![Redline RDL-3000 SC Скачать руководство пользователя страница 129](http://html.mh-extra.com/html/redline/rdl-3000-sc/rdl-3000-sc_user-manual_1429320129.webp)
RDL-3000
User Manual
70-00158-01-DRAFT
Proprietary Redline Communications © 2010
Page
129
of 142
November 25, 2010
7.4
SSH for Secure CLI
SSH is a standard feature on all RDL-3000 systems. SSH provides secure access when
using the command line interface (CLI) to manage RDL-3000 equipment. When SSH is
required, TELNET (unsecured access) should be disabled. Use an SSH client (e.g.,
OpenSSH, Putty, etc) to access an RDL-3000 using SSH.
It is recommended that system operators generate a unique certificate and private-public
keys, and load these on the RDL-3000 before using the HTTPS feature in a production
environment.
7.4.1
Out-of-Box Operation
The RDL-3000 provides out-of-box use of the SSH interface. If no user-generated DSA
key has been loaded on the RDL-3000, a temporary key is generated automatically.
Each reboot, a new self-generated key (ssh_key<mac>.pem) is loaded into the user
table. The self-generating key feature is disabled when the user loads a key in the
user (usr) table or creates a key using the CLI 'generate' command.
Note: When using the self-generated key, a warning message may be displayed, based
on the SSH client security settings (e.g.,
'Warning: Potential Security Breach. The servers
host key does not match ...'). T
he operator has full access to the secure CLI interface.
7.4.2
Enable SSH
SSH is disabled by (factory) default. Use the CLI or Web interface to enable SSH:
Web interface:
Configuration screen -> Ethernet: SSH Enable
CLI Command:
set ssh on
7.4.3
Loading an SSH Key File
Use the following steps to load user-generated X.509 certificate and key files:
1. Use a commercially available tool to create the required key file. The DSA key file
must conform to the following:
Maximum key size is 2048 bits
Key filename must be in the following format:
dsa_key_<mac>.pem
2. Copy the key file to the default directory on a TFTP server.
3. Use the CLI 'load' command to load the SSH DSA key into the user (usr) table. It is
recommended to use the local Ethernet port when transferring encryption keys and
certificates to the RDL-3000.
4. Reboot the RDL-3000 to activate changes.
5. Login to the RDL-3000 and verify the files have been successfully loaded.
Example
Use TFTP server at IP address 192.168.25.10 to load an SSH key file for the RDL-3000 with
MAC address 00 09 02 01 C1 9A.
192.168.25.2# load file 192.168.25.10 dsa_key_00-09-02-01-C1-9A.pem usr tftp
192.168.25.2#
show files usr
dsa_key.pem size=672 md5=fa9bd7a1f465fd7e9fed30150b0608c4
192.168.25.2#
192.168.25.2# reboot