Configuring SSH·· 2

Overview·· 2

How SSH works 2

SSH authentication· 3

Configuring the device as an SSH server 4

SSH server configuration task list 4

Generating local RSA key pairs 4

Enabling the SSH server function· 5

Enabling the SFTP server function· 5

Configuring the user interfaces for SSH clients 5

Configuring a client's host public key· 6

Configuring an SSH user 7

Setting the SSH management parameters 8

Configuring the device as an Stelnet client 9

Stelnet client configuration task list 9

Specifying a source IP address or source interface for the Stelnet client 10

Enabling and disabling first-time authentication· 10

Establishing a connection to an Stelnet server 11

Configuring the device as an SFTP client 11

SFTP client configuration task list 11

Specifying a source IP address or source interface for the SFTP client 12

Establishing a connection to an SFTP server 12

Working with SFTP directories 13

Working with SFTP files 14

Displaying help information· 14

Terminating the connection with the SFTP server 15

Configuring the device as an SCP client 15

SCP client configuration task list 15

Transferring files with an SCP server 15

Displaying and maintaining SSH·· 16

Stelnet configuration examples 17

Password authentication enabled Stelnet server configuration example· 17

Publickey authentication enabled Stelnet server configuration example· 21

Password authentication enabled Stelnet client configuration example· 26

Publickey authentication enabled Stelnet client configuration example· 29

SFTP configuration examples 30

Password authentication enabled SFTP server configuration example· 30

Publickey authentication enabled SFTP client configuration example· 32

SCP configuration example· 35

Network requirements 35

Configuration procedure· 35

Overview

Secure Shell (SSH) is a network security protocol. Using encryption and authentication, SSH implements remote login and file transfer securely over an insecure network.

SSH uses the typical client/server model, establishing a channel to protect data transfer based on TCP.

SSH includes two versions: SSH1.x and SSH2.0 (hereinafter referred to as SSH1 and SSH2), which are not compatible. SSH2 is better than SSH1 in performance and security.

The device can not only work as an SSH server to provide services to SSH clients, but can also work as an SSH client to allow users to establish SSH connections with a remote SSH server. When acting as an SSH server, the device supports SSH and SSH1. When acting as an SSH client, the device supports SSH2 only.

The device supports the following SSH applications:

·          Stelnet—Provides secure and reliable network terminal access services. Through Stelnet, a user can log in to a remote server securely. Stelnet protects devices against attacks such as IP spoofing and plain text password interception. The device can act as both the Stelnet server and Stelnet client.

·          SFTP—Based on SSH2, SFTP uses the SSH connection to provide secure file transfer. The device can serve as the SFTP server, allowing a remote user to log in to the SFTP server for secure file management and transfer. The device can also serve as an SFTP client, enabling a user to log in from the device to a remote device for secure file transfer.

·          SCP—Based on SSH2, SCP offers a secure approach to copying files. The device can act as the SCP server, allowing a user to log in to the device for file upload and download. The device can also act as an SCP client, enabling a user to log in from the device to a remote server for secure file transfer.

How SSH works

This section uses SSH2 as an example.

To establish an SSH connection and communicate with each other through the connection, an SSH client and an SSH server go through the stages listed in Table 1. For more information about these stages, see SSH Technology White Paper.

Table 1 Stages of secure session establishment

Stages	Description
Connection establishment	The SSH server listens to the connection requests on port 22. After a client initiates a connection request, the server and the client establish a TCP connection.
Version negotiation	The two parties determine a version to use after negotiation.
Algorithm negotiation	SSH supports multiple algorithms. Based on the local algorithms, the two parties determine the key exchange algorithm for generating session keys, the encryption algorithm for encrypting data, public key algorithm for digital signature and authentication, and the HMAC algorithm for protecting data integrity.
Key exchange	The two parties use the Diffie-Hellman (DH) exchange algorithm to dynamically generate the session key for protecting data transfer and the session ID for identifying the SSH connection. In this stage, the client authenticates the server as well.
Authentication	The SSH server authenticates the client in response to the client's authentication request.
Session request	After passing authentication, the client sends a session request to the server to request the establishment of a session (Stelnet, SFTP, or SCP).
Interaction	After the server grants the request, the client and the server start to communicate with each other in the session. In the interaction stage, you can execute commands from the client by pasting the commands in text format (the text must be within 2000 bytes). The commands must be available in the same view. Otherwise, the server might not be able to execute the commands correctly. If you want to execute commands of more than 2000 bytes, you can save the commands in a configuration file, upload it to the server through SFTP, and use it to restart the server.

 

SSH authentication

When the device acts as an SSH server, it supports the following authentication methods:

·          Password authentication—The SSH server uses AAA for authentication of the client. During password authentication, the SSH client encrypts its username and password, encapsulates them into an authentication request, and sends the request to the server. After receiving the request, the SSH server decrypts the request to get the username and password in plain text, checks the validity of the username and password locally or by a remote AAA server, and then informs the client of the authentication result.

·          Publickey authentication—The server authenticates the client by verifying the digital signature of the client. During publickey authentication, the client sends the server a publickey authentication request that contains its username, public key, and publickey algorithm information (or the digital certificate that carries the public key information). The server examines whether the public key is valid. If the public key is invalid, the authentication fails. If the public key is valid, the server verifies the digital signature of the client by using the public key of the client. The device supports using the publickey algorithm RSA to generate or verify the digital signature.

A client can send public key information to the device that acts as the server for validity check in either of the following methods:

¡  The client directly sends the user's public key information to the server, and the server checks the validity of the user's public key.

¡  The client sends the user's public key information to the server through a digital certificate, and the server checks the validity of the digital certificate. When acting as a client, the device does not support this method.

·          Password-publickey authentication—The server requires clients that run SSH2 to pass both password authentication and publickey authentication. However, if a client runs SSH1, it only needs to pass either authentication.

·          Any authentication—The server requires the client to pass either of password authentication and publickey authentication.

In a password authentication process, if the remote AAA server requires the user for a password secondary authentication, it sends the SSH server an authentication response with a prompt. The prompt is transparently transmitted to the client, and displayed on the client to notify the user to enter a specified password. After the user enters the correct password and passes validity check by the remote AAA server, the device returns an authentication success message to the client.

 

	NOTE: Only clients that run SSH2 or a later version support password secondary authentication that is initiated by the AAA server.

 

Configuring the device as an SSH server

You can configure the device as an Stelnet server, SFTP server, or SCP server. Because the configuration procedures are similar, the SSH server represents the Stelnet server, SFTP server, and SCP server unless otherwise specified.

