HP A5830 Series User Manual

174
A user without an SSH account can still pass password authentication and log in to the server through
Stelnet or SFTP, as long as the user can pass AAA authentication and the service type is SSH.
For successful login through SFTP, you must set the user service type to sftp or all.
SSH1 does not support the service type sftp. If the client uses SSH1 to log in to the server, you must set
the service type to stelnet or all on the server.
An SFTP user’s working folder depends on the authentication method. For a user who is using only
password authentication, the working folder is the AAA authorized one. For a user who is using only
publickey authentication or using both the publickey and password authentication methods, the working
folder is the one set by using the ssh user command.
You can change the authentication method and public key of an SSH user when the user is
communicating with the SSH server, but your changes take effect only after the user logs out and logs in
again.
With publickey authentication, the commands that a user can use after login are determined by the user
privilege level, which is configured with the user privilege level command on the user interface.
With password authentication, the commands that a user can use after login are determined by AAA
authorization.
Setting the SSH management parameters
SSH management includes the following:
• Enabling the SSH server to be compatible with SSH1 client
• Setting the RSA server key pair update interval (applies to users who are using SSH1 client)
• Setting the SSH user authentication timeout period
• Setting the maximum number of SSH authentication attempts
Setting these parameters can help avoid malicious guessing at and cracking of the keys and usernames,
securing your SSH connections.
To set the SSH management parameters:
To do… Use the command… Remarks
1. Enter system view.
system-view —
2. Enable the SSH server to
support SSH1 clients.
ssh server compatible-ssh1x
enable
Optional.
By default, the SSH server
supports SSH1 clients.
3. Set the RSA server key pair
update interval.
ssh server rekey-interval hours
Optional.
By default, the interval is 0, and
the RSA server key pair is not
updated.
4. Set the SSH user
authentication timeout period.
ssh server authentication-timeout
time-out-value
Optional.
60 seconds by default.
5. Set the maximum number of
SSH authentication attempts.
ssh server authentication-retries
times
Optional.
3 by default.
Authentication fails if the number of authentication attempts (including both publickey and password
authentication) exceeds that specified in the ssh server authentication-retries command.

HP A5830 Series Specifications

General

Brand	HP
Model	A5830 Series
Category	Switch
Language	English