Black Box ServSelect KV119A, Installer/User Manual

Page: 23 / 84

SERVSELECT™ IP SCPS INSTALLER/USER GUIDE
22
For more information, see
Show Server CLI command
in Chapter 6.
Connecting to devices using SSH
The SCPS supports version 2 of the SSH (Secure Shell) protocol (SSH2). When
SSH is enabled, all connections to the SCPS must be made from a third-party SSH
client. Telnet cannot be used.
The SCPS SSH server operates on the standard SSH port 22. The shell for this
connection provides a CLI prompt as if you had established a Telnet connection on
port 23. The shell request for this connection is for CLI access.
The SSH server on port 22 permits TCP-IP forwarding requests (tunneling) to each
of the SCPS serial port connections and to Telnet port 23. When SSH is enabled,
Telnet connections to ports are not accepted from remote clients.
Additional SCPS SSH servers operate on TCP ports that are numbered with values
100 greater than the standard 30xx Telnet ports for the SCPS. For example, if port 7
is configured for Telnet access on port 3007, then port 3107 will be a direct SSH
connection for port 7. When SSH is enabled, Telnet port 23 connections will not be
accepted from other clients; however, connecting to Telnet port 23 can be tunneled
via a connection to SSH port 22.
SSH server keys
When SSH is enabled for the first time, all other sessions on the SCPS are
terminated and the SCPS generates an SSH server key. The key generation process
may take up to ten minutes. The key is computed at random and is stored in the
SCPS configuration database.
In most cases, the SSH server key should not be modified because most SSH clients
will associate the key with the IP address of the SCPS. During the first connection to a
new SSH server, the client will display the SSH server key and ask if you want to
store it on the SSH client. After the first connection, most SSH clients will validate the
key when connecting to the SCPS. This provides an extra layer of security because the
SSH client can verify the key sent by the server each time it connects.
When you disable SSH and later reenable it, you may either use the existing server
key or compute a new one. If you are reenabling the same server at the same IP
address, it is recommended that you use the existing key, as SSH clients may be
using it for verification. If you are moving the SCPS to another location and
changing the IP address, you may want to generate a new SSH server key.
Enabling or disabling SSH requires a reboot of the SCPS.