ssh
config>system>security
This command enables the context to configure the SSH server parameters on the system.
Quitting SSH while in the process of authentication is accomplished by either executing a ctrl-c or ‟~.” (tilde and dot), assuming the ‟~” is the default escape character for the SSH session.
n/a
client-cipher-list protocol-version version
config>system>security>ssh
This command enables the context to configure the list of allowed ciphers on the SSH client based on the SSH protocol version.
2
the protocol version for the list of allowed ciphers on the SSH client
cipher index name cipher-name
no cipher index
config>system>security>ssh>client-cipher-list
config>system>security>ssh>server-cipher-list
This command configures the allowed SSH protocol version 1 or version 2 ciphers that are available on the SSH client or server. Client cipher and server cipher lists are used to negotiate the best compatible cipher between the SSH client and SSH server. Client ciphers are used when the 7705 SAR node is acting as an SSH client; server ciphers are used when the 7705 SAR node is acting as an SSH server.
Each list contains ciphers and their corresponding index values, where a lower index has a higher preference in the SSH negotiation. The list is ordered by preference from highest to lowest.
The no form of this command deletes the specified cipher index.
n/a
the index of the cipher in the list
the allowed cipher name
client-kex-list
config>system>security>ssh
This command enables the context to configure a list of preferred KEX algorithms to be used by an SSHv2 client.
n/a
kex index name kex-name
no kex index
config>system>security>ssh>client-kex-list
config>system>security>ssh>server-kex-list
This command configures the list of preferred KEX algorithms that are negotiated by the client and server using an SSHv2 phase one handshake.
By default, a KEX client and KEX server each have a hard-coded list that contains the default indexes and their corresponding algorithms. Table: Default KEX Index Values lists the default index values and algorithms, in order of preference.
KEX Index Value |
KEX Algorithm Name |
|---|---|
200 |
diffie-hellman-group16-sha512 |
210 |
diffie-hellman-group14-sha256 |
215 |
diffie-hellman-group14-sha1 |
220 |
diffie-hellman-group-exchange-sha1 |
225 |
diffie-hellman-group1-sha1 |
The default list can be changed by manually removing a single index or as many indexes as required using the no kex index command. The default list can also be customized by first removing an index and then redefining it for each algorithm as required. To go back to using the original hard-coded list, the default KEX indexes must be manually re-entered with their corresponding algorithms.
In a KEX list, the algorithm with the lowest index value has the highest preference in the SSH negotiation. The list is ordered by preference from highest to lowest. When the client and server exchange their KEX lists, the first algorithm in the client list that is also supported by the server is the algorithm that is agreed upon.
If a 7705 SAR node is running in FIPS-140-2 mode:
SSHv1 is not supported
for SSHv2, the following KEX algorithm is not available: diffie-hellman-group1-sha1
The no form of this command removes the specified KEX index. Removing all the indexes from a client or server list results in an empty list, and any KEX algorithm the client or server brings to the SSHv2 negotiation will be rejected.
no kex
the index of the KEX algorithm in the list. The list is ordered from highest to lowest.
the KEX algorithm for computing the shared secret key
client-mac-list
config>system>security>ssh
This command enables the context to configure a list of preferred MAC algorithms to be used by an SSHv2 client.
n/a
mac index name mac-name
no mac index
config>system>security>ssh>client-mac-list
config>system>security>ssh>server-mac-list
This command configures the list of preferred MAC algorithms that are negotiated by an SSHv2 server or client.
Each algorithm in the list has a corresponding index value, where a lower index has a higher preference in the SSH negotiation. The list is ordered by preference from highest to lowest.
The no form of this command removes the specified MAC index from the list.
no mac
the index of the MAC algorithm in the list
the algorithm for calculating the message authentication code
key-re-exchange
config>system>security>ssh
This command enables the context to configure key re-exchange parameters for an SSH client or server.
client
config>system>security>ssh>key-re-exchange
This command enables the context to configure key re-exchange parameters for an SSH client.
mbytes {mbytes | disable}
no mbytes
config>system>security>ssh>key-re-exchange>client
config>system>security>ssh>key-re-exchange>server
This command configures the maximum number of megabytes that can be transmitted during an SSH session before an SSH client or server initiates the key re-exchange procedure.
If both the mbytes and minutes key re-exchange parameters are configured, the key re-exchange will occur at whatever limit is reached first.
The no form of this command returns the setting to the default value.
1024
specifies the number of megabytes that can be transmitted during an SSH session before the key re-exchange occurs
specifies that a session will never time out
minutes {minutes | disable}
no minutes
config>system>security>ssh>key-re-exchange>client
config>system>security>ssh>key-re-exchange>server
This command configures the maximum time that an SSH session can be up before an SSH client or server initiates the key re-exchange procedure.
If both the mbytes and minutes key re-exchange parameters are configured, the key re-exchange will occur at whatever limit is reached first.
The no form of this command returns the setting to the default value.
60
specifies the number of minutes before an SSH client or server initiates the key re-exchange
specifies that a session will never time out
[no] shutdown
config>system>security>ssh>key-re-exchange>client
config>system>security>ssh>key-re-exchange>server
This command enables or disables initiating of the key re-exchange procedure when the configured thresholds are reached.
no shutdown
server
config>system>security>ssh>key-re-exchange
This command enables the context to configure key re-exchange parameters for an SSH server.
[no] preserve-key
config>system>security>ssh
This command specifies the persistence of the SSH server host key. When enabled, the host key will be saved by the server and restored following a system reboot. This command can only be enabled or disabled when no SSH session is running.
The no form of the command specifies that the host key will be held in memory by the SSH server and not be restored following a system reboot.
no preserve-key
server-cipher-list protocol-version version
config>system>security>ssh
This command enables the context to configure the list of allowed ciphers on the SSH server based on the SSH protocol version.
2
the protocol version for the list of allowed ciphers on the SSH server
server-kex-list
config>system>security>ssh
This command enables the context to configure a list of preferred KEX algorithms to be used by an SSHv2 server.
n/a
server-mac-list
config>system>security>ssh
This command enables the context to configure a list of preferred MAC algorithms to be used by an SSHv2 server.
n/a
[no] server-shutdown
config>system>security>ssh
This command disables the SSH server running on the system. The no version of the command enables the SSH server.
When the no server-shutdown command is executed, an SSH security key is generated. Unless the preserve-key command is enabled, this key is valid until either the node is restarted or the SSH server is stopped with the server-shutdown command and restarted. The key size is non-configurable and is set to 2048 for SSHv2 RSA and to 1024 for SSHv2 DSA and SSHv1 RSA1. Only SSHv2 RSA is supported in FIPS-140-2 mode.
no server-shutdown
version ssh-version
no version
config>system>security>ssh
This command specifies the SSH protocol version that will be supported by the SSH server. The server an be configured as Secure Shell version 1 (SSHv1), version 2 (SSHv2), or both. SSHv1 and SSHv2 are different protocols and encrypt at different parts of the packets. SSHv1 uses the server as well as host keys to authenticate systems, whereas SSHv2 only uses host keys. SSHv2 does not use the same networking implementation that SSHv1 does and is considered a more secure, efficient, and portable version of SSH.
specifies the SSH version