H3C Technologies H3C S12500 Series Switches - Manual (Page 41)

29
Figure 11 SSH login diagram
Table 12 shows the SSH server and client configuration required for a successful SSH login.
Table 12 SSH server and client requirements
Device role Requirements
SSH server
• Assign an IP address to the SSH server, and make sure the SSH server and
client can reach each other.
• Configure the authentication mode and other settings.
SSH client
• If the host operates as an SSH client, run the SSH client program on the
host.
• Obtain the IP address of the SSH server.
To control SSH access to the switch working as an SSH server, configure authentication and user privilege
level for SSH users.
As an SSH client:
• You can log in to an SSH sever from the client to perform operations on the server.
• By default, the switch is enabled with the SSH client function.
Logging in to the switch from an SSH client
By default, the switch is disabled with the SSH server function, password authentication is adopted for
SSH login, but no login password is configured. To log in to the switch from an SSH client, log in to the
switch through the console port (see " Logging in through the console or AUX port ") and configure the
switch as an SSH server.
Follow these guidelines when you configure the SSH server:
• To make the command authorization or command accounting function take effect, apply an
HWTACACS scheme to the intended ISP domain. This scheme must specify the IP address of the
authorization server and other authorization parameters.
• If the local authentication scheme is used, use the authorization-attribute level level command in
local user view to set the user privilege level on the device.
• If a RADIUS or HWTACACS authentication scheme is used, set the user privilege level on the
RADIUS or HWTACACS server.
The SSH client authentication method is password in this configuration procedure. For more information
about SSH and publickey authentication, see Security Configuration Guide.
To configure the switch as an SSH server:
Step Command Remarks
1. Enter system view. system-view N/A
2. Create local key pairs. public-key local create { dsa | rsa }
By default, no local key pairs are
created.