Juniper JUNOSE 11.3, Руководство по настройке

Страница: 452 / 632

algorithms are specified in order of preference in each list. The client and server use the
algorithm for each process that matches the client’s highest preference and is supported
by the server. If no intersection is found, the negotiation attempt fails and the connection
is terminated.
If algorithm negotiation is successful, the server sends its public host key to the client for
authentication so the client can be certain that it is connected to the intended host rather
than to an imposter. The client compares the key to its host key database. The client
authenticates the server if the key is found in the database. If the key is not present, then
the client can accept or reject this new, unknown key depending on how you have
configured the client. For more information, see “Host Key Management” on page 422.
When the client authenticates the server’s host key, it begins the transport key exchange
process by sending the key data required by the negotiated set of algorithms. The server
responds by sending its own key data set. If both sides agree that the keys are consistent
and authentic, the keys are applied so that all subsequent messages between client and
server are encrypted, authenticated, and compressed according to the negotiated
algorithms.
User Authentication
User authentication begins after the transport keys are applied. The client typically asks
the server which authentication methods it supports. The server responds with a list of
supported methods with no preference.
The system software currently supports RADIUS and password authentication.
RADIUS authentication is enabled by default. Based on the authentication protocol that
a user enables, the RADIUS or server validates the username and password
from its database. If user authentication is disabled, then all SSH clients that pass protocol
negotiation are accepted.
Connection
The SSH connection layer creates the user session when the user is authenticated. The
server waits for a connection request. The router currently supports only shell requests,
which the server interprets as a request for entry into a CLI session. The server ignores
any other requests, such as X11 or TCP/IP tunneling.
Key Management
The E Series router implementation of SSH provides for management of user keys and
host keys.
User Key Management
Key administration is still under development for the server environment.
Host Key Management
You create a host key for the SSH server with the crypto key generate dss command. If
a host key already exists, this command replaces it with a new key and terminates all
ongoing SSH sessions. Any SSH clients that previously accepted the old host key reject
Copyright © 2010, Juniper Networks, Inc. 422
JunosE 11.3.x System Basics Configuration Guide