RDL-3000
FAMILY
USER MANUAL
70-00158-03-00
Proprietary Redline Communications © 2015
Page
162
of 254
April 17, 2015
The self-generated certificate does not provide a secure solution. It is strongly
recommended to load a unique user-generated DSA key file before using the SSH
feature in a production environment.
When using the self-generated key, a warning message may be displayed based on the
SSH client security settings (e.g.,
Warning: Potential Security Breach. The servers host
key does not match
). This message does not interfere with the function and the operator
has full access to the secure Web interface.
Enabling SSH
SSH is disabled by (factory) default. Use the following steps to enable SSH.
Use Self Generated (Temporary) Key
For out-of-box operation, a temporary DSA key is self-generated on reboot.
1.
Use the CLI or Web interface to enable SSH:
Web: Configuration screen -> Ethernet: SSH Enable
CLI:
set ssh on
2.
Save the configuration to activate changes.
3.
Verify the radio is accessible using SSH, and then use the CLI or Web interface to
disable HTTP and Telnet.
Use Operator Generated (Permanent) Key
The operator can create a permanent key using the self-generate feature or load an
externally generated key. Both operations disable the self-renewing key function.
5.
Use one of the following methods to generate a key file:
Option 1: Create a DSA key using the CLI 'generate' command. This function self-
generates a key file and saves this value permanently in the user (usr) table. Reboot
the radio to activate the key.
Example: Generate a new DSA key file.
generate sshkey dsa
reboot
Option 2: Use a commercially available tool to create the DSA key file. A TFTP
server is required to load an externally generated key file.
The selected tool must create a file that conforms to the following:
Maximum key size is 2048 bits
Key filename must be in the following format: dsa_key_<mac>.pem
6.
Use a TFTP server to load the key file into the radio (option 3 only).
a. Copy the key file to the default directory of a TFTP server.
b. Use the CLI 'load' command to copy the key file from the TFTP server to the
user (usr) table on the radio.
c. Use the CLI command 'show files usr' to verify the files have been loaded.
d. Reboot the radio to activate changes.
Example: Use TFTP server at IP address 192.168.25.10 to load an SSH key file:
load file 192.168.25.10 dsa_key_00-09-02-01-C1-9A.pem usr tftp
show files usr
dsa_key.pem size=672 md5=fa9bd7a1f465fd7e9fed30150b0608c4
7.
Use the CLI or Web interface to enable SSH:
Web: Configuration screen -> Ethernet: SSH Enable
CLI: set ssh on
8.
Save the configuration to activate changes.
9.
Verify the radio is accessible using SSH, and then use the CLI or Web interface to
disable HTTP and Telnet.