SSH server configuration task list

 

Task	Remarks
Generating local RSA key pairs	Required.
Enabling the SSH server function	Required for Stelnet, SFTP and SCP servers.
Enabling the SFTP server function	Required only for SFTP server.
Configuring the user interfaces for SSH clients	Required.
Configuring a client's host public key	Required if publickey authentication is configured for users and the clients directly send the public keys to the server for validity check.
Configuring the PKI domain of the client certificate	See "Configuring PKI." Required if publickey authentication is configured for users and the clients send the public keys to the server through digital certificates for validity check. The PKI domain must have the CA certificate to verify the client certificate.
Configuring an SSH user	Required for publickey authentication users and optional for other authentication users.
Setting the SSH management parameters	Optional.

 

Generating local RSA key pairs

RSA key pairs are required for generating the session key and session ID in the key exchange stage, and are also used by a client to authenticate the server. When a client tries to communicate with a server, it compares the public key that it receives from the server with the server public key that it saved locally. If the keys are consistent, the client uses the locally saved server's public key to decrypt the digital signature received from the server. If the decryption succeeds, the server passes the authentication.

The public-key local create rsa command generates a server RSA key pair and a host RSA key pair. Each of the key pairs consists of a public key and a private key. The RSA server key pair is used only in SSH1 to encrypt the session key for secure transmission of the session key. It is not used in SSH2, because no session key transmission is required in SSH2.

To generate local RSA key pairs on the SSH server:

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Generate RSA key pairs.	public-key local create rsa	By default, no RSA key pairs exist.

 

Enabling the SSH server function

The SSH server function on the device allows clients to communicate with the device through SSH.

When the device acts as an SCP server, only one SCP user is allowed to access to the SCP server at one time.

To enable the SSH server function:

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Enable the SSH server function.	ssh server enable	Disabled by default.

 

Enabling the SFTP server function

This SFTP server function enables clients to log in to the SFTP server through SFTP.

When the device functions as the SFTP server, only one client can access the SFTP server at one time.

To enable the SFTP server function:

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Enable the SFTP server function.	sftp server enable	Disabled by default.

 

Configuring the user interfaces for SSH clients

An SSH client accesses the device through a VTY user interface. You must configure the user interfaces for SSH clients to allow SSH login. The configuration takes effect only for the clients logging in after the configuration.

 

	IMPORTANT: Before you configure a user interface to support SSH, you must configure its authentication mode to scheme. Otherwise, the protocol inbound command fails.

 

To configure the user interface for SSH clients:

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Enter VTY user interface view.	user-interface vty number [ ending-number ]	N/A
3.       Set the login authentication mode to scheme.	authentication-mode scheme	By default, the authentication mode is password.
4.       Configure the user interface to support SSH login.	protocol inbound { all | ssh }	Optional. By default, Telnet and SSH are supported.

 

For more information about the authentication-mode and protocol inbound commands, see Fundamentals Command Reference.

Configuring a client's host public key

This configuration task is only necessary if publickey authentication is configured for users and the clients directly send the public key to the server for authentication.

During a publickey authentication for a client, the server first compares the SSH username and host public key received from the client with those saved locally. If they are the same, the server checks the digital signature that the client sends. The client generates the digital signature by using the private key that is paired with the client's host public key.

You must configure the client's RSA host public key on the server, and specify the associated host private key on the client to generate the digital signature, so that the client can pass publickey authentication with correct digital signature. If the device serves as a client, the associated host private key is specified by the specified public key algorithm.

You can manually configure the public key of an SSH client on the server, or import it from the public key file:

·          Manual configuration—Type or copy the client host public key on the client to the SSH server. The host public key must be in the DER encoding format, which has not been converted.

·          Importing from the public key file—Upload the client's host public key file (in binary) to the server (for example, through FTP or TFTP), and import the uploaded file to the server. During the import process, the server automatically converts the public key in the public key file to a string in PKCS format.

Manually configured client host public keys must be in the specified format. If you use the device to act as the client, you can use the display public-key local public command to view the host public key and copy its contents to the server. A host public key obtained in other ways might be in incorrect format and cannot be saved on the server. H3C recommends that you configure a client public key by importing it from a public key file.

You can configure up to 20 SSH client public keys on an SSH server.

Configuring a client public key manually

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Enter public key view.	public-key peer keyname	N/A
3.       Enter public key code view.	public-key-code begin	N/A
4.       Configure a client's host public key.	Enter the content of the host public key	Spaces and carriage returns are allowed between characters.
5.       Return to public key view and save the configured host public key.	public-key-code end	When you exit public key code view, the system automatically saves the public key.
6.       Return to system view.	peer-public-key end	N/A

 

Importing a client public key from a public key file

 

Step	Command
1.       Enter system view.	system-view
2.       Import the public key from a public key file.	public-key peer keyname import sshkey filename

 

For more information about client public key configuration, see "Managing public keys."

Configuring an SSH user

To configure an SSH user that uses publickey authentication, you must perform the procedure in this section.

To configure an SSH user that uses password authentication, whether together with publickey authentication or not, you must configure a local user account by using the local-user command for local authentication, or configure an SSH user account on an authentication server, for example, a RADIUS server, for remote authentication.

For password-only SSH users, you do not need to perform the procedure in this section to configure them unless you want to use the display ssh user-information command to display all SSH users, including the password-only SSH users, for centralized management.

Configuration guidelines

·          You can set the service type to Stelnet, SFTP, or SCP.

·          You can enable one of the following authentication modes for the SSH user:

¡  Password—The user must pass password authentication.

¡  Publickey authentication—The user must pass publickey authentication.

¡  Password-publickey authentication—As an SSH2.0 user, the user must pass both password and publickey authentication. As an SSH1 user, the user must pass either password or publickey authentication.

¡  Any—The user can use either password authentication or publickey authentication.

·          All authentication methods, except password authentication, require a client's host public key or digital certificate to be specified.

¡  If a client directly sends the user's public key information to the server, the server must specify the client's public key and the specified public key must already exist. For more information about public keys, see "Configuring a client's host public key."

¡  If a client sends the user's public key information to the server through a digital certificate, the server must specify the PKI domain for verifying the client certificate. For more information about configuring a PKI domain, see "Configuring PKI." To make sure the authorized SSH users pass the authentication, the specified PKI domain must have the proper CA certificate.

·          If publickey authentication, whether with password authentication or not, is used, the command level accessible to the user is set by the user privilege level command on the user interface. If only password authentication is used, the command level accessible to the user is authorized by AAA.

