Avaya 3050-VM, User Manual, Page: 243 / 274

Appendix G: SSH host keys
SSH host keys serve much the same purpose as server certificates in SSL/TLS, i.e. they primarily allow
clients to authenticate the server, protecting against e.g. "man in the middle" attacks. As with certificates,
public/private key pairs are used. Unlike certificates, there is no public key infrastructure and no certificate
authorities for the SSH host keys.
Instead, the security of SSH sessions depends on SSH clients keeping track of the public keys that should
be used to authenticate different SSH server hosts, not silently accepting new keys from previously
unknown server hosts, and refusing or at least strongly warning the user from proceeding with the
connection if there is a key mismatch.
Methods for Protection
In many environments, it may be reasonable for a SSH client user to simply accept the key
from a previously unknown remote server host when prompted by the client, but to achieve
strict protection against a "man in the middle" attack against this very first connection, one of
these methods can be used:
• Verifying the "fingerprint" (as displayed by the client) of the new remote host key by some
out-of-band means (e.g. verbal communication with the server administrator).
OR
• Pre-installing the remote host key (previously transferred by some out-of-band means) in
the client's key storage, i.e. effectively making the remote host known even before the
first connection.
The server administrator also needs to be able to generate new keys (e.g. at initial
configuration, or in case the old ones are believed to be compromised), and the client user
needs to be able to remove remote host keys that are no longer valid from the client's key
storage (e.g. due to the server administrator having generated new keys).
The VPN Gateway
The VPN Gateway can act both as SSH server (when a user connects to the CLI using a SSH
client) and as SSH client (when file or data transfers are initiated from the VPN Gateway using
the SCP or SFTP protocols). The
generate
and
show
commands in the
/cfg/sys/adm/
sshkeys
menu concern the former case, while the
knownhosts
User Guide April 2013 243