.	N/A	InetAddress	OCTET STRING(0..255)
1.3.6.1.4.1.25506.2.22.1.2.4 (hh3cSSHUserAuthFailureReason)	Reason for the authentication failure.	N/A	INTEGER	exceedRetries(1), authTimeout(2), otherReason(3)

Recommended action

To resolve this issue:

1.Verify whether the SSH client is an unauthorized client through the hh3cSSHAttemptIpAddr node:

- If the SSH client is an authorized client, go to step 2.

- If the SSH client is an unauthorized client, exclude the IP address of the client from the permit rule of the ACL.

2.Verify whether the authentication method specified on the device is consistent with that used by the SSH client:

- If the authentication methods are consistent, go to step 3 if password authentication is used, go to step 5 if publickey authentication is used, and go to step 7 if X.509v3 certificate authentication is used.

- If the authentication methods are inconsistent, use the ssh user command to configure the SSH user correctly.

3.Verify whether the user exists on the local or authentication server:

- If the user exists, go to step 4.

- If the user does not exist, add the user.

4.Verify whether the username and password of the user are correct:

- If they are correct, go to step 9.

- If they are incorrect, use the correct username and password for login.

5.Verify whether the client public key has been assigned to the user:

- If the public key has not been assigned, make sure the client public key has been imported to the device, and use the ssh user command to assign the key to the user.

- If the public key has been assigned, go to step 6.

6.Execute the display public-key peer command to verify whether the assigned public key is correct:

- If the public key is incorrect, use the public-key peer command to import the correct key.

- If the public key is correct, go to step 9.

7.Verify whether SSH certificate authentication has been configured:

- If SSH certificate authentication has not been configured, execute the ssh server pki-domain command on the device to specify a PKI domain for the SSH server, and execute the ssh user command to specify a PKI domain for the SSH client.

- If SSH certificate authentication has been configured, go to step 8.

8.Use the display pki certificate domain command to verify whether the CA certificates on the SSH server and SSH client are correct:

- If the certificates are incorrect, execute the pki import domain command on the device to import the correct certificate file, use the ssh server pki-domain command to specify a PKI domain for the SSH server, and use the ssh user command to specify a PKI domain for the SSH client.

- If the certificates are correct, go to step 9.

9.Collect alarm information and configuration data, and then contact H3C Support for help.

hh3cSSHVersionNegotiationFailure

Basic information

OID	Event	Type	Severity	Recovery notification	Default status
1.3.6.1.4.1.25506.2.22.1.3.0.2	SSH version negotiation failure	Informational	Informational	N/A (N/A)	ON

Notification triggers

This notification is generated when the SSH version on the SSH server is incompatible with that on the SSH client.

System impact

No negative impact on the system.

Status control

This notification cannot be disabled.

Object

OID (object name)	Description	Index	Type	Value range
1.3.6.1.4.1.25506.2.22.1.2.2 (hh3cSSHAttemptIpAddrType)	Address type of the SSH user.	N/A	InetAddressType	INTEGER{, unknown(0),, ipv4(1), , ipv6(2), , dns(16), }
1.3.6.1.4.1.25506.2.22.1.2.3 (hh3cSSHAttemptIpAddr)	Address of the SSH user.	N/A	InetAddress	OCTET STRING (0..255)

Recommended action

To resolve this issue:

1.Execute the display ssh server status command on the device to view the SSH version of the SSH server:

- If the SSH version is 1.99, the device supports SSH1 clients. Go to step 2.

- If the SSH version is 2.0, execute the ssh server compatible-ssh1x enable command on the device to enable support for SSH1 clients.

2.Collect alarm information and configuration data, and then contact H3C Support for help.

hh3cSSHUserLogin

Basic information

OID	Event	Type	Severity	Recovery notification	Default status
1.3.6.1.4.1.25506.2.22.1.3.0.3	User login	Informational	Informational	N/A (N/A)	ON

Notification triggers

This notification is generated when a user successfully logs in.

Status control

No negative impact on the system.

System impact

This notification cannot be disabled.

