EX2500 Ethernet Switch Configuration Guide
When the SSH server is first enabled and applied, the switch automatically generates the RSA host and server keys, which are stored in the Flash memory. To configure RSA host and server keys, enter the following commands to generate them manually:
ex2500(config)# ssh
When the switch reboots, it will retrieve the host and server keys from the Flash memory. If these two keys are not available in the flash and if the SSH server feature is enabled, the switch automatically generates them during the system reboot. This process might take several minutes to complete.
The switch can automatically regenerate the RSA server key. To set the interval of
RSA server key autogeneration, use the following command:
ex2500(config)# ssh interval <number of hours (0-24)>
A value of 0 (zero) denotes that RSA server key autogeneration is disabled. When the interval value is greater than 0, the switch will autogenerate the RSA server key every specified interval. However, RSA server key generation is skipped if the switch is busy doing other key or cipher generation when the timer expires.
NOTE: The switch can perform only one session of key or cipher generation at a time. Thus, an SSH client will not be able to log in if the switch is performing key generation at that time, or if another client has logged in immediately prior. Also, key generation will fail if an SSH client is logging in at that time.
SSH Integration with RADIUS and TACACS+ Authentication
SSH is integrated with RADIUS authentication. After the RADIUS server is enabled on the switch, all subsequent SSH authentication requests will be redirected to the specified RADIUS servers for authentication. The redirection is transparent to the SSH clients.
SSH is integrated with TACACS+ authentication. After the TACACS+ server is enabled on the switch, all subsequent SSH authentication requests will be redirected to the specified TACACS+ servers for authentication. The redirection is transparent to the SSH clients.
End User Access Control
The EX2500 switch allows an administrator to define end user accounts that permit end users to perform operation tasks via the switch CLI commands. Once end user accounts are configured and enabled, the switch requires
For example, an administrator can assign a user, who can then log in to the switch and perform operational commands (effective only until the next switch reboot).
18 Securing Access to the Switch