·          SSH1 does not support SFTP or SCP. For an SSH1 client, you must set the service type to stelnet or all.

·          For an SFTP SSH user, the working folder depends on the authentication method:

¡  If only password authentication is used, the working folder is authorized by AAA.

¡  If publickey authentication, whether with password authentication or not, is used, the working folder is set by using the ssh user command.

·          If you change the authentication mode or public key for an SSH user that has logged in, the change takes effect only at the next login of the user.

To configure an SSH user and specify the service type and authentication method:

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Create an SSH user, and specify the service type and authentication method.	·         Create an SSH user, and specify the service type and authentication method for Stelnet users: ssh user username service-type stelnet authentication-type { password | { any | password-publickey | publickey } assign { pki-domain pkiname | publickey keyname } } ·         Create an SSH user, and specify the service type and authentication method for all users, SCP or SFTP users: ssh user username service-type { all | scp | sftp } authentication-type { password | { any | password-publickey | publickey } assign { pki-domain pkiname | publickey keyname } work-directory directory-name }	Use either command.

 

Setting the SSH management parameters

The SSH management parameters can be set to improve the security of SSH connections. The SSH management parameters include:

·          Compatibility between the SSH server and SSH1 clients.

·          RSA server key pair update interval, applicable to users using SSH1 client.

·          SSH user authentication timeout period. This parameter is used to reject a connection if the authentication for the connection is not completed before the timeout period expires.

·          Maximum number of SSH authentication attempts. This parameter is used to prevent malicious password cracking.

·          SFTP connection idle timeout period. Once the idle period of an SFTP connection exceeds the specified threshold, the system automatically tears the connection down.

To set the SSH management parameters:

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Enable the SSH server to support SSH1 clients.	ssh server compatible-ssh1x enable	Optional. By default, the SSH server supports SSH1 clients.
3.       Set the RSA server key pair update interval.	ssh server rekey-interval hours	Optional. By default, the interval is 0, and the RSA server key pair is not updated.
4.       Set the SSH user authentication timeout period.	ssh server authentication-timeout time-out-value	Optional. 60 seconds by default.
5.       Set the maximum number of SSH authentication attempts.	ssh server authentication-retries times	Optional. 3 by default. Authentication fails if the number of authentication attempts (including both publickey and password authentication) exceeds the upper limit.
6.       Configure the SFTP connection idle timeout period.	sftp server idle-timeout time-out-value	Optional. 10 minutes by default.

 

Configuring the device as an Stelnet client

This section describes how to configure the device as an Stelnet client.

Stelnet client configuration task list

 

Task	Remarks
Specifying a source IP address or source interface for the Stelnet client	Optional.
Enabling and disabling first-time authentication	Optional.
Establishing a connection to an Stelnet server	Required.

 

Specifying a source IP address or source interface for the Stelnet client

By default, an Stelnet client uses the IP address of the outbound interface specified by the route to the Stelnet server as the source IP address to communicate with the Stelnet server. You can change the source IP address or specify a source interface for the client.

To make sure the Stelnet client and the Stelnet server can communicate with each other, and to improve the manageability of Stelnet clients in the authentication service, H3C recommends that you specify a loopback interface as the source interface.

To specify a source IP address or source interface for the Stelnet client:

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Specify a source IP address or source interface for the Stelnet client.	·         Specify a source IPv4 address or source interface for the Stelnet client: ssh client source { interface interface-type interface-number | ip ip-address } ·         Specify a source IPv6 address or source interface for the Stelnet client: ssh client ipv6 source { interface interface-type interface-number | ipv6 ipv6-address }	Use either approach.

 

Enabling and disabling first-time authentication   

When the device works as an SSH client and connects to the SSH server, you can configure whether the device supports first-time authentication.

When a client not configured with the server host public key access the server for the first time:

·          If first-time authentication is disabled, the client refuses to access the server. To enable the client to access the server, you must configure the server host public key locally and specify the public key name for authentication on the client in advance.

·          If first-time authentication is enabled, the client accesses the server, and saves the host public key on the client. When accessing the server again, the client uses the saved server host public key to authenticate the server.

In a secure network, first-time authentication simplifies client configuration, but also brings some potential security risks.

Enabling first-time authentication

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Enable first-time authentication.	ssh client first-time enable	Optional. Enabled by default.

 

Disabling first-time authentication

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Disable first-time authentication.	undo ssh client first-time	Enabled by default.
3.       Configure the server host public key.	See "Configuring a client's host public key"	The method for configuring the server host public key on the client is similar to that for configuring client public key on the server.
4.       Specify the host public key name of the server.	ssh client authentication server server assign publickey keyname	N/A

 

Establishing a connection to an Stelnet server

You can launch the Stelnet client to establish a connection to an Stelnet server, and specify the public key algorithm, the preferred encryption algorithm, the preferred HMAC algorithm, and the preferred key exchange algorithm.

To establish a connection to an Stelnet server:

 

Task	Command	Remarks
Establish a connection to an Stelnet server.	·         Establish a connection to an IPv4 server: ssh2 server [ port-number ] [ identity-key rsa | prefer-compress { zlib | zlib-openssh } | prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] * ·         Establish a connection to an IPv6 server: ssh2 ipv6 server [ port-number ] [ identity-key rsa | prefer-compress { zlib | zlib-openssh } |prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] *	Use either command in user view.

 

Configuring the device as an SFTP client

This section describes how to configure the device as an SFTP client.

SFTP client configuration task list

 

Task	Remarks
Specifying a source IP address or source interface for the SFTP client	Optional.
Enabling and disabling first-time authentication	Optional.
Establishing a connection to an SFTP server	Required.
Working with SFTP directories	Optional.
Working with SFTP files	Optional.
Displaying help information	Optional.
Terminating the connection with the SFTP server	Optional.

 

Specifying a source IP address or source interface for the SFTP client

By default, an SFTP client uses the IP address of the outbound interface specified by the route to the SFTP server as the source IP address to communicate with the SFTP server. You can change the source IP address or specify a source interface for the client.

To make sure the SFTP client and the SFTP server can communicate with each other, and to improve the manageability of SFTP clients in the authentication service, H3C recommends that you specify a loopback interface as the source interface.

To specify a source IP address or interface for the SFTP client:

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Specify a source IP address or interface for the SFTP client.	·         Specify a source IPv4 address or interface for the SFTP client: sftp client source { interface interface-type interface-number | ip ip-address } ·         Specify a source IPv6 address or interface for the SFTP client: sftp client ipv6 source { interface interface-type interface-number | ipv6 ipv6-address }	Use either command.

