Admin Guide

By using a combination of host, server, and session keys, the SSHv2 protocol can provide strong
authentication and secure communication over an insecure network, offering protection from the
following security risks:
• IP spoofing
• IP source routing
• Domain name server (DNS) spoofing
• Man-in-the-middle/TCP hijacking attacks
• Eavesdropping and password sniffing
Even if network security is compromised, traffic cannot be played back or decrypted, and the
connection cannot be hijacked.
The SSH secure channel of communication does not provide protection against break-in attempts or
denial-of-service (DoS) attacks.
With the SSHv2 server in the VSP switch, you can use an SSHv2 client to make a secure
connection to the VSP switch and work with commercially available SSHv2 clients. For more
information about supported clients, see
Table 37: Third-party SSH and SCP client software on
page 147. The VSP switch also supports outbound connections to remote SSHv2 servers to
provide complete inbound and outbound secure access.
Security features
The SSHv2 protocol supports the following security features:
• Authentication. This feature determines, in a reliable way, the SSHv2 client. During the log on
process, the SSHv2 client is queried for a digital proof of identity.
Supported authentications with the switch as a server for SSHv2, are: RSA, DSA, and
passwords. Supported authentications with the switch as a client for SSHv2, are: DSA and
passwords. The VSP switch does not support RSA when the switch acts as a client.
When the VSP switch acts as an SSH server the VSP switch allows up to four sessions at a
time. However, only one SSH public key encryption per access level is allowed at a time. For
instance, if multiple SSH public key encryption clients have to connect to the VSP server with
the same access level, such as rwa then the clients must connect to the server one-by-one as
the VSP only supports one public key per access level.
• Encryption. The SSHv2 server uses encryption algorithms to scramble data and render it
unintelligible except to the receiver.
Supported encryption and ciphers are: 3DES, AES128-cbc, AES192-cbc, and AES256-cbc,
MD5, secure hash algorithm 1 (SHA-1) and SHA-2.
• Integrity. This feature guarantees that the data transmits from the sender to the receiver
without alterations. If a third party captures and modifies the traffic, the SSHv2 server detects
this alteration.
SSHv2 considerations using EDM
You must use ACLI to initially configure SSHv2. You can use Enterprise Device Manager (EDM) to
change the SSHv2 configuration parameters. However, Avaya recommends that you use ACLI.
Avaya also recommends that you use the console port (10101) to configure the SSHv2 parameters.
Secure Shell fundamentals
October 2015 Administering Avaya VSP 7200 Series and 8000 Series 141
Comments on this document? [e-mail]