Nokia 7705 - Page 31

System Management Guide Security
Edition: 01 3HE 11018 AAAC TQZZA 31
The 7705 SAR has a global SSH server process to support inbound SSH and SCP
sessions initiated by external SSH or SCP client applications. The SSH server
supports SSH1. This server process is separate from the SSH and SCP client
commands on the 7705 SAR, which initiate outbound SSH and SCP sessions.
Inbound SSH sessions are counted as inbound Telnet sessions for the purposes of
the maximum number of inbound sessions specified by Login Control. Inbound SCP
sessions are counted as inbound FTP sessions by Login Control.
When the SSH server is enabled, an SSH security key is generated. The key is only
valid until either the node is restarted or the SSH server is stopped and restarted. The
key size is non-configurable and set at 1024 bits. When the server is enabled, both
inbound SSH and SCP sessions will be accepted provided the session is properly
authenticated.
When the global SSH server process is disabled, no inbound SSH or SCP sessions
will be accepted.
When using SCP to copy files from an external device to the file system, the
7705 SAR SCP server will accept either forward slash (“/”) or backslash (“\”)
characters to delimit directory and/or filenames. Similarly, the 7705 SAR SCP client
application can use either slash or backslash characters, but not all SCP clients treat
backslash characters as equivalent to slash characters. In particular, UNIX systems
will often interpret the backslash character as an “escape” character, which does not
get transmitted to the 7705 SAR SCP server. For example, a destination directory
specified as “cf3:\dir1\file1” will be transmitted to the 7705 SAR SCP server as
“cf3:dir1file1”, where the backslash escape characters are stripped by the SCP client
system before transmission. On systems where the client treats the backslash like
an “escape” character, a double backslash “\\” or the forward slash “/” can typically
be used to properly delimit directories and the filename.
The 7705 SAR support for SSH and SCP is the same for both IPv4 and IPv6
addressing, including support for:
• SSH1 and SSH2
• in-band and out-of-band management of the 7705 SAR
• key management and authentication types
• encryption types
• simultaneous IPv4 and IPv6 SSH/SCP sessions