HPE 704654-B21, Руководство по настройке безопасности

Страница: 341 / 540

328
Protocols and standards
RFC 6239, Suite B Cryptographic Suites for Secure Shell (SSH)
FIPS compliance
The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for
features, commands, and parameters might differ in FIPS mode and non-FIPS mode. For more
information about FIPS mode, see "Configuring FIPS."
Configuring the device as an SSH server
SSH server configuration task list
Tasks at a glance Remarks
(Optional.) Generating local key pairs N/A
(Required.) Enabling the Stelnet server Required for Stelnet servers.
(Required.) Enabling the SFTP server Required for SFTP servers.
(Required.) Enabling the SCP server Required for SCP servers.
(Required.) Configuring NETCONF over SSH Required for NETCONF-over-SSH servers.
(Required.) Configuring user lines for SSH login
Required for Stelnet servers and
NETCONF-over-SSH servers.
(Required.) Configuring a client's host public key
Required if the authentication method is
publickey , password-publickey, or any .
Configuring the PKI domain for verifying the client
certificate
See "Configuring PKI."
Required if the following conditions exist:
•
The authentication method is publickey .
•
The clients send the public keys to the
server through digital certificates for validity
check.
The PKI domain must have the CA certificate to
verify the client certificate.
(Required/optional.) Configuring an SSH user
Required if the authentication method is
publickey , password-publickey , or any .
Optional if the authentication method is
password .
(Optional.) Configuring the SSH management
parameters
N/A
(Optional.) Specifying a PKI domain for the SSH server N/A
Generating local key pairs
The DSA, RSA, or ECDSA key pairs are required for generating the session keys and session ID in
the key exchange stage. They can also be used by a client to authenticate the server. When a client
authenticates the server, it compares the public key received from the server with the server's public
key that the client saved locally. If the keys are consistent, the client uses the locally saved server's