HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

354
Step Command Remarks
4. Configure a client's host
public key.
Enter the content of the host
public key
Spaces and carriage returns are
allowed between characters.
5. Return to public key view
and save the configured host
public key.
public-key-code end
When you exit public key code
view, the system automatically
saves the public key.
6. Return to system view.
peer-public-key end
N/A
Importing a client public key from a public key file
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Import the public key from a
public key file.
public-key peer
keyname
import sshkey
filename
N/A
Configuring an SSH user
If the authentication method is publickey, you must perform the procedure in this section.
If the authentication method is password-publickey or any, you must configure a local user
account by using the local-user command for local authentication, or configure an SSH user
account on an authentication server, for example, a RADIUS server, for remote authentication. For
more information about the local-user command, see HPE FlexNetwork MSR Router Series
Comware 5 Security Command Reference.
If the authentication method is password, you do not need to perform the procedure in this section to
configure them unless you want to use the display ssh user-information command to display all
SSH users, including the password-only SSH users, for centralized management.
Configuration guidelines
When you configure an SSH user, follow these guidelines:
• You can set the service type to Stelnet, SFTP, or SCP.
• You can enable one of the following authentication modes for the SSH user:
{ Password—The user must pass password authentication.
{ Publickey authentication—The user must pass publickey authentication.
{ Password-publickey authentication—As an SSH2.0 user, the user must pass both
password and publickey authentication. As an SSH1 user, the user must pass either
password or publickey authentication.
{ Any—The user can use either password authentication or publickey authentication.
• All authentication methods, except password authentication, require a client's host public key or
digital certificate to be specified.
{ If a client directly sends the user's public key information to the server, the server must
specify the client's public key and the specified public key must already exist. For more
information about public keys, see "Configuring a client's host public key."
{ If a client sends the user's public key information to the server through a digital certificate,
the server must specify the PKI domain for verifying the client certificate. For more
information about configuring a PKI domain, see "Configuring PKI." To make sure the
authorized SSH users pass the authentication, the specified PKI domain must have the
proper CA certificate.
• If the authentication method is publickey or password-publickey, the command level
accessible to the user is set by the user privilege level command on the user interface. If the

HPE FlexNetwork MSR Series Specifications

General

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English