Security: SSH Client
Overview
Cisco 350XG & 550XG Series 10G Stackable Managed Switches
491
23
Passwords
To use the password method, first ensure that a username/password has been
established on the SSH server. This is not done through the device’s management
system, although, after a username has been established on the server, the server
password can be changed through the device’s management system.
The username/password must then be created on the device. When the device
tries to establish a SSH session to a SSH server, the username/password
supplied by the device must match the username/password on the server.
Data can be encrypted using a one-time symmetric key negotiated during the
session.
Each device being managed must have its own username/password, although the
same username/password can be used for multiple switches.
The password method is the default method on the device.
Public/Private Keys
To use the public/private key method for client authentication by a SSH server,
create a user and generate/import a public/private key pair on the device which is
a SSH client. Then create the same user at the SSH server and copy the public
key (or fingerprint) generated/entered at the SSH client to the SSH server. The
action of creating the user and copy the public key (or fingerprint) to the SSH
server is beyond the scope of this guide.
RSA and DSA default key pairs are generated for the device when it is booted.
One of these keys is used to encrypt the data being downloaded from the SSH
server. The RSA key is used by default.
If the user deletes one or both of these keys, they are regenerated.
The public/private keys are encrypted and stored in the device memory. The keys
are part of the device configuration file, and the private key can be displayed to
the user, in encrypted or plaintext form.
Since the private key cannot be copied directly to the private key of another
device, an import method exists that enables copying private keys from device to
device (described in
Import Keys
In the key method, individual public/private keys must be created for each
individual device, and these private keys cannot be copied directly from one
device to another because of security considerations.
