Quidway NetEngine20/20E
Configuration Guide - Basic Configurations
9 Telnet and SSH
Issue 05 (2010-01-30)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
9-43
#
return
9.8.5 Example for Authenticating SSH Through RADIUS
Networking Requirements
When the RADIUS user is connected to the server, the SSH server sends the authentication
information about the SSH client, including the user name and password to the RADIUS
server that is compatible with the TACACS server for authentication.
The RADIUS server authenticates the user and sends the result (passed or failed) back to the
SSH server. If the authentication is passed, the user level is included in the result. The SSH
server determines whether the SSH client is allowed to set up a connection according to the
authentication result.
The networking diagram is shown in
Figure 9-9
.
Figure 9-9
Networking diagram of authenticating the SSH through RADIUS
SSH Server
SSH Client
RADIUS Server
Configuration Roadmap
The configuration roadmap is as follows:
1.
Configure the RADIUS template on the SSH server.
2.
Configure a domain on the SSH server.
3.
Create a user on the RADIUS server.
Data Preparation
To complete the configuration, you need the following data:
z
Set the authentication modes of one SSH user to password.
z
RADIUS authentication
z
Name of the RADIUS template
z
Name of the RADIUS domain
z
Name and password of the RADIUS user
Configuration Procedure
Step 1
Generate a local key pair on the SSH server.
<Quidway>
system-view
[Quidway]
rsa local-key-pair create
The key name will be: Quidway_Host
The range of public key size is (512 ~ 2048).
NOTES: If the key modulus is greater than 512,
