Cisco IE 4000, Software Configuration Manual

Page: 165 / 1066

161
Configuring Switch-Based Authentication
Information About Configuring Switch-Based Authentication
Kerberos Configuration
So that remote users can authenticate to network services, you must configure the hosts and the KDC in the Kerberos
realm to communicate and mutually authenticate users and network services. To do this, you must identify them to each
other. You add entries for the hosts to the Kerberos database on the KDC and add KEYTAB files generated by the KDC
to all hosts in the Kerberos realm. You also create entries for the users in the KDC database.
When you add or create entries for the hosts and users, follow these guidelines:

The Kerberos principal name must be in all lowercase characters.

The Kerberos instance name must be in all lowercase characters.

The Kerberos realm name must be in all uppercase characters.
Note: A Kerberos server can be a switch that is configured as a network security server and that can authenticate users
by using the Kerberos protocol.
To set up a Kerberos-authenticated server-client system, follow these steps:

Configure the KDC by using Kerberos commands.

Configure the switch to use the Kerberos protocol.
Local Authentication and Authorization
You can configure AAA to operate without a server by setting the switch to implement AAA in local mode. The switch
then handles authentication and authorization. No accounting is available in this configuration.
Secure Shell
To use this feature, you must install the cryptographic (encrypted) software image on your switch. You must obtain
authorization to use this feature and to download the cryptographic software files from Cisco.com. For more information,
see the release notes for this release.
For SSH configuration examples, see the “SSH Configuration Examples” section in the “Configuring Secure Shell”
chapter of the
Cisco IOS Security Configuration Guide, Cisco IOS Release 12.2 .
SSH in IPv6 functions the same and offers the same benefits as SSH in IPv4. IPv6 enhancements to SSH consist of
support for IPv6 addresses that enable a Cisco router to accept and establish secure, encrypted connections with remote
IPv6 nodes over an IPv6 transport.
SSH
SSH is a protocol that provides a secure, remote connection to a device. SSH provides more security for remote
connections than Telnet does by providing strong encryption when a device is authenticated. This software release
supports SSH Version 1 (SSHv1) and SSH Version 2 (SSHv2).
SSH Servers, Integrated Clients, and Supported Versions
The SSH feature has an SSH server and an SSH integrated client, which are applications that run on the switch. You can
use an SSH client to connect to a switch running the SSH server. The SSH server works with the SSH client supported
in this release and with non-Cisco SSH clients. The SSH client also works with the SSH server supported in this release
and with non-Cisco SSH servers.
The switch supports an SSHv1 or an SSHv2 server.