Dell N3200-ON Networking N-Series Switches User Guide version 6.8.0 - Page 245

the message (and can send back some proof that it has done so) then the response proves that switch must possess the public key, and user is authenticated without giving a username/password. The public key method is implemented in the Dell Networking N-Series switch as opposed to an external server. If the user does not present a certificate, it is not considered an error and authentication will continue with challenge-response authentication. Challenge-response SSH authentication works as follows: The switch sends an arbitrary "challenge" text and prompts for a response. SSH-2 allows multiple challenges and responses; SSH-1 is restricted to one challenge/response only. Examples of challenge-response authentication include BSD Authentication. Finally, if all other authentication methods fail, SSH prompts the user for a password. Enabling SSH Access The following example enables the switch to be accessed using SSH. If RSA or DSA keys exist, the switch will prompt to overwrite the keys as shown below. The RSA and DSA keys are used to negotiate the symmetric encryption algorithm used for the SSH session. RSA keys can be generated specifying the length 1024, 2048, or 3072 bits but DSA keys must be exactly 1024 bits as specified by FIPS 186-2. console(config)#crypto key generate rsa Do you want to overwrite the existing RSA keys? (y/n):y RSA key generation started, this may take a few minutes... RSA key generation complete. console(config)#crypto key generate dsa Do you want to overwrite the existing DSA keys? (y/n):y DSA key generation started, this may take a few minutes... DSA key generation complete. console(config)#ip ssh server The following is an ECDSA example. console(config)#crypto key generate ecdsa Do you want to overwrite the existing ECDSA keys? (y/n):y ECDSA key generation started, this may take a few minutes.... Authentication, Authorization, and Accounting 245