HPE FlexFabric 5940 SERIES, Руководство по настройке безопасности

Страница: 375 / 571

362
•
To support SSH clients that use different types of key pairs, generate DSA, ECDSA, and RSA
key pairs on the SSH server.
•
The SSH server operating in FIPS mode supports only ECDSA and RSA key pairs. Do not
generate a DSA key pair on the SSH server.
•
The public-key local create rsa command generates a server key pair and a host key pair for
RSA. The RSA server key pair is only used in SSH1 to encrypt the session key for secure
transmission of the session key. It is not used in SSH2, because no session key transmission is
required in SSH2.
•
The public-key local create dsa command generates only one DSA host key pair. The key
modulus length must be less than 2048 bits when you generate the DSA key pair on the SSH
server. SSH1 does not support the DSA algorithm.
•
The public-key local create ecdsa secp256r1 or public-key local create ecdsa secp384r1
command generates only one ECDSA host key pair.
Configuration procedure
To generate local key pairs on the SSH server:
Step Command Remarks
1. Enter system view.
system-view N/A
2. Generate local key pairs.
public-key local create { dsa |
ecdsa { secp256r1 | secp384r1 }
| rsa }
By default, no local key pairs exist
on the server.
Enabling the Stelnet server
After you enable the Stelnet server on the device, a client can log in to the device through Stelnet.
To enable the Stelnet server:
Step Command Remarks
1. Enter system view.
system-view N/A
2. Enable the Stelnet server.
ssh server enable
By default, the Stelnet server is
disabled.
Enabling the SFTP server
After you enable the SFTP server on the device, a client can log in to the device through SFTP.
When acting as an SFTP server, the device does not support SFTP connections initiated by SSH1
clients.
To enable the SFTP server:
Step Command Remarks
1. Enter system view.
system-view N/A
2. Enable the SFTP server.
sftp server enable
By default, the SFTP server is
disabled.