H3C Technologies H3C S5120 Series Switches - Manual (Page 483)

1-5
Follow these steps to generate a DSA or RSA key pair on the SSH server:
To do… Use the command… Remarks
Enter system view system-view —
Generate a DSA or RSA key
pair public-key local create { dsa |
rsa }
Required
By default, there is neither DSA
key pair nor RSA key pair.
z For details about the public-key local create command, refer to Public Key Commands.
z To ensure that all SSH clients can log into the SSH server successfully, you are recommended to
generate both DSA and RSA key pairs on the SSH server. This is because different SSH clients
may use different publickey algorithms, though a single client usually uses only one type of
publickey algorithm.
z The public-key local create rsa command generates two RSA key pairs: a server key pair and a
host key pair. Each of the key pairs consists of a public key and a private key. The public key in the
server key pair of the SSH server is used in SSH1 to encrypt the session key for secure
transmission of the key. As SSH2 uses the DH algorithm to generate the session key on the SSH
server and client respectively, no session key transmission is required in SSH2 and the server key
pair is not used.
z The length of the modulus of RSA server keys and host keys must be in the range 512 to 2048 bits.
Some SSH2 clients require that the length of the key modulus be at least 768 bits on the SSH
server side.
z The public-key local create dsa command generates only the host key pair. SSH1 does not
support the DSA algorithm.
z The length of the modulus of DSA host keys must be in the range 512 to 2048 bits. Some SSH2
clients require that the length of the key modulus be at least 768 bits on the SSH server side.
Enabling the SSH Server Function
Follow these steps to enable the SSH server function:
To do… Use the command… Remarks
Enter system view system-view —
Enable the SSH server function ssh server enable
Required
Disabled by default
Configuring the User Interfaces for SSH Clients
An SSH client accesses the device through a VTY user interface. Therefore, you need to configure the
user interfaces for SSH clients to allow SSH login. Note that the configuration takes effect only for
clients logging in after the configuration.
Follow these steps to configure the protocols for the current user interface to support: