HP 2626 (J4900A/B), 4100gl, 2650 (J4899A/B), 2600-PWR, 6108 manual U t i o n

Configuring Secure Shell (SSH)

Further Information on SSH Client Public-Key Authentication

Enabling Client Public-Key Authentication. After you TFTP a client- public-key file into the switch (described above), you can configure the switch to allow one of the following:

■ If an SSH client’s public key matches the switch’s client-public-key file, allow that client access to the switch. If there is not a public-key match, then deny access to that client.

■ If an SSH client’s public key does not have a match in the switch’s client-public-key file, allow the client access if the user can enter the switch’s login (Operator) password. (If the switch does not have an Operator password, then deny access to that client.

Syntax: aaa authentication ssh login public-key none

Allows SSH client access only if the switch detects a match between the client’s public key and an entry in the client- public-key file most recently copied into the switch.

aaa authentication ssh login public-key local

	Allows SSH client access if there is a public key match (see
	above) or if the client’s user enters the switch’s login (Oper-
	ator) password.
	With login public-key local configured, if the switch does not have an Operator-
	level password, it blocks client public-key access to SSH clients whose private
	keys do not match a public key in the switch’s client-public-key file.
C a u t i o n	To enable client public-key authentication to block SSH clients whose public
	keys are not in the client-public-key file copied into the switch, you must
	configure the Login Secondary as none. Otherwise, the switch allows such
	clients to attempt access using the switch’s Operator password.

6-26