Users Guide

825| Management Access Dell Networking W-Series ArubaOS 6.5.x| User Guide
In the WebUI
1. Navigate to the Configuration > Management > General page.
2. Under WebUI Management Authentication Method, select Client Certificate. You can select
Username and Password as well; in this case, the user is prompted to manually enter the username and
password only if the client certificate is invalid.
3. Select the Server Certificate to be used for this service.
4. Click Apply.
5. To configure the management user, navigate to the Configuration > Management > Administration
page.
a. Under Management Users, click Add.
b. Select Certificate Management.
c. Select WebUI Certificate.
d. Enter the username.
e. Select the user role assigned to the user upon validation of the client certificate
f. Enter the serial number for the client certificate.
g. Select the name of the CA that issued the client certificate.
h. Click Apply.
In the CLI
(host)(config) #web-server profile
(host)(Web Server Configuration) #mgmt-auth certificate
(host)(Web Server Configuration) #switch-cert <certificate>
(host)(Web Server Configuration) #!
(host)(config) #mgmt-user webui-cacert <certificate-name> serial <number> <username>
<rolename>
Secure Shell (SSH)
SSH is enabled by default in ArubaOS, and thus lets you log in using a username and password. You can enable
SSH login by using public key authentication while leaving username/password authentication enabled, or you
may disable the username/password authentication and leave only the public key authentication enabled. In
the FIPS mode of operation, SSH is pre-configured to only use Diffie-Hellman Group 14 with AES-CBC-128 and
AES-CBC-256 and HMAC-SHA1/HMAC-SHA1-96. These settings are not configurable.
When you import an X.509 client certificate into the controller, the certificate is converted to SSH-RSA keys.
When you enable public key authentication for SSH, the controller validates the client’s credentials with the
imported public keys. You can specify public key authentication only, or public key authentication with
username/password (if the public key authentication fails, the user can login with a configured username and
password).
Enabling Public Key Authentication
The controller allows public key authentication of users accessing the controller using SSH. (The default is for
username/password authentication.)
To use public key authentication, you must do the following:
1. Import the X.509 client certificate into the controller using the WebUI, as described in Importing Certificates
on page 848
2. Configure SSH for client public key authentication. You can optionally also select username/password
authentication.