 

Establishing a connection to an SFTP server

You can launch the SFTP client to establish a connection to an SFTP server, and specify the public key algorithm, the preferred encryption algorithm, preferred HMAC algorithm, and preferred key exchange algorithm.

After the connection is established, you can directly enter SFTP client view on the server to perform directory and file operations.

To establish a connection to an SFTP server:

 

Task	Command	Remarks
Establish a connection to an SFTP server and enter SFTP client view.	·         Establish a connection to an IPv4 SFTP server: sftp server [ port-number ] [ identity-key rsa | prefer-compress { zlib | zlib-openssh } |prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] * ·         Establish a connection to an IPv6 SFTP server: sftp ipv6 server [ port-number ] [ identity-key rsa | prefer-compress { zlib | zlib-openssh } | prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] *	Use either command in user view.

 

Working with SFTP directories

SFTP directory operations include:

·          Changing or displaying the current working directory

·          Displaying files under a specified directory or the directory information

·          Changing the name of a specified directory on the server

·          Creating or deleting a directory

To work with the SFTP directories:

 

Step	Command	Remarks
1.       Enter SFTP client view.	For more information, see "Establishing a connection to an SFTP server."	N/A
2.       Change the working directory of the remote SFTP server.	cd [ remote-path ]	Optional.
3.       Return to the upper-level directory.	cdup	Optional.
4.       Display the current working directory on the SFTP server.	pwd	Optional.
5.       Display files under a specified directory.	·         dir [ -a | -l ] [ remote-path ] ·         ls [ -a | -l ] [ remote-path ]	Optional. The dir command functions as the ls command.
6.       Change the name of a specified directory on the SFTP server.	rename oldname newname	Optional.
7.       Create a new directory on the SFTP server.	mkdir remote-path	Optional.
8.       Delete one or more directories from the SFTP server.	rmdir remote-path&<1-10>	Optional.

 

Working with SFTP files

SFTP file operations include:

·          Changing the name of a file

·          Downloading a file

·          Uploading a file

·          Displaying a list of the files

·          Deleting a file

To work with SFTP files:

 

Step	Command	Remarks
1.       Enter SFTP client view.	For more information, see "Establishing a connection to an SFTP server."	N/A
2.       Change the name of a specified file on the SFTP server.	rename old-name new-name	Optional.
3.       Download a file from the remote server and save it locally.	get remote-file [ local-file ]	Optional.
4.       Upload a local file to the SFTP server.	put local-file [ remote-file ]	Optional.
5.       Display the files under a specified directory.	·         dir [ -a | -l ] [ remote-path ] ·         ls [ -a | -l ] [ remote-path ]	Optional. The dir command functions as the ls command.
6.       Delete one or more directories from the SFTP server.	·         delete remote-file&<1-10> ·         remove remote-file&<1-10>	Optional. The delete command functions as the remove command.

 

Displaying help information

Use the help command to display all commands or the help information of an SFTP client command, including the command format and parameters.

To display all commands or the help information of an SFTP client command:

 

Step	Command
1.       Enter SFTP client view.	For more information, see "Establishing a connection to an SFTP server."
2.       Display all commands or the help information of an SFTP client command.	help [ all | command-name ]

 

Terminating the connection with the SFTP server

 

Step	Command	Remarks
1.       Enter SFTP client view.	For more information, see "Establishing a connection to an SFTP server."	N/A
2.       Terminate the connection with the SFTP server and return to user view.	·         bye ·         exit ·         quit	Use any of the commands. These three commands function in the same way.

 

Configuring the device as an SCP client

This section describes how to configure the device as an SCP client.

SCP client configuration task list

 

Task	Remarks
Enabling and disabling first-time authentication	Optional.
Transferring files with an SCP server	Required.

Transferring files with an SCP server

 

Task	Command	Remarks
Connect to the SCP server, and transfer files with the server.	·         Upload a file to the SCP server: scp [ ipv6 ] server [ port-number ] put source-file-path [ destination-file-path ] [ identity-key rsa | prefer-compress { zlib | zlib-openssh } | prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] * ·         Download a file from the SCP server: scp [ ipv6 ] server [ port-number ] get source-file-path [ destination-file-path ] [ identity-key rsa | prefer-compress { zlib | zlib-openssh } | prefer-ctos-cipher { 3des | aes128 | des } | prefer-ctos-hmac { md5 | md5-96 | sha1 | sha1-96 } | prefer-kex { dh-group-exchange | dh-group1 | dh-group14 } | prefer-stoc-cipher { 3des | aes128 | des } | prefer-stoc-hmac { md5 | md5-96 | sha1 | sha1-96 } ] *	Use either command.

 

Displaying and maintaining SSH

 

Task	Command	Remarks
Display the source IP address or interface configured for the SFTP client.	display sftp client source [ | { begin | exclude | include } regular-expression ]	Available in any view.
Display the source IP address or interface information configured for the Stelnet client.	display ssh client source [ | { begin | exclude | include } regular-expression ]	Available in any view.
Display SSH server status information or session information on an SSH server.	display ssh server { status | session } [ | { begin | exclude | include } regular-expression ]	Available in any view.
Display the mappings between SSH servers and their host public keys on an SSH client.	display ssh server-info [ | { begin | exclude | include } regular-expression ]	Available in any view.
Display information about one or all SSH users on an SSH server.	display ssh user-information [ username ] [ | { begin | exclude | include } regular-expression ]	Available in any view.
Display the public keys of the local key pairs.	display public-key local rsa public [ | { begin | exclude | include } regular-expression ]	Available in any view.
Display the public keys of the SSH peers.	display public-key peer [ brief | name publickey-name ] [ | { begin | exclude | include } regular-expression ]	Available in any view.

 

Stelnet configuration examples

This section provides examples of configuring Stelnet.

Password authentication enabled Stelnet server configuration example

Network requirements

As shown in Figure 1:

·          The AP acts as the Stelnet server and uses password authentication.

·          The username and password of the client are saved on the AP.

Establish an Stelnet connection between the client and the AP, so you can log in to the AP to configure and manage the AP.

Figure 1 Network diagram

 

Configuration procedure

1.        Configure the Stelnet client:

a.    Run PuTTYGen.exe, select SSH-2 RSA and click Generate.

