Security Measures
152
Instruction Manual - NXA-ENET8-POE+
Command Usage
The SSH server on this switch supports both password and public key authentication. If password authentication is specified by
the SSH client, then the password can be authenticated either locally or via a RADIUS or remote authentication server, as
specified on the System Authentication page (page 135). If public key authentication is specified by the client, then you must
configure authentication keys on both the client and the switch as described in the following section. Note that regardless of
whether you use public key or password authentication, you still have to generate authentication keys on the switch (SSH Host Key
Settings) and enable the SSH server (Authentication Settings).
To use the SSH server, complete these steps:
1.
Generate a Host Key Pair
- On the SSH Host Key Settings page, create a host public/private key pair.
2.
Provide Host Public Key to Clients
- Many SSH client programs automatically import the host public key during the initial
connection setup with the switch. Otherwise, you need to manually create a known hosts file on the management station and
place the host public key in it. An entry for a public key in the known hosts file would appear similar to the following example:
10.1.0.54 1024 35 15684995401867669259333946775054617325313674890836547254
15020245593199868544358361651999923329781766065830956 10825913212890233
76546801726272571413428762941301196195566782
595664104869574278881462065194174677298486546861571773939016477935594230357741
309802273708779454524083971752646358058176716709574804776117
3.
Import Client's Public Key to the Switch
- See the
section on page 154 to copy a file containing the
public key for all the SSH client's granted management access to the switch. (Note that these clients must be configured
locally on the switch via the User Accounts page as described on page 144.) The clients are subsequently authenticated using
these keys. The current firmware only accepts public key files based on standard UNIX format as shown in the following
example for an RSA Version 1 key:
1024 35
134108168560989392104094492015542534763164192187295892114317388005553616163105
177594083868631109291232226828519254374603100937187721199696317813662774141689
851320491172048303392543241016379975923714490119380060902539484084827178194372
288402533115952134861022902978982721353267131629432532818915045306393916643
4.
Set the Optional Parameters
- On the SSH Settings page, configure the optional parameters, including the authentication
timeout, the number of retries, and the server key size.
5.
Enable SSH Service
- On the SSH Settings page, enable the SSH server on the switch.
6.
Authentication
- One of the following authentication methods is employed:
Password Authentication (for SSH v1.5 or V2 Clients)
The client sends its password to the server.
The switch compares the client's password to those stored in memory.
If a match is found, the connection is allowed.
NOTE:
To use SSH with only password authentication, the host public key must still be given to the client, either during initial
connection or manually entered into the known host file. However, you do not need to configure the client's keys.
Public Key Authentication
- When an SSH client attempts to contact the switch, the SSH server uses the host key pair to
negotiate a session key and encryption method. Only clients that have a private key corresponding to the public keys stored
on the switch can access it. The following exchanges take place during this process:
Authenticating SSH v1.5 Clients
The client sends its RSA public key to the switch.
The switch compares the client's public key to those stored in memory.
If a match is found, the switch uses its secret key to generate a random 256-bit string as a challenge, encrypts this
string with the user's public key, and sends it to the client.
The client uses its private key to decrypt the challenge string, computes the MD5 checksum, and sends the checksum
back to the switch.
The switch compares the checksum sent from the client against that computed for the original string it sent. If the two
checksums match, this means that the client's private key corresponds to an authorized public key, and the client is
authenticated.
Authenticating SSH v2 Clients
The client first queries the switch to determine if DSA public key authentication using a preferred algorithm is
acceptable.
If the specified algorithm is supported by the switch, it notifies the client to proceed with the authentication process.
Otherwise, it rejects the request.
The client sends a signature generated using the private key to the switch.
When the server receives this message, it checks whether the supplied key is acceptable for authentication, and if so, it
then checks whether the signature is correct. If both checks succeed, the client is authenticated.
NOTE:
The SSH server supports up to eight client sessions. The maximum number of client sessions includes both current Telnet
sessions and SSH sessions.
NOTE:
The SSH server can be accessed using any configured IPv4 or IPv6 interface address on the switch.