Objects

OID (object name)

Description

Index nodes

Type

Value range

1.3.6.1.4.1.25506.2.22.1.1.3.1.2 (hh3cSSHSessionUserName)

User name of the SSH session.

hh3cSSHSessionID

DisplayString

OCTET STRING (0..255)

1.3.6.1.4.1.25506.2.22.1.1.3.1.3 (hh3cSSHSessionUserIpAddrType)

User address type of the SSH session.

hh3cSSHSessionID

InetAddressType

INTEGER{

unknown(0),

ipv4(1),

ipv6(2),

dns(16)

}

1.3.6.1.4.1.25506.2.22.1.1.3.1.4 (hh3cSSHSessionUserIpAddr)

User address of the SSH session.

hh3cSSHSessionID

InetAddress

OCTET STRING (0..255)

Recommended action

No action is required.

hh3cSSHUserLogoff

Basic information

OID

Event

Type

Severity

Recovery notification

Default status

1.3.6.1.4.1.25506.2.22.1.3.0.4

User logout

Informational

N/A

Notification triggers

This notification is generated when a user logs out.

System impact

No negative impact on the system.

Status control

This notification cannot be disabled.

Object

OID (object name)	Description	Index	Type	Value range
1.3.6.1.4.1.25506.2.22.1.1.3.1.2 (hh3cSSHSessionUserName)	User name of the SSH session.	hh3cSSHSessionID	DisplayString	OCTET STRING (0..255)
1.3.6.1.4.1.25506.2.22.1.1.3.1.3 (hh3cSSHSessionUserIpAddrType)	User address type of the SSH session.	hh3cSSHSessionID	InetAddressType	INTEGER{, unknown(0),, ipv4(1), , ipv6(2), , dns(16), }
1.3.6.1.4.1.25506.2.22.1.1.3.1.4 (hh3cSSHSessionUserIpAddr)	User address of the SSH session.	hh3cSSHSessionID	InetAddress	OCTET STRING (0..255)

Recommended action

To resolve this issue, use the hh3cSSHSessionUserIpAddr node to verify whether the SSH client is authorized:

● If the SSH client is unauthorized, exclude the IP address of the client from the permit rule of the ACL, and edit the user authentication configuration of the client.

● If the SSH client is authorized, no action is required.

hh3cSSHLoginFailed

Basic information

OID	Event	Type	Severity	Recovery notification	Default status
1.3.6.1.4.1.25506.2.22.1.3.0.5	Frequent consecutive authentication failures of a user	Error	Warning	1.3.6.1.4.1.25506.2.22.1.3.0.6 (hh3cSSHLoginFailedClear)	ON

Notification triggers

This notification is generated when the number of consecutive authentication failures of a user logging in to the SSH server reaches the upper threshold during the specified period.

System impact

The system might be attacked by unauthorized users.

Status control

This notification cannot be disabled.

Object

OID (object name)

Description

Index

Type

Value range

1.3.6.1.4.1.25506.2.22.1.2.9

(hh3cSSHLoginFailedTimes)

Number of authentication failures

N/A

Unsigned32

(0..65535)

1.3.6.1.4.1.25506.2.22.1.2.10 (hh3cSSHStatisticPeriod)

Statistics period

N/A

Unsigned32

(1..120)

Recommended action

1.To resolve this issue, verify whether the user is unauthorized through the logs:

- If the user is unauthorized, exclude the IP address of the client from the permit rule of the ACL.

- If the user is authorized, contact the administrator to obtain the correct username and password of the user. If the issue persists, go to step 2.

2.Collect alarm information and configuration data, and then contact H3C Support for help.

hh3cSSHLoginFailedClear

Basic information

OID	Event	Type	Severity	Recovery notification	Default status
1.3.6.1.4.1.25506.2.22.1.3.0.6	SSH user authentication failure notification clear	Recovery	Warning	N/A (N/A)	ON

Notification triggers

This notification is generated when the SSH user login failure notification is cleared.

System impact

No negative impact on the system.

Status control

This notification cannot be disabled.

Object

OID (object name)	Description	Index	Type	Value range
无 (无)	无	无	无	无

Recommended action

No action is required.

18-Security

About this table

Support for operations

Columns

About this table

Support for operations

Columns

Basic information

Notification triggers

System impact

Status control

Object

Recommended action

Basic information

Notification triggers

System impact

Status control

Object

Recommended action

Basic information

Notification triggers

System impact

Status control

Object

Recommended action

Basic information

Notification triggers

System impact

Status control

Object

Recommended action

Basic information

Notification triggers

System impact

Status control

Object

Recommended action

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Policy & Program

Global Learning

Partner Sales Resources

Service Business

News & Events

Contact Us