167
Setting the SSH management parameters
Setting the SSH management parameters can improve the security of SSH connections. The SSH
management parameters include:
•
Whether the SSH server is compatible with SSH1 clients.
•
RSA server key pair update interval, applicable to users using SSH1 clients.
•
SSH user authentication timeout period. You can set this parameter to reject a connection if the
authentication for the connection has not been finished when the timeout period expires.
•
Maximum number of SSH authentication attempts. You can set this parameter to prevent malicious
password cracking. If any authentication is used, the total number of both publickey and password
authentication attempts cannot exceed the configured upper limit.
•
ACL for SSH clients. You can configure an ACL to filter SSH clients which initiate connections with
the SSH server.
•
SFTP connection idle timeout period. When the idle period of an SFTP connection exceeds the
specified threshold, the system automatically tears the connection down.
•
Maximum number of concurrent online SSH users. When the number of online SSH users reaches
the upper limit, the system refuses new SSH connection requests.
To set the SSH management parameters:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable the SSH server to
support SSH1 clients.
ssh server compatible-ssh1x
enable
By default, the SSH server supports
SSH1 clients.
This command is not available in
FIPS mode.
3.
Set the RSA server key pair
update interval.
ssh server rekey-interval
hours
By default, the RSA server key pair
is not updated.
This command is not available in
FIPS mode.
4.
Set the SSH user
authentication timeout period.
ssh server authentication-timeout
time-out-value
The default setting is 60 seconds.
5.
Set the maximum number of
SSH authentication attempts.
ssh server authentication-retries
times
The default setting is 3.
6.
Configure an ACL for IPv4
SSH clients.
ssh server acl
acl-number
By default, all IPv4 SSH users are
allowed to initiate connections with
the SSH server.
7.
Configure an ACL for IPv6
SSH clients.
ssh server ipv6 acl
[
ipv6
]
acl-number
By default, all IPv6 SSH users are
allowed to initiate connections with
the SSH server.
8.
Configure the SFTP
connection idle timeout
period.
sftp server idle-timeout
time-out-value
The default setting is 10 minutes.