Figure 2 Generating a key pair on the client

 

b.    Keep moving the mouse during the key generating process, but do not place the mouse over the green progress bar shown in Figure 3. Otherwise, the progress bar stops moving and the key pair generating process stops.

Figure 3 Generating process

 

c.     After the key pair is generated, click Save public key to save the public key.

A file saving window appears.

Figure 4 Saving a key pair on the client

 

d.    Enter a file name (key.pub in this example), and click Save.

e.    On the page as shown in Figure 4, click Save private key to save the private key.

A confirmation dialog box appears.

f.      Click Yes.

A file saving window appears.

g.    Enter a file name (private.ppk in this example), and click Save.

h.    Transmit the public key file to the server through FTP or TFTP. (Details not shown.)

2.        Configure the Stelnet server:

# Enable the SSH server function.

<AP> system-view

[AP] ssh server enable

# Configure an IP address for VLAN-interface 2. This address is the destination address of the SSH connection.

[AP] vlan2

[AP-vlan2] quit

[AP] interface vlan-interface 2

[AP-Vlan-interface2] ip address 192.168.1.40 255.255.255.0

[AP-Vlan-interface2] quit

# Set the authentication mode for the user interfaces to AAA.

[AP] user-interface vty 0 4

[AP-ui-vty0-4] authentication-mode scheme

# Set the protocol that a remote user uses for login as SSH.

[AP-ui-vty0-4] protocol inbound ssh

[AP-ui-vty0-4] quit

# Create a local user client001, set the password to aabbcc and specify the service type ssh for the user, and set the user command privilege level to 3.

[AP] local-user client001

[AP-luser-client001] password simple aabbcc

[AP-luser-client001] service-type ssh

[AP-luser-client001] authorization-attribute level 3

[AP-luser-client001] quit

# (Optional.) Create an SSH user client001. Specify the service type as stelnet and the authentication method as password for the user.

[AP] ssh user client001 service-type stelnet authentication-type password

3.        Configuration the wireless service:

# Create a WLAN-BSS interface.

<AP> system-view

[AP] interface wlan-bss 1

# Set the link type to hybrid for WLAN-BSS 1, set the PVID of WLAN-BSS 1 to VLAN 2, and assign WLAN-BSS 1 to VLAN 2 as an untagged member.

[AP-WLAN-BSS1] port link-type hybrid

[AP-WLAN-BSS1] port hybrid pvid vlan 2

[AP-WLAN-BSS1] port hybrid vlan 2 untagged

[AP-WLAN-BSS1] quit

# Configure a clear type WLAN service template that adopts open-system authentication, and enable the template.

[AP] wlan service-template 1 clear

[AP-wlan-st-1] ssid service

[AP-wlan-st-1] authentication-method open-system

[AP-wlan-st-1] service-template enable

[AP-wlan-st-1] quit

# On WLAN-Radio 1/0/1, bind service template 1 to WLAN-BSS 1.

[AP] interface wlan-radio 1/0/1

[AP-WLAN-Radio1/0/1] radio-type dot11ac

[AP-WLAN-Radio1/0/1] service-template 1 interface wlan-bss 1

[AP-WLAN-Radio1/0/1] quit

4.        Establish a connection with the Stelnet server:

There are different types of Stelnet client software, such as PuTTY and OpenSSH. This example uses an Stelnet client that runs PuTTY version 0.58.

To establish a connection with the Stelnet server:

a.    Launch PuTTY.exe to enter the following interface, as shown in Figure 5.

Figure 5 Specifying the host name (or IP address)

 

b.    In the Host Name (or IP address) field, enter the IP address of the server (192.168.1.40).

c.     Click Open.

d.    In the dialog box that appears, enter the correct username (client001) and password (aabbcc) to log in to the AP.

Publickey authentication enabled Stelnet server configuration example

Network requirements

As shown in Figure 6, the AP acts as the Stelnet server, and it uses publickey authentication and the RSA public key algorithm.

Establish an Stelnet connection between the client and the AP, so you can log in to the AP to configure and manage the AP.

Figure 6 Network diagram

 

Configuration considerations

In the server configuration, the client public key is required. Use the client software to generate RSA key pairs on the client before configuring the Stelnet server.

There are different types of Stelnet client software, such as PuTTY and OpenSSH. This example uses an Stelnet client that runs PuTTY version 0.58.

Configuration procedure

1.        Configure the Stelnet client:

a.    Launch PuTTYGen.exe, select SSH-2 RSA and click Generate.

Figure 7 Generating a key pair on the client

 

b.    Keep moving the mouse during the key generating process, but do not place the mouse over the green progress bar shown in Figure 8. Otherwise, the progress bar stops moving and the key pair generating process stops.

Figure 8 Generating process

 

c.     After the key pair is generated, click Save public key to save the public key.

A file saving window appears.

Figure 9 Saving a key pair on the client

 

d.    Enter a file name (key.pub in this example), and click Save.

e.    On the page as shown in Figure 9, click Save private key to save the private key.

A confirmation dialog box appears.

f.      Click Yes.

A file saving window appears.

g.    Enter a file name (private.ppk in this example), and click Save.

h.    Transmit the public key file to the server through FTP or TFTP. (Details not shown.)

2.        Configure the Stelnet server:

# Generate RSA key pairs.

<AP> system-view

[AP] public-key local create rsa

The range of public key size is (512 ~ 2048).

NOTES: If the key modulus is greater than 512,

It will take a few minutes.

Press CTRL+C to abort.

Input the bits of the modulus[default = 1024]:1024

Generating Keys...

+++++++

++++++

++

+++

# Enable the SSH server function.

[AP] ssh server enable

# Configure an IP address for VLAN-interface 2. This address is the destination address of the SSH connection.

[AP] vlan2

[AP-vlan2] quit

[AP] interface vlan-interface 2

[AP-Vlan-interface2] ip address 192.168.1.40 255.255.255.0

[AP-Vlan-interface2] quit

# Set the authentication mode for the user interfaces to AAA.

[AP] user-interface vty 0 4

[AP-ui-vty0-4] authentication-mode scheme

# Set the protocol that a remote user uses for login as SSH.

[AP-ui-vty0-4] protocol inbound ssh

# Set the user command privilege level to 3.

[AP-ui-vty0-4] user privilege level 3

[AP-ui-vty0-4] quit

# Import the client's public key from file key.pub and name it AP001.

[AP] public-key peer AP001 import sshkey key.pub

# Create an SSH user client002. Specify service type as stelnet and the authentication type as publickey for the user, and assign the public key AP001 to the user.

