Dell Force10 Z9000 FTOS Configuration Guide for Z9000 System - Page 808

www.dell.com | support.dell.com To configure host-based authentication: Step 1 2 Task Command Syntax Command Mode Configure RSA Authentication. See RSA Authentication of SSH, above. Create shosts by copying the public RSA key to the to the file shosts in the diretory .ssh, and write the IP address of the host to the file. Figure 39-10. Creating shosts cp /etc/ssh/ssh_host_rsa_key.pub /.ssh/shosts admin@Unix_client# cd /etc/ssh admin@Unix_client# ls moduli sshd_config ssh_host_dsa_key.pub ssh_host_key.pub ssh_host_rsa_key.pub ssh_config ssh_host_dsa_key ssh_host_key ssh_host_rsa_key admin@Unix_client# cat ssh_host_rsa_key.pub ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA8K7jLZRVfjgHJzUOmXxuIbZx/ AyWhVgJDQh39k8v3e8eQvLnHBIsqIL8jVy1QHhUeb7GaDlJVEDAMz30myqQbJgXBBRTWgBpLWwL/ doyUXFufjiL9YmoVTkbKcFmxJEMkE3JyHanEi7hg34LChjk9hL1by8cYZP2kYS2lnSyQWk= admin@Unix_client# ls id_rsa id_rsa.pub shosts admin@Unix_client# cat shosts 10.16.127.201, ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA8K7jLZRVfjgHJzUOmXxuIbZx/AyW hVgJDQh39k8v3e8eQvLnHBIsqIL8jVy1QHhUeb7GaDlJVEDAMz30myqQbJgXBBRTWgBpLWwL/ doyUXFufjiL9YmoVTkbKcFmxJEMkE3JyHanEi7hg34LChjk9hL1by8cYZP2kYS2lnSyQWk= 3 Create a list of IP addresses and usernames that are permitted to SSH in a file called rhosts, as shown in Figure 39-11. Figure 39-11. Creating rhosts admin@Unix_client# ls id_rsa id_rsa.pub rhosts shosts admin@Unix_client# cat rhosts 10.16.127.201 admin 4 Copy the file shosts and rhosts to the Dell Force10 system. 5 Disable password authentication and • no ip ssh password-authentication RSA authentication, if configured • no ip ssh rsa-authentication • CONFIGURATION • EXEC Privilege 6 Enable host-based authentication. ip ssh hostbased-authentication enable CONFIGURATION 7 Bind shosts and rhosts to host-based authentication. ip ssh pub-key-file flash://filename ip ssh rhostsfile flash://filename CONFIGURATION Client-based SSH Authentication SSH from the chassis to the SSH client using the command ssh ip_address. This method uses SSH version 1 or version 2. If the SSH port is a non-default value, use the command ip ssh server port number, to change the default port number. You may only change the port number when SSH is disabled. When must then still use the -p option with the command ssh. 808 | Security