337
method is supported only when the router acts as an SSH server and uses the HWTACACS
server as the remote authentication server.
•
any
: Specifies either password authentication, publickey authentication, or
keyboard-interactive authentication.
•
password
-
publickey
: Specifies both password authentication and publickey authentication
(featuring higher security) if the client runs SSH2, and specifies either type of authentication if
the client runs SSH1.
•
publickey
: Specifies publickey authentication. This authentication method has the complicated
and slow encryption, but it provides strong authentication that can defend against brute-force
attacks. This authentication method is easy to use. If this method is configured, the
authentication process completes automatically without the need of entering any password.
assign
: Specifies parameters that are used to verify the client.
•
pki-domain
pkiname
: Specifies the PKI domain which verifies the client certificate. The
pkiname
argument is a case-insensitive string of 1 to 15 characters. The server uses the CA
certificate that is saved in the PKI domain to verify one or multiple client certificates without
saving clients' public keys in advance.
•
publickey
keyname
: Specifies the public key of the SSH user. The
keyname
argument
represents an existing public key to an SSH user, and is a case-sensitive string of 1 to 64
characters. The server checks the validity of the user through the user's public key that has
been locally saved. If the public key file on the client changes, the server needs to update the
local configuration promptly.
work-directory
directory-name
: Specifies the working directory for an SFTP user. The
directory-name
argument is a string of 1 to 135 characters.
Usage guidelines
If the SSH server uses publickey authentication, you must create an SSH user account on the device.
If the SSH server uses password authentication, you do not need to create the user account on the
device, but you must configure the user account information on the device for local authentication, or
on the remote authentication server (such as a RADIUS server) for remote authentication.
If you specify a public key or PKI domain for a user multiple times, the most recent configuration
takes effect.
You can change parameters for an SSH user that has logged in, but your changes take effect for the
user at next login.
If an SFTP or SCP user has been assigned a public key or PKI domain, it is necessary to set a
working folder for the user.
The working folder of an SFTP or SCP user depends on the user authentication method. For a user
using only password authentication, the working folder is the AAA authorized one. For a user using
only publickey authentication or using both publickey authentication and password authentication,
the working folder is the one set by using the
ssh user
command.
Examples
# Create an SSH user named
user1
, setting the service type as
sftp
, the authentication method as
publickey
, assigning a public key named
key1
to the client, and the work folder of the SFTP server
as
cfa0
:
<Sysname> system-view
[Sysname] ssh user user1 service-type sftp authentication-type publickey assign publickey
key1 work-directory cfa0:
Related commands
•
display ssh user-information
•
pki
domain
