HP E3800 Series, Access Security Manual

Page: 351 / 732

8-19
Configuring Secure Shell (SSH)
Configuring the Switch for SSH Operation
N o t e o n P o r t
N u m b e r
HP recommends using the default TCP port number (22). However, you can
use
ip ssh port to specify any TCP port for SSH connections except those
reserved for other purposes. Examples of reserved IP ports are 23 (Telnet)
and 80 (http). Some other reserved TCP ports on the switch are 49, 80, 1506,
and 1513.
Figure 8-10. Example of Enabling IP SSH and Displaying the SSH Configuration
C a u t i o n
Protect your private key file from access by anyone other than yourself. If
someone can access your private key file, they can then penetrate SSH security
on the switch by appearing to be you.
SSH does not protect the switch from unauthorized access via the WebAgent,
Telnet, SNMP, or the serial port. While WebAgent and Telnet access can be
restricted by the use of passwords local to the switch, if you are unsure of the
security this provides, you may want to disable web-based and/or Telnet
access (
no web-management and no telnet ). If you need to increase SNMP
security, you should use SNMP version 3 only. If you need to increase the
security of your web interface see the section on SSL. Another security
measure is to use the Authorized IP Managers feature described in the switch’s
Management and Configuration Guide
. To protect against unauthorized
HP Switch(config) ip ssh
HP Switch(config)# show ip ssh
SSH Enabled : Yes Secure Copy Enabled : No
TCP Port Number : 22 Timeout (sec) : 120
IP Version : IPv4orIPv6
Host Key Type : RSA Host Key Size : 1024
Ciphers : aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,
rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
MACs : hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-96
Ses Type | Source IP Port
--- -------- + ---------------------------------------------- -----
1 console |
2 telnet |
3 ssh | 12.255.255.255
4 inactive |
5 inactive |
6 inactive |
With SSH running, the switch allows one console
session and up to five other sessions (SSH and/or
Telnet). WebAgent sessions are also allowed, but do
not appear in the
show ip ssh listing.
Enable SSH