Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Premier Sign In Partner Program Sign In
Contact Us

Dell EMC SmartFabric OS10 User Guide Release 10.5.1

PDF

SSH server

In OS10, the secure shell server allows an SSH client to access an OS10 switch through a secure, encrypted connection. The SSH server authenticates remote clients using RADIUS challenge/response, a trusted host file, locally-stored passwords, and public keys.

Configure SSH server

  • The SSH server is enabled by default. You can disable the SSH server using the no ip ssh server enable command.
  • Challenge response authentication is disabled by default. To enable, use the ip ssh server challenge-response-authentication command.
  • Host-based authentication is disabled by default. To enable, use the ip ssh server hostbased-authentication command.
  • Password authentication is enabled by default. To disable, use the no ip ssh server password-authentication command.
  • Public key authentication is enabled by default. To disable, use the no ip ssh server pubkey-authentication command.
  • Password-less login is disabled by default. To enable, use the username sshkey or username sshkey filename commands.
  • Configure the list of cipher algorithms using the ip ssh server cipher cipher-list command.
  • Configure key exchange algorithms using the ip ssh server kex key-exchange-algorithm command.
  • Configure hash message authentication code (HMAC) algorithms using the ip ssh server mac hmac-algorithm command.
  • Configure the SSH server listening port using the ip ssh server port port-number command.
  • Configure the SSH server to be reachable on the management VRF using the ip ssh server vrf command.
  • Configure the SSH login timeout using the ip ssh server login-grace-time seconds command, from 0 to 300; default 60. To reset the default SSH prompt timer, use the no ip ssh server login-grace-time command.
  • Configure the maximum number of authentication attempts using the ip ssh server max-auth-tries number command, from 0 to 10; default 6. To reset the default, use the no ip ssh server max-auth-tries command.

    The max-auth-tries value includes all authentication attempts, including public-key and password. If you enable both, public-key based authentication and password authentication, the public-key authentication is the default and is tried first. If it fails, the number of max-auth-tries is reduced by one. In this case, if you configured ip ssh server max-auth-tries 1, the password prompt does not display.

Regenerate public keys

When enabled, the SSH server generates public keys by default and uses them for client authentication:
  • A Rivest, Shamir, and Adelman (RSA) key using 2048 bits.
  • An Elliptic Curve Digital Signature Algorithm (ECDSA) key using 256 bits
  • An Ed25519 key using 256 bits
NOTE: RSA1 and DSA keys are not supported on the OS10 SSH server.
An SSH client must exchange the same public key to establish a secure SSH connection to the OS10 switch. If necessary, you can regenerate the keys used by the SSH server with a customized bit size. You cannot change the default size of the Ed25519 key. The crypto key generate command is available only to the sysadmin and secadmin roles.
  1. Regenerate keys for the SSH server in EXEC mode. 
    crypto ssh-key generate {rsa {2048|3072|4096} | ecdsa {256|384|521} | ed25519}
  2. Enter yes at the prompt to overwrite an existing key. 
    Host key already exists. Overwrite [confirm yes/no]:yes
Generated 2048-bit RSA key
  3. Display the SSH public keys in EXEC mode. 
    show crypto ssh-key
After you regenerate SSH public keys, disable and re-enable the SSH server to use the new public keys. Restarting the SSH server does not impact current OS10 sessions.

Rate this content

Accurate
Useful
Easy to understand
Was this article helpful?
0/3000 characters
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please select whether the article was helpful or not.
  Comments cannot contain these special characters: <>()\