Operation Manual – SSH
H3C S3610&S5510 Series Ethernet Switches
Chapter 1 SSH Configuration
1-4
z
The server authenticates the client. If the authentication fails, the server informs
the client by sending a message, which includes a list of available methods for
re-authentication.
z
The client selects a method from the list to initiate another authentication.
z
The above process repeats until the authentication succeeds or the authentication
times timeout and the session is torn down.
SSH provides two authentication methods: password authentication and publickey
authentication.
In password authentication:
z
The client encrypts the username and password, encapsulates them into a
password authentication request, and sends the request to the server.
z
Upon receiving the request, the server decrypts the username and password,
compares them against those it maintains, and then informs the client of the
authentication result.
In publickey authentication:
z
The server authenticates clients using digital signatures. Currently, the device
uses RSA to implement digital signature. The client sends to the
server a public
authentication request containing its user name, public key and algorithm. The
server validates the public key. If the public key is invalid, the authentication fails;
otherwise, the server generates a digital signature to authenticate the client, and
then sends back a message to inform the success or failure of the authentication.
Note:
Besides password authentication and publickey authentication, SSH2.0 provides
another two authentication methods:
z
password-publickey
: Performs both password authentication and publickey
authentication of the client. A client running SSH1 client only needs to pass either
type of the two, while a client running SSH2 client must pass both of them to login.
z
any
: Performs either password authentication or publickey authentication. The
client tries publickey authentication first.
IV. Session request
After passing authentication, the client sends a session request to the server, while the
server listens to and processes the request from the client. If the client passes
authentication, the server sends back to the client an SSH_SMSG_SUCCESS packet
and goes on to the interactive session stage with the client. Otherwise, the server
sends back to the client an SSH_SMSG_FAILURE packet, indicating that the
processing fails or it cannot resolve the request.