15: Security Settings
PremierWave® XC HSPA+ Intelligent Gateway User Guide
101
OpenSSL
OpenSSL is a widely used open source set of SSL related command line utilities. It can act as
server or client. It can also generate or sign certificate requests, and can convert from and to
several different of formats.
OpenSSL is available in binary form for Linux and Windows.
To generate a self-signed RSA certificate/key combo:
openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout mp_key.pem -
out mp_cert.pem
See
www.openssl.org
or
www.madboa.com/geek/openssl
for more information.
Note:
Signing other certificate requests is also possible with OpenSSL but the details of
this process are outside the scope of this document.
SSH Settings
SSH is a network protocol for securely accessing a remote device over an encrypted channel. This
protocol manages the security of internet data transmission between two hosts over a network by
providing encryption, authentication, and message integrity services.
Configuration is required when the PremierWave XC HSPA+ device is either (1) the SSH server or
(2) an SSH client.. The SSH server is used by the CLI (Command Mode) and for tunneling in
Accept Mode. The SSH client is for tunneling in Connect Mode.
To configure the PremierWave XC HSPA+ intelligent gateway as an SSH server, there are two
requirements:
Defined Host Keys:
both private and public keys are required. These keys are used for the
Diffie-Hellman key exchange (used for the underlying encryption protocol).
Defined Users
: these users are permitted to connect to the PremierWave XC HSPA+ device
SSH server.
SSH Server Host Keys
The SSH Server Host Keys are used by all applications that play the role of an SSH Server.
Specifically Tunneling in Accept Mode. These keys can be created elsewhere and uploaded to the
device or automatically generated on the device.
If uploading existing keys, take care to ensure the Private Key will not be compromised in transit.
This implies the data is uploaded over some kind of secure private network.
Note:
Some SSH Clients require RSA Host Keys to be at least 1024 bits in size.
Table 15-1 SSH Server Host Keys
SSH Settings
Description
Private Key
Click
Choose File
to browse to and select the existing private key you want to
upload. In Web Manager, you can also browse to the private key to be uploaded. Be
sure the private key will not be compromised in transit. This implies the data is
uploaded over some kind of secure private network.
