214
Follow these steps to configure an SSH user and specify the service type and authentication mode:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Create an SSH
user, and
specify the
service type
and
authentication
mode
For Stelnet
users
ssh user
username
service-type
stelnet
authentication-type
{
password
| {
any
|
password-
publickey
|
publickey
}
assign
publickey
keyname
}
Required
Use either command.
For all users or
SFTP users
ssh user
username
service-type
{
all
|
sftp
}
authentication-type
{
password
| {
any
|
password-
publickey
|
publickey
}
assign
publickey
keyname
work-
directory
directory-name
}
CAUTION:
A user without an SSH account can still pass password authentication and log in to the server through Stelnet or
SFTP, as long as the user can pass AAA authentication and the service type is SSH.
An SSH server supports up to 1024 SSH users.
For successful login through SFTP, you must set the user service type to
sftp
or
all
.
SSH1 does not support the service type
sftp
.
If the client uses SSH1 to log in to the server, you must set the
service type to
stelnet
or
all
on the server.
An SFTP user’s working folder depends on the authentication method. For a user using only password
authentication, the working folder is the AAA authorized one. For a user using only publickey authentication or
using both the publickey and password authentication methods, the working folder is the one set by using the
ssh user
command.
You can change the authentication method and public key of an SSH user when the user is communicating with
the SSH server, but your changes take effect only after the user logs out and logs in again.
NOTE:
With publickey authentication, which commands a user can use after login depends on the user privilege level,
which is configured with the
user privilege level
command on the user interface.
With password authentication, which commands a user can use after login depends on AAA authorization.
Setting the SSH management parameters
SSH management includes:
Enabling the SSH server to be compatible with SSH1 client
Setting the RSA server key pair update interval, applicable to users using SSH1 client
Setting the SSH user authentication timeout period
Setting the maximum number of SSH authentication attempts
Setting the parameters can help avoid malicious guessing at and cracking of the keys and usernames,
securing your SSH connections.
Follow these steps to set the SSH management parameters:
