Alcatel-Lucent OmniSwitch 6850 Series, Руководство по управлению

Страница: 207 / 292

Managing Switch Security Setting Up Management Interfaces for ASA
OmniSwitch 6800/6850/9000 Switch Management Guide December 2007 page 8-11
In this scenario, SNMP access is not enabled because only RADIUS servers have been included in the
default setting. If servers of different types are configured and include LDAP or local , SNMP will be
enabled through those servers. For example:
-> aaa authentication default rad1 ldap2 local
In this case, SNMP access is enabled, and users will be authenticated through ldap2 and the local data-
base.
The default keyword may also be used to reset a specified interface to the default interface setting. For
example:
-> aaa authentication telnet default
In this example, Telnet users will now be authenticated through the servers that are specified for the
default interface.
Using Secure Shell
Secure Shell is recommended instead of Telnet and FTP as a method for accessing the switch. (Telnet and
FTP are not secure.) Secure Shell contains a secure FTP application that may be used after a Secure Shell
session is initiated. If Secure Shell is enabled, it is recommended that Telnet and FTP be disabled. For
example:
-> no aaa authentication telnet
-> no aaa authentication ftp
-> aaa authentication ssh rad1 ldap2 local
In addition to enabling Secure Shell on the switch, you may want to replace the DSA key on the switch.
The DSA key is generated at initial switch startup and copied to the secondary CMM; it includes a private
key that generates a digital signature against a public key. The Secure Shell client will verify this signa-
ture when the client attempts to log into the switch.
The DSA key on the switch is made up of two files contained in the /flash/network directory; the public
key is called ssh_host_dsa_key.pub , and the private key is called ssh_host_dsa_key . To generate a
different DSA key, use the Secure Shell tools available on your Unix or Windows system and copy the
files to the /flash/network directory.
For more information about Secure Shell, see Chapter 2, “Logging Into the Switch.”
Note. Secure Shell cannot be used for Authenticated VLANs.