[AP] ssh user client002 service-type stelnet authentication-type publickey assign publickey AP001

3.        Establish a connection with the Stelnet server:

a.    Launch PuTTY.exe to enter the following interface, as shown in Figure 10.

b.    In the Host Name (or IP address) field, enter the IP address of the server (192.168.1.40).

Figure 10 Specifying the host name (or IP address)

 

c.     Select Connection > SSH > Auth from the navigation tree.

The window as shown in Figure 11 appears.

d.    Click Browse… to bring up the file selection window, navigate to the private key file and click OK.

Figure 11 Specifying the private key file

 

e.    In the window shown in Figure 11, click Open.

f.      In the dialog box that appears, enter the correct username (client002) to log in to the AP.

Password authentication enabled Stelnet client configuration example

Network requirements

As shown in Figure 12:

·          The switch acts as the Stelnet server and uses password authentication.

·          The username and password of the client are saved on the switch.

Establish an Stelnet connection between the AP and the switch, so you can log in to the switch to configure and manage the switch.

Figure 12 Network diagram

 

Configuration procedure

1.        Configure the switch (the Stelnet server):

# Create RSA key pairs.

<Switch> system-view

[Switch] public-key local create rsa

# Enable the SSH server function.

[Switch] ssh server enable

# Assign an IP address to VLAN-interface 2, which the SSH client uses as the destination IP address for SSH connection.

[Switch] interface vlan-interface 2

[Switch-Vlan-interface2] ip address 192.168.1.40 255.255.255.0

[Switch-Vlan-interface2] quit

# Set the authentication mode for the user interfaces to AAA.

[Switch] user-interface vty 0 4

[Switch-ui-vty0-4] authentication-mode scheme

# Set the protocol that a remote user uses for login as SSH.

[Switch-ui-vty0-4] protocol inbound ssh

[Switch-ui-vty0-4] quit

# Create a local user client001, set the password to aabbcc and specify the service type ssh for the user, and set the user command privilege level to 3.

[Switch] local-user client001

[Switch-luser-client001] password simple aabbcc

[Switch-luser-client001] service-type ssh

[Switch-luser-client001] authorization-attribute level 3

[Switch-luser-client001] quit

# (Optional.) Create an SSH user client001. Specify the service type as stelnet and the authentication type as password for user.

[Switch] ssh user client001 service-type stelnet authentication-type password

2.        Configure the AP (the Stelnet client):

# Configure an IP address for VLAN-interface 2.

<AP> system-view

[AP] interface vlan-interface 2

[AP-Vlan-interface2] ip address 192.168.1.56 255.255.255.0

[AP-Vlan-interface2] quit

[AP] quit

¡  If the client support first-time authentication, you can directly establish a connection from the client to the server.

# Establish an SSH connection to server 192.168.1.40.

<AP> ssh2 192.168.1.40

Username: client001

Trying 192.168.1.40 ...

Press CTRL+K to abort

Connected to 192.168.1.40 ...

 

The Server is not authenticated. Continue? [Y/N]:y

Do you want to save the server public key? [Y/N]:n

Enter password:

After you enter the correct username, you can log into the switch successfully.

¡  If the client does not support first-time authentication, you must perform the following configurations.

# Disable first-time authentication.

[AP] undo ssh client first-time

# Configure the host public key of the SSH server. You can get the server host public key by using the display public-key local rsa public command on the server.

[AP] public-key peer key1

[AP-pkey-public-key] public-key-code begin

[AP-pkey-key-code]308201B73082012C06072A8648CE3804013082011F0281810

0D757262C4584C44C211F18BD96E5F0

[AP-pkey-key-code]61C4F0A423F7FE6B6B85B34CEF72CE14A0D3A5222FE08CECE

65BE6C265854889DC1EDBD13EC8B274

[AP-pkey-key-code]DA9F75BA26CCB987723602787E922BA84421F22C3C89CB9B0

6FD60FE01941DDD77FE6B12893DA76E

[AP-pkey-key-code]EBC1D128D97F0678D7722B5341C8506F358214B16A2FAC4B3

68950387811C7DA33021500C773218C

[AP-pkey-key-code]737EC8EE993B4F2DED30F48EDACE915F0281810082269009E

14EC474BAF2932E69D3B1F18517AD95

[AP-pkey-key-code]94184CCDFCEAE96EC4D5EF93133E84B47093C52B20CD35D02

492B3959EC6499625BC4FA5082E22C5

[AP-pkey-key-code]B374E16DD00132CE71B020217091AC717B612391C76C1FB2E

88317C1BD8171D41ECB83E210C03CC9

[AP-pkey-key-code]B32E810561C21621C73D6DAAC028F4B1585DA7F42519718CC

9B09EEF0381840002818000AF995917

[AP-pkey-key-code]E1E570A3F6B1C2411948B3B4FFA256699B3BF871221CC9C5D

F257523777D033BEE77FC378145F2AD

[AP-pkey-key-code]D716D7DB9FCABB4ADBF6FB4FDB0CA25C761B308EF53009F71

01F7C62621216D5A572C379A32AC290

[AP-pkey-key-code]E55B394A217DA38B65B77F0185C8DB8095522D1EF044B465E

8716261214A5A3B493E866991113B2D

[AP-pkey-key-code]485348

[AP-pkey-key-code] public-key-code end

[AP-pkey-public-key] peer-public-key end

# Specify the host public key for the SSH server (192.168.1.40) as key1.

[AP] ssh client authentication server 192.168.1.40 assign publickey key1

[AP] quit

# Establish an SSH connection to the server 192.168.1.40.

<AP> ssh2 192.168.1.40

Username: client001

Trying 192.168.1.40

Press CTRL+K to abort

Connected to 192.168.1.40..

Enter password:

After you enter the correct username and password, you can log in to the switch successfully.

Publickey authentication enabled Stelnet client configuration example

Network requirements

As shown in Figure 13, the switch acts as the Stelnet server, and it uses publickey authentication and the RSA public key algorithm.

Establish an Stelnet connection between the AP and the switch, so you can log in to the switch to configure and manage the switch.

Figure 13 Network diagram

 

Configuration considerations

In the server configuration, the client public key is required. Generate RSA key pairs on the client before configuring the Stelnet server.

