312
CAUTION:
•
A user without an SSH account can still pass password authentication and log in to the server
through Stelnet or SFTP, as long as the user can pass AAA authentication and the service type is SSH.
•
An SSH server supports up to 1024 SSH users.
•
For successful login through SFTP, you must set the user service type to
sftp
or
all
.
•
SSH1 does not support the service type
sftp
.
If the client uses SSH1 to log in to the server, you must
set the service type to
stelnet
or
all
on the server.
•
An SFTP user's working folder depends on the authentication method. For a user who is using only
password authentication, the working folder is the AAA-authorized one. For a user who is using only
publickey authentication or both the publickey and password authentication methods, the working
folder is the one set by using
ssh user.
•
change the authentication method and public key of an SSH user when the user is communicating
with the SSH server, but your changes take effect only after the user logs out and logs in again.
To do…
Command…
Remarks
1.
Enter system view.
system-view
—
2.
Create an
SSH user,
and specify
the service
type and
authenticati
on method.
For Stelnet
users
ssh user
username
service-type stelnet
authentication-type
{
password
| {
any
|
password-publickey
|
publickey
}
assign
publickey
keyname
}
Required.
Use either command.
For all users or
SFTP users
ssh user
username
service-type
{
all
|
sftp
}
authentication-type
{
password
| {
any
|
password-publickey
|
publickey
}
assign publickey
keyname
work-directory
directory-name
}
NOTE:
•
With publickey authentication, the commands that a user can use after login depend on the user
privilege level, which is configured with
user privilege level
on the user interface.
•
With password authentication, the commands that a user can use after login depend on AAA
authorization.
Setting SSH management parameters
SSH management includes the following:
•
Enabling the SSH server to be compatible with SSH1 client.
•
Setting the RSA server key pair update interval; applies to users who are using SSH1 client.
•
Setting the SSH user authentication timeout period.
•
Setting the maximum number of SSH authentication attempts.
Setting these parameters can help avoid malicious guessing at and cracking of the keys and usernames,
securing your SSH connections.
