Configuring Secure Shell (SSH)

Configuring the Switch for SSH Operation

■Non-encoded ASCII numeric string: Requires a client ability to display the keys in the “known hosts” file in the ASCII format. This method is tedious and error-prone due to the length of the keys. (See figure 6-7 on page 6-14.)

■Phonetic hash: Outputs the key as a relatively short series of alpha- betic character groups. Requires a client ability to convert the key to this format.

■Hexadecimal hash: Outputs the key as a relatively short series of hexadecimal numbers. Requires a parallel client ability.

For example, on the switch, you would generate the phonetic and hexadecimal versions of the switch’s public key in figure 6-7 as follows:

Phonetic "Hash" of Switch’s Public Key

Hexadecimal "Fingerprints" of the Same Switch

Figure 6-9. Examples of Visual Phonetic and Hexadecimal Conversions of the Switch’s Public Key

The two commands shown in figure 6-9 convert the displayed format of the switch’s (host) public key for easier visual comparison of the switch’s public key to a copy of the key in a client’s “known host” file. The switch has only one RSA host key. The 'babble' and 'fingerprint' options produce two hashes for the key--one that corresponds to the challenge hash you will see if connecting with a v1 client, and the other corresponding to the hash you will see if connecting with a v2 client. These hashes do not correspond to different keys, but differ only because of the way v1 and v2 clients compute the hash of the same RSA key. The switch always uses ASCII version (without babble or fingerprint conversion) of its public key for file storage and default display format.

4.Enabling SSH on the Switch and Anticipating SSH Client Contact Behavior

The ip ssh command enables or disables SSH on the switch and modifies parameters the switch uses for transactions with clients. After you enable SSH, the switch can authenticate itself to SSH clients.

6-15