Configuration procedure

1.        Configure the AP (the Stelnet client):

# Configure an IP address for VLAN-interface 2.

<AP> system-view

[AP] interface vlan-interface 2

[AP-Vlan-interface2] ip address 192.168.1.56 255.255.255.0

[AP-Vlan-interface2] quit

# Generate RSA key pairs.

[AP] public-key local create rsa

# Export the RSA public key to the file key.pub.

[AP] public-key local export rsa ssh2 key.pub

[AP] quit

# Transmit the public key file key.pub to the server through FTP or TFTP. (Details not shown.)

2.        Configure the switch (the Stelnet server):

# Generate RSA key pairs.

<Switch> system-view

[Switch] public-key local create rsa

# Enable the SSH server function.

[Switch] ssh server enable

# Configure an IP address for VLAN-interface 2, which the SSH client uses as the destination for SSH connection.

[Switch] interface vlan-interface 2

[Switch-Vlan-interface2] ip address 192.168.1.40 255.255.255.0

[Switch-Vlan-interface2] quit

# Set the authentication mode for the user interfaces to AAA.

[Switch] user-interface vty 0 4

[Switch-ui-vty0-4] authentication-mode scheme

# Set the protocol that a remote user uses for login as SSH.

[Switch-ui-vty0-4] protocol inbound ssh

# Set the user command privilege level to 3.

[Switch-ui-vty0-4] user privilege level 3

[Switch-ui-vty0-4] quit

# Import the peer public key from the file key.pub and name it AP001.

[Switch] public-key peer AP001 import sshkey key.pub

# Create an SSH user client002. Specify the authentication type as publickey for the user, and assign the public key AP001 to the user.

[Switch] ssh user client002 service-type stelnet authentication-type publickey assign publickey AP001

3.        Establish an SSH connection to the server (192.168.1.40).

<AP> ssh2 192.168.1.40

Username: client002

Trying 192.168.1.40 ...

Press CTRL+K to abort

Connected to 192.168.1.40 ...

 

The Server is not authenticated. Continue? [Y/N]:y

Do you want to save the server public key? [Y/N]:n

SFTP configuration examples

Password authentication enabled SFTP server configuration example

Network requirements

As shown in Figure 14:

·          The AP acts as the SFTP server and uses password authentication.

·          The username and password of the client are saved on the AP.

Establish an SFTP connection between the client and the AP, so you can log in to the AP to manage and transfer files.

Figure 14 Network diagram

 

Configuration procedure

1.        Configure the AP (the SFTP server):

# Generate RSA key pairs.

<Switch> system-view

[Switch] public-key local create rsa

# Enable the SSH server function.

[Switch] ssh server enable

# Enable the SFTP server function.

[Switch] sftp server enable

# Configure an IP address for VLAN-interface 2, which the SSH client uses as the destination IP address of the SSH connection.

[Switch] interface vlan-interface 2

[Switch-Vlan-interface2] ip address 192.168.0.1 255.255.255.0

[Switch-Vlan-interface2] quit

# Set the authentication mode on the user interfaces to AAA.

[Switch] user-interface vty 0 4

[Switch-ui-vty0-4] authentication-mode scheme

# Set the protocol that a remote user uses for login as SSH.

[Switch-ui-vty0-4] protocol inbound ssh

[Switch-ui-vty0-4] quit

# Create a local user client002, and set the password to aabbcc and specify the service type ssh for the user.

[AP] local-user client002

[AP-luser-client002] password simple aabbcc

[AP-luser-client002] service-type ssh

[AP-luser-client002] quit

# Create an SSH user client002. Specify the service type as sftp and the authentication method as password for the user.

[AP] ssh user client002 service-type sftp authentication-type password

2.        Configure the client (the SFTP client):

There are many kinds of SFTP client software. The following takes the PSFTP of Putty Version 0.58 as an example. The PSFTP supports only password authentication.

To establish a connection with the remote SFTP server:

a.    Run the psftp.exe to launch the client interface as shown in Figure 15, and enter the following command:

open 192.168.1.45

b.    Enter username client002 and password aabbcc as prompted to log in to the SFTP server.

Figure 15 SFTP client interface

 

Publickey authentication enabled SFTP client configuration example

Network requirements

As shown in Figure 16, the switch acts as the SFTP server, and it uses publickey authentication and the RSA public key algorithm.

Establish an SFTP connection between the AP and the switch, so you can log in to the switch to manage and transfer files.

Figure 16 Network diagram

 

Configuration considerations

In the server configuration, the client public key is required. Generate RSA key pairs on the client before configuring the SFTP server.

Configuration procedure

1.        Configure the AP (the SFTP client):

# Configure an IP address for VLAN-interface 2

<AP> system-view

[AP] interface vlan-interface 2

[AP-Vlan-interface2] ip address 192.168.0.2 255.255.255.0

[AP-Vlan-interface2] quit

# Generate RSA key pairs.

[AP] public-key local create rsa

# Export the host public key to file pubkey.

[AP] public-key local export rsa ssh2 pubkey

[AP] quit

# Transmit the public key file pubkey to the server through FTP or TFTP. (Details not shown.)

2.        Configure the switch (the SFTP server):

# Generate RSA key pairs.

<Switch> system-view

[Switch] public-key local create rsa

# Enable the SSH server function.

[Switch] ssh server enable

# Enable the SFTP server function.

[Switch] sftp server enable

# Configure an IP address for VLAN-interface 2, which the client uses as the destination for SSH connection.

[Switch] interface vlan-interface 2

[Switch-Vlan-interface2] ip address 192.168.1.45 255.255.255.0

[Switch-Vlan-interface2] quit

# Set the authentication mode of the user interfaces to AAA.

[Switch] user-interface vty 0 4

[Switch-ui-vty0-4] authentication-mode scheme

# Set the protocol that a remote user uses for login as SSH.

[Switch-ui-vty0-4] protocol inbound ssh

[Switch-ui-vty0-4] quit

# Import the peer public key from the file pubkey and name it AP001.

[Switch] public-key peer AP001 import sshkey pubkey

# Create a local user client001, set the password to aabbcc and specify the service type ssh for the user, and set the user command privilege level to 3.

[Switch] local-user client001

[Switch-luser-client001] password simple aabbcc

[Switch-luser-client001] service-type ssh

[Switch-luser-client001] authorization-attribute level 3

[Switch-luser-client001] quit

# Create an SSH user client001. Specify the service type sftp and the authentication method publickey for the user. Assign the public key AP001 and working folder flash:/ to the user.

[Switch] ssh user client001 service-type sftp authentication-type publickey assign publickey AP001 work-directory flash:/

3.        Establish a connection to the SFTP server:

# Establish a connection to the remote SFTP server and enter SFTP client view.

<AP> sftp 192.168.0.1 identity-key rsa

Input Username: client001

Trying 192.168.0.1 ...

