333
•
For all authentication methods except password authentication, you must specify a client's host
public key or digital certificate.
{
For a client that directly sends the user's public key information to the server, you must
specify the client's host public key on the server. The specified public key must already exist.
For more information about public keys, see "
Configuring a client's host public key
{
For a client that sends the user's public key information to the server through a digital
certificate, specify a PKI domain on the server to verify the client's digital certificate. For
successful verification, the specified PKI domain must have the correct CA certificate. To
specify the PKI domain, use the
ssh user
or
ssh server pki-domain
command. For more
information about configuring a PKI domain, see "Configuring PKI."
•
When the device operates in FIPS mode as an SSH server, the device does not support the
authentication method of
any
or
publickey
.
For information about configuring local users and remote authentication, see "Configuring AAA."
Configuration procedure
To configure an SSH user, and specify the service type and authentication method:
Step Command
1.
Enter system view.
system-view
2.
Create an SSH user, and
specify the service type and
authentication method.
•
In non-FIPS mode:
ssh user username service-type
{
all
|
netconf
|
scp
|
sftp
|
stelnet
}
authentication-type
{
password
| {
any
|
password-publickey
|
publickey
} [
assign
{
pki-domain
domain-name
|
publickey
keyname
} ] }
•
In FIPS mode:
ssh user
username
service-type
{
all
|
netconf
|
scp
|
sftp
|
stelnet
}
authentication-type
{
password
|
password-publickey
[
assign
{
pki-domain
domain-name
|
publickey
keyname
} ] }
Configuring the SSH management parameters
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable the SSH server to
support SSH1 clients.
ssh server compatible-ssh1x
enable
By default, the SSH server
supports SSH1 clients.
This command is not available in
FIPS mode.
3.
Set the minimum update
interval for the RSA server
key pair.
ssh server rekey-interval
hours
By default, the RSA server key
pair is not updated.
This command takes effect only
on SSH1 users.
This command is not available in
FIPS mode.
4.
Set the SSH user
authentication timeout timer.
ssh server
authentication-timeout
time-out-value
The default setting is 60 seconds.
If a user does not finish the
authentication when the timeout
timer expires, the connection
cannot be established.
5.
Set the maximum number of
SSH authentication
attempts.
ssh server
authentication-retries
times
The default setting is 3.
If a user does not finish the
