No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

Configuration Guide - Basic Configuration

S9300, S9300E, and S9300X V200R011C10

This document describes methods to use command line interface and to log in to the device, file operations, and system startup configurations.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Example for Configuring the Device as the STelnet Client to Log In to Another Device

Example for Configuring the Device as the STelnet Client to Log In to Another Device

Networking Requirements

The enterprise requires that secure data exchange should be performed between the server and client. As shown in Figure 5-16, two login users client001 and client002 are configured and they use the password and DSA authentication modes respectively to log in to the SSH server.

Figure 5-16  Networking diagram of logging in to another device through STelnet

The STelnet V1 protocol poses a security risk, and therefore the STelnet V2 mode is recommended.

Configuration Roadmap

The configuration roadmap is as follows:

  1. Generate a local key pair on the SSH server to implement secure data exchange between the server and client.

  2. Configure different authentication modes for the SSH users client001 and client002 on the SSH server.

  3. Enable the STelnet service on the SSH server.

  4. Configure the STelnet server type for the SSH users client001 and client002 on the SSH server.

  5. Log in to the SSH server as the client001 and client002 users through STelnet.

Procedure

  1. Generate a local key pair on the server.

    <Quidway> system-view
    [Quidway] sysname SSH Server
    [SSH Server] dsa local-key-pair create
    Info: The key name will be: SSH Server_Host_DSA.
    Info: The DSA host key named SSH Server_Host_DSA already exists.
    Info: The key modulus can be any one of the following : 1024, 2048.
    Info: If the key modulus is greater than 512, it may take a few minutes.
    Please input the modulus [default=2048]:
    Info: Generating keys........
    Info: Succeeded in creating the DSA host keys.
    

  2. Create an SSH user on the server.

    # Configure the VTY user interface.

    [SSH Server] user-interface vty 0 4
    [SSH Server-ui-vty0-4] authentication-mode aaa
    [SSH Server-ui-vty0-4] protocol inbound ssh
    [SSH Server-ui-vty0-4] quit
    • Create an SSH user named client001.

      # Create an SSH user named client001 and configure the password authentication mode for the user.

      [SSH Server] aaa
      [SSH Server-aaa] local-user client001 password irreversible-cipher Huawei@123
      [SSH Server-aaa] local-user client001 privilege level 3
      [SSH Server-aaa] local-user client001 service-type ssh
      [SSH Server-aaa] quit
      [SSH Server] ssh user client001
      [SSH Server] ssh user client001 authentication-type password
    • Create an SSH user named client002.

      # Create an SSH user named client002 and configure the DSA authentication mode for the user.

      [SSH Server] ssh user client002
      [SSH Server] ssh user client002 authentication-type dsa

      # Generate a local key pair for Client002.

      <Quidway> system-view
      [Quidway] sysname client002
      [client002] dsa local-key-pair create
      Info: The key name will be: SSH Server_Host_DSA.
      Info: The DSA host key named SSH Server_Host_DSA already exists.
      Info: The key modulus can be any one of the following : 1024, 2048.
      Info: If the key modulus is greater than 512, it may take a few minutes.
      Please input the modulus [default=2048]:
      Info: Generating keys........
      Info: Succeeded in creating the DSA host keys.
      # Check the public key in the DSA key pair generated on the client.
      [client002] display dsa local-key-pair public
      =====================================================
      Time of Key pair created: 2014-03-03 16:51:28-05:13
      Key name: client002_Host
      Key modulus : 2048
      Key type: DSA encryption Key
      Key fingerprint: c0:52:b0:37:4c:b2:64:d1:8f:ff:a1:42:87:09:8c:6f
      =====================================================
      Key code:
      30820109
        02820100
          CA97BCDE 697CEDE9 D9AB9475 9E004D15 C8B95116
          87B79B0C 5698C582 69A9F4D0 45ED0E53 AF2EDEC1
          A09DF4BE 459E34B6 6697B85D 2191A00E 92F3A5E7
          FB0E73E7 F0212432 E898D979 8EAA491E E2B69727
          4B51A2BE CD86A144 16748D1E 4847A814 3FE50862
          6EB1AD81 EB49A05E 64F6D186 C4E94CDB 04C53074
          B839305A 7F7BCE2C 606F6C91 EA958B6D AC46C12B
          8C2B1E03 98F1C09D 3AF2A69D 6867F930 DF992692
          9A921682 916273FC 4DD875D4 44BC371E DDBB8F6A
          C0A4CDB3 ADDAE853 DB86B9FA DB13CCA9 D8CF6EC1
          530CC2F5 697C4707 90829982 4339507F F354FAF9
          0F9CD2C2 F7D6FF3D 901D700F F0588104 856B9592
          71D773E2 E76E8EEB 431FB60D 60ABC20B
        0203
          010001
                                                
