TeleBoss 850 2.06.280_STD User Manual
Page 84
This means, for example, if your SSH client is configured to support and prefer AES-256 the most then that is the
cipher that will be negotiated with the unit.
Configuring the SSH login banner
You can configure the unit to display a login banner when users connect via SSH. Configure this by entering
sshc -
an
(case-sensitive). Input the banner by sending the banner directory (e.g., paste it into your terminal) and
terminating it with "END" on a line by itself. It is recommended you do this on an error-correcting connection such as
Telnet or SSH.
How to secure SSH
SSH is inherently a security asset. There is nothing about it that needs to be secured aside from what has already
been discussed, namely enabling SSH access and configuring the authentication method. There is however one
setting that is useful.
sec.user[x].connectvia.ssh
(value = ON or OFF)
This setting allows and administrator to limit which users are allowed to log in via SSH (with either password or public
key SSH authentication). This can also be set in the Setup Menu -> Security -> Specific Security -> User Profile x ->
Allow User Connection via option, and the Security -> User Profiles -> User Profile x portion of the Web UI. When
using RADIUS security mode, use the Asentria-Connect-Via-SSH vendor-specific attribute.
SFTP CDR out of the unit
The T850 uses SFTP to transfer CDR securely. SFTP runs on top of SSH version 2 and so has the same security as
SSH. The unit supports password and public key authentication methods for SFTP.
If the SFTP host requires a password then the password entered in the
If the SFTP host requires public key authentication then do the following configuration steps:
1. Create a client key on the unit. Enter
sshc
–
t rsa
(case sensitive) to create an RSA public/private key pair.
The unit will generate the key and then output the key's fingerprint and public part as human-readable mostly
base-64 text. The key text will begin with "ssh-" and end with "Asentria_clientkey_<serial number of unit>". You
can see the unit's public client key at any time by entering
SSHC
.
2. Configure the SFTP server to make it aware that the unit is authorized to connect. - The SFTP server must
know the unit's public client key in order to do public key authentication. This means taking the public client key
output by the unit and configuring it in the SFTP server. For UNIX SSH servers (which typically support SFTP),
this is done by appending the unit's public client key to the "authorized_keys" file in the ".ssh" directory of the user
account the unit uses to SFTP-push CDR. Check with your System Administrator to determine exactly how to do
this with your SFTP server.
3. Configure SFTP push - Go to the Setup->Network Settings->FTP Settings menu. Select option A until it reads
"SECURE" and then configure the server address, username, password, etc.
4. Establish the authenticity of the SFTP host to the unit. - At this point the unit does not know whether to trust the
configured SFTP host. (It may be a malicious host that is pretending to be your host.) Essentially you must tell
the unit that you vouch for the host that is running the SFTP server; assuming you are 100% sure that the host to
which the unit connects is really your host. Do this by entering
PUSHTEST
. This command is used to see that
the connection between the unit and the SFTP (or FTP) host is working. For SFTP, it is also used to let you vouch
for the host. The first time you make the unit connect to the SFTP host with the
PUSHTEST
command, you will
see a message like the following:
The authenticity of host <your SFTP host> can't be established.
RSA key fingerprint is d4:1a:16:46:8a:36:59:24:22:e5:ec:6f:01:fc:74:78.
Are you sure you want to continue connecting (yes/no)?
Summary of Contents for Teleboss 850
Page 6: ......
