LevelOne GEL-5261, User Manual

Page: 272 / 570

Chapter 12
| Security Measures
Configuring the Secure Shell
– 272 –
e.
The switch compares the checksum sent from the client against that
computed for the original string it sent. If the two checksums match,
this means that the client's private key corresponds to an authorized
public key, and the client is authenticated.
Authenticating SSH v2 Clients
a.
The client first queries the switch to determine if DSA public key
authentication using a preferred algorithm is acceptable.
b.
If the specified algorithm is supported by the switch, it notifies the
client to proceed with the authentication process. Otherwise, it rejects
the request.
c.
The client sends a signature generated using the private key to the
switch.
d.
When the server receives this message, it checks whether the supplied
key is acceptable for authentication, and if so, it then checks whether
the signature is correct. If both checks succeed, the client is
authenticated.
Note: The SSH server supports up to eight client sessions. The maximum number
of client sessions includes both current Telnet sessions and SSH sessions.
Note: The SSH server can be accessed using any configured IPv4 or IPv6 interface
address on the switch.
Configuring the
SSH Server
Use the Security > SSH (Configure Global) page to enable the SSH server and
configure basic settings for authentication.
Note: You must generate DSA and RSA host keys before enabling the SSH server.
See “Generating the Host Key Pair” on page 273 .
Parameters
These parameters are displayed:
◆ SSH Server Status – Allows you to enable/disable the SSH server on the switch.
(Default: Disabled)
◆ Version – The Secure Shell version number. Version 2.0 is displayed, but the
switch supports management access via either SSH Version 1.5 or 2.0 clients.
◆
Authentication Timeout – Specifies the time interval in seconds that the SSH
server waits for a response from a client during an authentication attempt.
(Range: 1-120 seconds; Default: 120 seconds)
◆
Authentication Retries – Specifies the number of authentication attempts
that a client is allowed before authentication fails and the client has to restart
the authentication process. (Range: 1-5 times; Default: 3)