Cisco Systems 15327 Manual de usuario descargar pdf (Pagina 315)

19-3

Ethernet Card Software Feature and Configuration Guide, R7.2

January 2009

Chapter 19 Configuring Security for the ML-Series Card

Configuring SSH

SSH has two applications, an SSH server and SSH client. The ML-Series card only supports the SSH

server and does not support the SSH client. The SSH server in Cisco IOS software works with publicly

and commercially available SSH clients.

The SSH server enables a connection into the ML-Series card, similar to an inbound Telnet connection,

but with stronger security. Before SSH, security was limited to the native security in Telnet. SSH

improves on this by allowing the use of Cisco IOS software authentication.

The ONS node also supports SSH. When SSH is enabled on the ONS node, you use SSH to connect to

the ML-Series card for Cisco IOS CLI sessions.

Note Telnet access to the ML-Series card is not automatically disabled when SSH is enabled. The user can

disable Telnet access with the vty line configuration command transport input ssh.

Configuring SSH

This section has this configuration information:

• Configuration Guidelines, page 19-3

• Setting Up the ML-Series Card to Run SSH, page 19-3 (required)

• Configuring the SSH Server, page 19-4 (required)

Configuration Guidelines

Follow these guidelines when configuring the ML-Series card as an SSH server:

• The new model of AAA and a AAA login method must be enabled. If not previously enabled,

complete the “Configuring AAA Login Authentication” section on page 19-11.

• A Rivest, Shamir, and Adelman (RSA) key pair generated by a SSHv1 server can be used by an

SSHv2 server, and the reverse.

• If you get CLI error messages after entering the crypto key generate rsa global configuration

command, an RSA key pair has not been generated. Reconfigure the hostname and domain, and then

enter the crypto key generate rsa command. For more information, see the “Setting Up the

ML-Series Card to Run SSH” section on page 19-3.

• When generating the RSA key pair, the message No host name specified might appear. If it does,

you must configure a hostname by using the hostname global configuration command.

• When generating the RSA key pair, the message No domain specified might appear. If it does, you

must configure an IP domain name by using the ip domain-name global configuration command.

Setting Up the ML-Series Card to Run SSH

Follow these steps to set up your ML-Series card to run as an SSH server:

1. Configure a hostname and IP domain name for the ML-Series card.

2. Generate an RSA key pair for the ML-Series card, which automatically enables SSH.

3. Configure user authentication for local or remote access. This step is required.

Beginning in privileged EXEC mode, follow these steps to configure a hostname and an IP domain name

and to generate an RSA key pair.

1 2 ... 310 311 312 313 314 315 316 317 318 319 320 ... 583 584

Sin comentarios

Cisco Systems 15327 Manual de usuario Pagina 315