Extreme Networks Summit 300-48, Software User'S Manual

Page: 39 / 198

Using Secure Shell 2 (SSH2)
Summit 300-48 Switch Software User Guide 39
Controlling Telnet Access
By default, Telnet services are enabled on the switch. To display the status of Telnet, use the following
command:
show management
You can choose to disable Telnet by using the following command:
disable telnet
To re-enable Telnet on the switch, at the console port use the following:
enable telnet
You must be logged in as an administrator to enable or disable Telnet.
Using Secure Shell 2 (SSH2)
Secure Shell 2 (SSH2) is a feature of ExtremeWare that allows you to encrypt session data between the
switch and a network administrator using SSH2 client software. The ExtremeWare SSH2 switch
application is based on the Data Fellows
™ SSH2 server implementation. It is highly recommended that
you use the F-Secure

SSH client products from Data Fellows corporation. These applications are
available for most operating systems. For more information, refer to the Data Fellows website at:
http://www.datafellows.com.
NOTE
SSH2 is compatible with the Data Fellows SSH2 client version 2.0.12 or above. SSH2 is not compatible
with SSH1.
Enabling SSH2 for Inbound Switch Access
Because SSH2 is currently under U.S. export restrictions, you must first obtain a security-enabled
version of the ExtremeWare software from Extreme Networks before you can enable SSH2. The
procedure for obtaining a security-enabled version of the ExtremeWare software is described in
Chapter 1.
You must enable SSH2 on the switch before you can connect to it using an external SSH2 client.
Enabling SSH2 involves two steps:
• Enabling SSH2 access, which may include specifying an access profile, and specifying a TCP port to
be used for communication.
By default, if you have a security license, SSH2 is disabled using TCP port 22, with no restrictions on
client access.
• Generating or specifying an authentication key for the SSH2 session.
To enable SSH2, use the following command:
enable ssh2 {access-profile [<access_profile> | none] {port <tcp_port_number>}}