Juniper JUNOSE 11.3, Configuration Manual

Page: 457 / 632

•
Use to disable SSH password authentication. If you disable SSH authentication, the
authentication protocol becomes None and all SSH clients that pass protocol
negotiation are accepted.
•
RADIUS authentication is enabled by default.
•
Example
host1(config)# ip ssh disable-user-authentication
•
Use the no version to restore default user authentication protocol, RADIUS.
•
See ip ssh disable-user-authentication.
ip ssh sleep
•
Use to set a sleep period in seconds for users that have exceeded the authentication
retry limit. Connection attempts from the user at the same host are denied until this
period expires.
•
Specify any nonnegative integer.
•
Example
host1(config)# ip ssh sleep 300
•
Use the no version to restore the default value, 600 seconds.
•
See ip ssh sleep.
ip ssh timeout
•
Use to set a timeout period in seconds. The SSH server terminates the connection if
protocol negotiation—including user authentication—is not completed within this
timeout.
•
Specify an integer in the range 10–600.
•
Example
host1(config)# ip ssh timeout 480
•
Use the no version to restore the default value, 600 seconds.
•
See ip ssh timeout.
Configuring Message Authentication
The SSH server and SSH client maintain separate lists of the message authentication
algorithms that each supports. Lists are kept for
inbound and outbound algorithms. For
the server, inbound means the algorithms that the server supports for information coming
in from a client. For the server, outbound means the algorithms that the server supports
for information it sends out to a client. You must configure each list separately. By default,
all of the supported encryption algorithms are available. You need to configure encryption
only if you need to specifically remove or add any supported algorithm from the list. The
system supports the following SSH algorithms for hash function-based message
authentication:
427 Copyright © 2010, Juniper Networks, Inc.
Chapter 7: Passwords and Security