H3C S5120-SI Series, Руководство по эксплуатации

Страница: 460 / 697

2-14
When Switch Acts as Server for Publickey Authentication
Network requirements
z
As shown in Figure 1-3 , a local SSH connection is established between the host (the SSH client)
and the switch (the SSH server) for secure data exchange.
z
Publickey authentication is used, the algorithm is RSA.
Figure 1-3 Switch acts as server for publickey authentication
SSH client SSH server
Host Switch
192.168.1.56/24
Vlan-int1
192.168.1.40/24
Configuration procedure
1) Configure the SSH server
# Generate RSA and DSA key pairs and enable SSH server.
<Switch> system-view
[Switch] public-key local create rsa
[Switch] public-key local create dsa
[Switch] ssh server enable
# Configure an IP address for VLAN interface 1. This address will serve as the destination of the SSH
connection.
[Switch] interface vlan-interface 1
[Switch-Vlan-interface1] ip address 192.168.1.40 255.255.255.0
[Switch-Vlan-interface1] quit
# Set the authentication mode for the user interfaces to AAA.
[Switch] user-interface vty 0 4
[Switch-ui-vty0-4] authentication-mode scheme
# Enable the user interfaces to support SSH.
[Switch-ui-vty0-4] protocol inbound ssh
# Set the user command privilege level to 3.
[Switch-ui-vty0-4] user privilege level 3
[Switch-ui-vty0-4] quit
Before performing the following tasks, you must use the client software to generate an RSA key pair on
the client, save the public key in a file named key.pub , and then upload the file to the SSH server
through FTP or TFTP. For details, refer to Configure the SSH client below.
# Import the client’s public key from file key.pub and name it Switch001 .
[Switch] public-key peer Switch001 import sshkey key.pub