网络设备实施 SSH 协议远程管理

2021-02-18 | 129 浏览

网络设备实施SSH协议远程管理

1.SSH安全远程管理简书

ssh支持RSA和ECC认证方式客户端需要创建一对密钥，并把公用密钥发送到需要登录的服务器，服务器使用预先配置的的该客户端公用密钥，于报文中携带的客户端公用密钥进行比较，如果两个公用密钥不一致，服务器断开与客户端的连接。如果两个公用密钥一致，客户端继续使用自己本地密钥对的私用密钥部分，对特定报文进行摘要运算，将所得结果既数字签名发送给服务器，向服务器证明自己的身份，服务器使用加密算法DES\3DES\AES128\AES256对用户名密码以及传输数据进行加密

2.在华为设备上实施SSH协议

1.华为设备实施ssh组网需求

在华为模拟器中使用AR2200的设备,R1服务器，R2作为客户端。

2.华为SSH配置步骤详解

1.先完成基本的网络连通性
AR1:

<AR1>system-view 
Enter system view, return user view with Ctrl+Z.
[AR1]interface g0/0/0  
[AR1-GigabitEthernet0/0/0]ip address 202.100.1.1 255.255.255.252 
[AR1-GigabitEthernet0/0/0]display th
[V200R003C00]
#
interface GigabitEthernet0/0/0
 ip address 202.100.1.1 255.255.255.252 
#
return

AR2:

<Huawei>system-view 
Enter system view, return user view with Ctrl+Z.
[ar2]sysname AR2
[AR2]interface g0/0/0
[AR2-GigabitEthernet0/0/0]ip addre
[AR2-GigabitEthernet0/0/0]ip address 202.100.1.2 255.255.255.252
[AR2-GigabitEthernet0/0/0]display th
[V200R003C00]
#
interface GigabitEthernet0/0/0
 ip address 202.100.1.2 255.255.255.252 
#
return
[AR2-GigabitEthernet0/0/0]

测试网络连通性

[AR1]ping 202.100.1.2
  PING 202.100.1.2: 56  data bytes, press CTRL_C to break
    Reply from 202.100.1.2: bytes=56 Sequence=1 ttl=255 time=70 ms
    Reply from 202.100.1.2: bytes=56 Sequence=2 ttl=255 time=70 ms
    Reply from 202.100.1.2: bytes=56 Sequence=3 ttl=255 time=50 ms
    Reply from 202.100.1.2: bytes=56 Sequence=4 ttl=255 time=60 ms
    Reply from 202.100.1.2: bytes=56 Sequence=5 ttl=255 time=40 ms

  --- 202.100.1.2 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 40/58/70 ms

在R1上级服务器上实施SSH配置

[AR1]aaa    #进入aaa模式，既认证、授权、审计，该模式用于创建用户和密码
[AR1-aaa]local-user ender password  cipher 123456     #创建本地用户ender，密码为123456
Info: Add a new user.
[AR1-aaa]local-user ender privilege level 15        #该用户的级别为最高级别15
[AR1-aaa]local-user ender service-type ssh         #该用户用于ssh登录
[AR1-aaa]quit                                       #退出aaa模式
[AR1]ssh user ender authentication-type  password   #ssh用户ender通过密码进行认证
 Authentication type setted, and will be in effect next time
[AR1]stelnet server enable                         #开启ssh服务，该服务默认处于关闭状态
Info: Succeeded in starting the STELNET server.
[AR1]rsa local-key-pair create                     #在设备上创建rsa的key，用于ssh登录
The key name will be: Host
% RSA keys defined for Host already exist.
Confirm to replace them? (y/n)[n]:y
The range of public key size is (512 ~ 2048).
NOTES: If the key modulus is greater than 512,
       It will take a few minutes.
Input the bits in the modulus[default = 512]:
Generating keys...
.++++++++++++
......++++++++++++
.............++++++++
.....................++++++++

[AR1]user-interface vty 0 4                     #进入vty通道
[AR1-ui-vty0-4]authentication-mode aaa          #vty通道认证模式使用aaa模式，既认证时用aaa定义的用户和密码
[AR1-ui-vty0-4]protocol inbound ?
  all     All protocols
  ssh     SSH protocol
  telnet  Telnet protocol
[AR1-ui-vty0-4]protocol inbound ssh      #vty允许ssh登录
[AR1-ui-vty0-4]

完成ssh登录测试

Please run the command "ssh client first-time enable"to enable the first-time access function and try again.              #注意华为设备作为客户端第一次登录可以使用命令ssh client first-time enable
[AR2]ssh client first-time enable 
[AR2]stelnet 202.100.1.1         #在系统视图进行连接
Please input the username:ender
Trying 202.100.1.1 ...
Press CTRL+K to abort
Connected to 202.100.1.1 ...
The server is not authenticated. Continue to access it? (y/n)[n]:y
Feb 14 2020 10:30:57-08:00 AR2 %%01SSH/4/CONTINUE_KEYEXCHANGE(l)[0]:The server had not been authenticated in the process of exchanging keys. When deciding whether to continue, the user chose Y. 
[AR2]
Save the server's public key? (y/n)[n]:y
Feb 14 2020 10:30:59-08:00 AR2 %%01SSH/4/SAVE_PUBLICKEY(l)[1]:When deciding whether to save the server's public key 202.100.1.1, the user chose Y. 
[AR2]
The server's public key will be saved with the name 202.100.1.1. Please wait...

Enter password:123456

<AR1>display users     #登录成功，查看登录用户为ender，位于202.100.1.2的设备已通过vty登录了r1
  User-Intf    Delay    Type   Network Address     AuthenStatus    AuthorcmdFlag
+ 130 VTY 1   00:00:00  SSH    202.100.1.2               pass                     Username : ender             
<AR1>system-view 
Enter system view, return user view with Ctrl+Z.
[AR1]

华为设备完成ssh实施

3.在H3C设备实施ssh协议远程登录

1.华三SSH协议组网络拓扑
R2充当ssh客户端远程登录到ssh服务器R1

2.华三设备配置SSH要点
本部分的配置要点

1.需要在服务器创建ssh账户并开启ssh

2.手工创建密钥

3.vty允许ssh登陆

3.华三配置SSH和测试步骤

配置R1
配置R2
华三SSH服务器配置
[R1]ssh server enable  #开启ssh服务
[R1]local-user ender   #创建本地用户，这是华三设备上创建aaa用户的方式
[R1-local-user ender] password simple 123456
[R1-local-user ender] service-type ssh   #该用户服务与ssh应用
[R1]user-interface vty 0 4  #进去vty接口
[R1-line-vty0-4]authentication-mode schema #登录vty用户的认证方式为aaa，即使用前边配置的用户和密码登录
[R1-line-vty0-4] protocol inbound ssh #vty线路允许ssh登录管理
[R1-line-vty0-4]user-role level-15   #登录的用户为15级
在客户端进行SSH登录测试
<SW1>sshv2 202.100.1.1 #注意需要在系统视图进行ssh登录

路由交换