Dell BigIron RX Series, Configuration Manual

Page: 995 / 1458

BigIron RX Series Configuration Guide 919
53-1002253-01
Configuring SSH
30
With DSA challenge-response authentication, a collection of clients’ public keys are stored on the
device. Clients are authenticated using these stored public keys. Only clients that have a private
key that corresponds to one of the stored public keys can gain access to the device using SSH.
With password authentication, users are prompted for a password when they attempt to log into the
device (provided empty password logins are not allowed; refer to
“Enabling empty password logins”
on page 919). If there is no user account that matches the user name and password supplied by
the user, the user is not granted access.
You can deactivate one or both user authentication methods for SSH. Note that deactivating both
authentication methods essentially disables the SSH server entirely.
To disable DSA challenge-response authentication.
BigIron RX(config)# ip ssh key-authentication no
Syntax: ip ssh key-authentication yes | no
The default is “yes”.
To deactivate password authentication.
BigIron RX(config)# ip ssh password-authentication no
Syntax: ip ssh password-authentication no | yes
The default is “yes”.
Enabling empty password logins
By default, empty password logins are not allowed. This means that users with an SSH client are
always prompted for a password when they log into the device. To gain access to the device, each
user must have a user name and password. Without a user name and password, a user is not
granted access. Refer to
“Setting up local user accounts” on page 74 for information on setting up
user names and passwords on the device.
If you enable empty password logins, users are not prompted for a password when they log in. Any
user with an SSH client can log in without being prompted for a password.
To enable empty password logins.
BigIron RX(config)# ip ssh permit-empty-passwd yes
Syntax: ip ssh permit-empty-passwd no | yes
Setting the SSH port number
By default, SSH traffic occurs on TCP port 22. You can change this port number. For example, the
following command changes the SSH port number to 2200.
BigIron RX(config)# ip ssh port 2200
Note that if you change the default SSH port number, you must configure SSH clients to connect to
the new port. Also, you should be careful not to assign SSH to a port that is used by another
service. If you change the SSH port number, Brocade recommends that you change it to a port
number greater than 1024.
Syntax: ip ssh port <number>