Alteon Application Switch Operating System Application Guide
Securing Alteon
74
Document
ID:
RDWR-ALOS-V2900_AG1302
Notes
•
The diff command is executed at the end of putcfg to notify the remote client of the difference
between the new and the current configurations.
•
putcfg_apply runs the apply command after the putcfg command.
•
putcfg_apply_save saves the new configuration to the flash after the putcfg_apply
command.
SSH and SCP Encryption of Management Messages
Table 7 shows the encryption and authentication methods that are supported for SSH and SCP:
Generating RSA Host and Server Keys for SSH Access
To support the SSH server feature, two sets of RSA keys (host and server keys) are required. The
host key is 1024 bits and is used to identify Alteon. The server key is 768 bits and is used to make it
impossible to decipher a captured session by breaking into Alteon at a later time.
When you first enable and apply the SSH server, Alteon generates the RSA host and server keys and
is stored in the flash memory.
To configure RSA host and server keys
1. Connect to Alteon via the console port (the commands for this procedure are not available via
Telnet connection).
2. Enter the following commands to generate the keys manually:
These two commands take effect immediately without the need of an apply command.
When Alteon reboots, it retrieves the host and server keys from the flash memory. If these two keys
are not available in the flash memory and if the SSH server feature is enabled, Alteon generates
them during the system reboot. This process may take several minutes to complete.
>># scp appldevice.cfg 192.168.249.13:putcfg_apply
>># scp appldevice.cfg 192.168.249.13:putcfg_apply_save
Table 7: SSH and SCP Encryption of Management Messages
Encryption/Authentication
Method
Server host authentication
The client RSA authenticates Alteon at the beginning of
every connection.
Key exchange
RSA
Encryption
3DES-CBC, DES
User authentication
Local password authentication, RADIUS,
SecurID
via
RADIUS, for SSH only. It does not apply to SCP.
>> # /cfg/sys/access/sshd/hkeygen
(Generates the host key)
>> # /cfg/sys/access/sshd/skeygen
(Generates the server key)
