HP 10500 series, Руководство по настройке безопасности

Страница: 378 / 596

364
{
For a client that sends the user's public key information to the server through a digital
certificate, specify a PKI domain on the server to verify the client's digital certificate. For
successful verification, the specified PKI domain must have the correct CA certificate. To
specify the PKI domain, use the
ssh user or ssh server pki-domain command. For more
information about configuring a PKI domain, see " Configuring PKI ."
•
When the device operates in FIPS mode as an SSH server, the device does not support the
authentication method of
any or publickey .
Configuration procedure
To configure an SSH user, and specify the service type and authentication method:
Step Command
1. Enter system view.
system-view
2. Create an SSH user, and
specify the service type and
authentication method.
•
In non-FIPS mode:
ssh user username service-type { all | netconf | scp | sftp |
stelnet } authentication-type { password | { any |
password-publickey | publickey } [ assign { pki-domain
domain-name | publickey keyname } ] }
•
In FIPS mode:
ssh user username service-type { all | netconf | scp | sftp |
stelnet } authentication-type { password |
password-publickey [ assign { pki-domain domain-name |
publickey keyname } ] }
Configuring the SSH management parameters
Step Command Remarks
1. Enter system view.
system-view N/A
2. Enable the SSH server to
support SSH1 clients.
ssh server compatible-ssh1x
enable
By default, the SSH server
supports SSH1 clients.
This command is not available in
FIPS mode.
3. Set the minimum interval for
updating the RSA server key
pair.
ssh server rekey-interval hours
By default, the RSA server key
pair is not updated.
This command takes effect only
on SSH1 users.
This command is not available in
FIPS mode.
4. Set the SSH user
authentication timeout timer.
ssh server
authentication-timeout
time-out-value
The default setting is 60 seconds.
If a user does not finish the
authentication when the timeout
timer expires, the connection
cannot be established.
5. Set the maximum number of
SSH authentication
attempts.
ssh server
authentication-retries
times
The default setting is 3.
If the authentication method is
any , the total number of publickey
authentication attempts and
password authentication attempts
cannot exceed the upper limit.