       Host public key for PEM format code:
      ---- BEGIN SSH2 PUBLIC KEY ----
      AAAAB3NzaC1yc2EAAAADAQABAAABAQDKl7zeaXzt6dmrlHWeAE0VyLlRFoe3mwxW
      mMWCaan00EXtDlOvLt7BoJ30vkWeNLZml7hdIZGgDpLzpef7DnPn8CEkMuiY2XmO
      qkke4raXJ0tRor7NhqFEFnSNHkhHqBQ/5QhibrGtgetJoF5k9tGGxOlM2wTFMHS4
      OTBaf3vOLGBvbJHqlYttrEbBK4wrHgOY8cCdOvKmnWhn+TDfmSaSmpIWgpFic/xN
      2HXURLw3Ht27j2rApM2zrdroU9uGufrbE8yp2M9uwVMMwvVpfEcHkIKZgkM5UH/z
      VPr5D5zSwvfW/z2QHXAP8FiBBIVrlZJx13Pi526O60Mftg1gq8IL
      ---- END SSH2 PUBLIC KEY ----
      
      Public key code for pasting into OpenSSH authorized_keys file :
      ssh-dsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKl7zeaXzt6dmrlHWeAE0VyLlRFoe3mwxWmMWCaan00EXtDlOvLt7BoJ30vkWeNLZml7hdIZGgDpLzpef7DnPn8CEkMuiY2XmOqkke4raXJ0tRor7NhqFEFnSNHkhHqBQ/5QhibrGtgetJoF5k9tGGxOlM2wTFMHS4OTBaf3vOLGBvbJHqlYttrEbBK4wrHgOY8cCdOvKmnWhn+TDfmSaSmpIWgpFic/xN2HXURLw3Ht27j2rApM2zrdroU9uGufrbE8yp2M9uwVMMwvVpfEcHkIKZgkM5UH/zVPr5D5zSwvfW/z2QHXAP8FiBBIVrlZJx13Pi526O60Mftg1gq8IL dsa-key
      
      [SSH Server] dsa peer-public-key dsakey001 encoding-type der
      [SSH Server-dsa-public-key] public-key-code begin
      Info: Enter "DSA key code" view, return the last view with "public-key-code end".
      [SSH Server-dsa-key-code] 30820109
      [SSH Server-dsa-key-code] 2820100
      [SSH Server-dsa-key-code] CA97BCDE 697CEDE9 D9AB9475 9E004D15 C8B95116
      [SSH Server-dsa-key-code] 87B79B0C 5698C582 69A9F4D0 45ED0E53 AF2EDEC1
      [SSH Server-dsa-key-code] A09DF4BE 459E34B6 6697B85D 2191A00E 92F3A5E7
      [SSH Server-dsa-key-code] FB0E73E7 F0212432 E898D979 8EAA491E E2B69727
      [SSH Server-dsa-key-code] 4B51A2BE CD86A144 16748D1E 4847A814 3FE50862
      [SSH Server-dsa-key-code] 6EB1AD81 EB49A05E 64F6D186 C4E94CDB 04C53074
      [SSH Server-dsa-key-code] B839305A 7F7BCE2C 606F6C91 EA958B6D AC46C12B
      [SSH Server-dsa-key-code] 8C2B1E03 98F1C09D 3AF2A69D 6867F930 DF992692
      [SSH Server-dsa-key-code] 9A921682 916273FC 4DD875D4 44BC371E DDBB8F6A
      [SSH Server-dsa-key-code] C0A4CDB3 ADDAE853 DB86B9FA DB13CCA9 D8CF6EC1
      [SSH Server-dsa-key-code] 530CC2F5 697C4707 90829982 4339507F F354FAF9
      [SSH Server-dsa-key-code] 0F9CD2C2 F7D6FF3D 901D700F F0588104 856B9592
      [SSH Server-dsa-key-code] 71D773E2 E76E8EEB 431FB60D 60ABC20B
      [SSH Server-dsa-key-code] 203
      [SSH Server-dsa-key-code] 10001
      [SSH Server-dsa-key-code] public-key-code end
      [SSH Server-dsa-public-key] peer-public-key end

      # Bind the DSA public key of the STelnet client to the SSH user client002 on the SSH server.

      [SSH Server] ssh user client002 assign dsa-key dsakey001

  3. Enable the STelnet service on the SSH server.

    # Enable the STelnet service.

    [SSH Server] stelnet server enable

  4. Configure the STelnet service type for the client001 and client002 users.

    [SSH Server] ssh user client001 service-type stelnet
    [SSH Server] ssh user client002 service-type stelnet

  5. Connect the STelnet client to the SSH server.

    # Enable the first authentication function on the SSH client upon the first login.

    Enable the first authentication function for Client001.

    <Quidway> system-view
    [Quidway] sysname client001
    [client001] ssh client first-time enable

    Enable the first authentication function for Client002.