Press CTRL+K to abort

Connected to 192.168.0.1 ...

 

The Server is not authenticated. Continue? [Y/N]:y

Do you want to save the server public key? [Y/N]:n

 

sftp-client>

# Display files under the current directory of the server, delete the file named z, and check if the file has been deleted successfully.

sftp-client> dir

-rwxrwxrwx   1 noone    nogroup      1759 Aug 23 06:52 config.cfg

-rwxrwxrwx   1 noone    nogroup       225 Aug 24 08:01 pubkey2

-rwxrwxrwx   1 noone    nogroup       283 Aug 24 07:39 pubkey

drwxrwxrwx   1 noone    nogroup         0 Sep 01 06:22 new

-rwxrwxrwx   1 noone    nogroup       225 Sep 01 06:55 pub

-rwxrwxrwx   1 noone    nogroup         0 Sep 01 08:00 z

sftp-client> delete z

The following File will be deleted:

/z

Are you sure to delete it? [Y/N]:y

This operation may take a long time.Please wait...

 

File successfully Removed

sftp-client> dir

-rwxrwxrwx   1 noone    nogroup      1759 Aug 23 06:52 config.cfg

-rwxrwxrwx   1 noone    nogroup       225 Aug 24 08:01 pubkey2

-rwxrwxrwx   1 noone    nogroup       283 Aug 24 07:39 pubkey

drwxrwxrwx   1 noone    nogroup         0 Sep 01 06:22 new

-rwxrwxrwx   1 noone    nogroup       225 Sep 01 06:55 pub

# Add a directory named new1 and check if it has been created successfully.

sftp-client> mkdir new1

New directory created

sftp-client> dir

-rwxrwxrwx   1 noone    nogroup      1759 Aug 23 06:52 config.cfg

-rwxrwxrwx   1 noone    nogroup       225 Aug 24 08:01 pubkey2

-rwxrwxrwx   1 noone    nogroup       283 Aug 24 07:39 pubkey

drwxrwxrwx   1 noone    nogroup         0 Sep 01 06:22 new

-rwxrwxrwx   1 noone    nogroup       225 Sep 01 06:55 pub

drwxrwxrwx   1 noone    nogroup         0 Sep 02 06:30 new1

# Rename directory new1 to new2 and check if the directory has been renamed successfully.

sftp-client> rename new1 new2

File successfully renamed

sftp-client> dir

-rwxrwxrwx   1 noone    nogroup      1759 Aug 23 06:52 config.cfg

-rwxrwxrwx   1 noone    nogroup       225 Aug 24 08:01 pubkey2

-rwxrwxrwx   1 noone    nogroup       283 Aug 24 07:39 pubkey

drwxrwxrwx   1 noone    nogroup         0 Sep 01 06:22 new

-rwxrwxrwx   1 noone    nogroup       225 Sep 01 06:55 pub

drwxrwxrwx   1 noone    nogroup         0 Sep 02 06:33 new2

# Download the file pubkey2 from the server and change the name to public.

sftp-client> get pubkey2 public

Remote  file:/pubkey2 --->  Local file: public

Downloading file successfully ended

# Upload the local file pu to the server, save it as puk, and check if the file has been uploaded successfully.

sftp-client> put pu puk

Local file:pu --->  Remote file: /puk

Uploading file successfully ended

sftp-client> dir

-rwxrwxrwx   1 noone    nogroup      1759 Aug 23 06:52 config.cfg

-rwxrwxrwx   1 noone    nogroup       225 Aug 24 08:01 pubkey2

-rwxrwxrwx   1 noone    nogroup       283 Aug 24 07:39 pubkey

drwxrwxrwx   1 noone    nogroup         0 Sep 01 06:22 new

drwxrwxrwx   1 noone    nogroup         0 Sep 02 06:33 new2

-rwxrwxrwx   1 noone    nogroup       283 Sep 02 06:35 pub

-rwxrwxrwx   1 noone    nogroup       283 Sep 02 06:36 puk

sftp-client>

# Terminate the connection to the remote SFTP server.

sftp-client> quit

Bye

Connection closed.

<AP>

SCP configuration example

Network requirements

As shown in Figure 17:

·          The switch uses the password authentication method.

·          The client's username and password are saved on the switch.

Establish an SCP connection between the AP and the switch, so you can log in to the switch to transfer files.

Figure 17 Network diagram

 

Configuration procedure

1.        Configure the SCP server:

# Generate RSA key pairs.

<Switch> system-view

[Switch] public-key local create rsa

The range of public key size is (512 ~ 2048).

NOTES: If the key modulus is greater than 512,

It will take a few minutes.

Press CTRL+C to abort.

Input the bits of the modulus[default = 1024]:

Generating Keys...

++++++++

++++++++++++++

+++++

++++++++

# Enable the SSH server function.

[Switch] ssh server enable

# Configure an IP address for VLAN-interface 2, which the client will use as the destination for SCP connection.

[Switch] interface vlan-interface 2

[Switch-Vlan-interface2] ip address 192.168.0.1 255.255.255.0

[Switch-Vlan-interface2] quit

# Set the authentication mode of the user interface to AAA.

[Switch] user-interface vty 0 4

[Switch-ui-vty0-4] authentication-mode scheme

# Enable the user interface to support SSH.

[Switch-ui-vty0-4] protocol inbound ssh

[Switch-ui-vty0-4] quit

# Create a local user named client001, and set the password to aabbcc and specify the service type ssh for the user.

[Switch] local-user client001

[Switch-luser-client001] password simple aabbcc

[Switch-luser-client001] service-type ssh

[Switch-luser-client001] quit

# (Optional.) Create an SSH user client001. Specify the service type as scp and the authentication method password for the user.

[Switch] ssh user client001 service-type scp authentication-type password

2.        Configure an IP address for VLAN-interface 2 on the SCP client:

<AP> system-view

[AP] interface vlan-interface 2

[AP-Vlan-interface2] ip address 192.168.0.2 255.255.255.0

[AP-Vlan-interface2] quit

[AP] quit

3.        Connect to the SCP server, download the file remote.bin from the server, and save it locally with the name local.bin.

<AP> scp 192.168.0.1 get remote.bin local.bin

Username: client001

Trying 192.168.0.1 ...

Press CTRL+K to abort

Connected to 192.168.0.1 ...

 

The Server is not authenticated. Continue? [Y/N]:y

Do you want to save the server public key? [Y/N]:n

Enter password:

18471 bytes transfered in 0.001 seconds.