Brocade Multi-Service IronWare Security Configuration Guid Manual de usuario descargar pdf (Pagina 267)

Multi-Service IronWare Security Configuration Guide 249

53-1003035-02

SSH server version 2 support

Setting optional parameters

You can adjust the following SSH server settings on the device:

• Number of SSH server authentication retries

• User authentication method the device uses for SSH server connections

• Whether or not the device allows users to log in without supplying a password

• Port number for SSH server connections

• SSH server login timeout value

• A specific interface to be used as the source for all SSH server traffic from the device

• Maximum idle time for SSH server sessions

• Disable 3-DES support

Setting the number of SSH server authentication retries

By default, the device attempts to negotiate a connection with the connecting host three times. The

number of authentication retries can be changed to between 1 – 5.

For example, the following command changes the number of authentication retries to 5.

Brocade(config)# ip ssh authentication-retries 5

Syntax: ip ssh authentication-retries number

Deactivating user authentication

After the SSH server on the device negotiates a session key and encryption method with the

connecting client, user authentication takes place. The implementation of SSH server supports

DSA challenge-response authentication and password authentication.

With DSA challenge-response authentication, a collection of clients’ public keys are stored on the

device. Clients are authenticated using these stored public keys. Only clients that have a private

key that corresponds to one of the stored public keys can gain access to the device using SSH

server.

With password authentication, users are prompted for a password when they attempt to log into the

device (provided empty password logins are not allowed; refer to “Enabling empty password

logins”). If there is no user account that matches the user name and password supplied by the

user, the user is not granted access.

You can deactivate one or both user authentication methods for SSH server. Note that deactivating

both authentication methods essentially disables the SSH server entirely.

To disable DSA challenge-response authentication.

Brocade(config)# ip ssh key-authentication no

Syntax: ip ssh key-authentication yes | no

The default is “yes”.

To deactivate password authentication.

Brocade(config)# ip ssh password-authentication no

Syntax: ip ssh password-authentication no | yes

1 2 ... 262 263 264 265 266 267 268 269 270 271 272 ... 369 370

Sin comentarios

Brocade Multi-Service IronWare Security Configuration Guid Manual de usuario Pagina 267