    [client002] ssh client first-time enable

    # Log in to the SSH server from Client001 in password authentication mode by entering the user name and password.

    [client001] stelnet 10.1.1.1
    Please input the username:client001
    Trying 10.1.1.1 ...
    Press CTRL+K to abort
    Connected to 10.1.1.1 ...
    The server is not authenticated. Continue to access it? [Y/N] :y
    Save the server's public key? [Y/N] :y
    The server's public key will be saved with the name 10.1.1.1. Please wait...
    
    Please select public key type for user authentication [R for RSA; D for DSA; Enter for Skip publickey authentication; Ctrl_C for Can
    cel], Please select [R, D, Enter or Ctrl_C]:d
    Enter password:

    Enter the password. The following information indicates that you have logged in successfully:

    <SSH Server>

    # Log in to the SSH server from Client002 in DSA authentication mode.

    [client002] stelnet 10.1.1.1 user-identity-key dsa
    Please input the username:client002
    Trying 10.1.1.1 ...
    Press CTRL+K to abort
    Connected to 10.1.1.1 ...
    Please select public key type for user authentication [R for RSA; D for DSA; Enter for Skip publickey authentication; Ctrl_C for Can
    cel], Please select [R, D, Enter or Ctrl_C]:d
    <SSH Server>

    If the user view is displayed, you have logged in successfully. If the message "Session is disconnected" is displayed, the login fails.

  6. Verify the configuration.

    Run the display ssh server status command. You can see that the STelnet service has been enabled. Run the display ssh user-information command. Information about the configured SSH users is displayed.

    # Check the status of the SSH server.

    [SSH Server] display ssh server status
     SSH version                         :2.0
     SSH connection timeout              :60 seconds
     SSH server key generating interval  :0 hours
     SSH authentication retries          :3 times
     SFTP server                         :Disable
     Stelnet server                      :Enable
     Scp server                          :Disable
     SSH server source                   :0.0.0.0
     ACL4 number                         :0
     ACL6 number                         :0

    # Check information about SSH users.

    [SSH Server] display ssh user-information
      User 1:
           User Name            : client001
           Authentication-type  : password
           User-public-key-name : -
           User-public-key-type : -
           Sftp-directory       : -
           Service-type         : stelnet
           Authorization-cmd    : No
      User 2:
           User Name            : client002
           Authentication-type  : dsa
           User-public-key-name : dsakey001
           User-public-key-type : dsa
           Sftp-directory       : -
           Service-type         : stelnet
           Authorization-cmd    : No

Configuration File

  • SSH server configuration file

    #
    sysname SSH Server
    #
    dsa peer-public-key dsakey001 encoding-type der
     public-key-code begin
      30820109
        02820100
          CA97BCDE 697CEDE9 D9AB9475 9E004D15 C8B95116 87B79B0C 5698C582 69A9F4D0
          45ED0E53 AF2EDEC1 A09DF4BE 459E34B6 6697B85D 2191A00E 92F3A5E7 FB0E73E7
          F0212432 E898D979 8EAA491E E2B69727 4B51A2BE CD86A144 16748D1E 4847A814
          3FE50862 6EB1AD81 EB49A05E 64F6D186 C4E94CDB 04C53074 B839305A 7F7BCE2C
          606F6C91 EA958B6D AC46C12B 8C2B1E03 98F1C09D 3AF2A69D 6867F930 DF992692
          9A921682 916273FC 4DD875D4 44BC371E DDBB8F6A C0A4CDB3 ADDAE853 DB86B9FA
          DB13CCA9 D8CF6EC1 530CC2F5 697C4707 90829982 4339507F F354FAF9 0F9CD2C2
          F7D6FF3D 901D700F F0588104 856B9592 71D773E2 E76E8EEB 431FB60D 60ABC20B
        0203 
          010001
     public-key-code end
    peer-public-key end
    #
    aaa
     local-user client001 password irreversible-cipher $1a$gRNl~ukoL~0.WU)C2]~2a}Cz/Y0-u8M{j@Ql6/xHryO-Y7m{=A>kWc.-q}>*$
     local-user client001 privilege level 3
     local-user client001 service-type ssh
    #
    stelnet server enable
    ssh user client001
    ssh user client001 authentication-type password
    ssh user client001 service-type stelnet
    ssh user client002
    ssh user client002 authentication-type dsa
    ssh user client002 assign dsa-key dsakey001
    ssh user client002 service-type stelnet
    #
    user-interface vty 0 4
     authentication-mode aaa
    #
    return
  • Client001 configuration file

    #
    sysname client001
    #
    ssh client first-time enable
    #
    return
  • Client002 configuration file

    #
    sysname client002
    #
    ssh client first-time enable
    #
    return
Translation
Download
Updated: 2019-04-17

Document ID: EDOC1000178413

Views: 68609

Downloads: 109

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next