在 NDcPPv2.2e 的评估配置上配置 SSH
在评估的配置中允许通过远程管理接口进行 SSH。本主题介绍如何配置 SSH 以远程管理 TOE。需要配置以下算法来验证 NDcPPv2.2e 的 SSH。
要在 TOE 上配置 SSH，请执行以下操作：
为系统服务指定允许的 SSH 主机密钥算法。
[edit] security-administrator@host:fips# set system services ssh hostkey-algorithm ssh-ecdsa security-administrator@host:fips# set system services ssh hostkey-algorithm no-ssh-dss security-administrator@host:fips# set system services ssh hostkey-algorithm ssh-rsa security-administrator@host:fips# set system services ssh hostkey-algorithm no-ssh-ed25519
指定系统服务的 Diffie-Hellman 密钥的 SSH 密钥交换。
[edit] security-administrator@host:fips# set system services ssh key-exchange dh-group14-sha1 security-administrator@host:fips# set system services ssh key-exchange ecdh-sha2-nistp256 security-administrator@host:fips# set system services ssh key-exchange ecdh-sha2-nistp384 security-administrator@host:fips# set system services ssh key-exchange ecdh-sha2-nistp521
指定 SSHv2 的所有允许的消息身份验证代码算法
[edit] security-administrator@host:fips# set system services ssh macs hmac-sha1 security-administrator@host:fips# set system services ssh macs hmac-sha2-256 security-administrator@host:fips# set system services ssh macs hmac-sha2-512
指定协议版本 2 允许使用的密码。
[edit] security-administrator@host:fips# set system services ssh ciphers aes128-cbc security-administrator@host:fips# set system services ssh ciphers aes256-cbc security-administrator@host:fips# set system services ssh ciphers aes128-ctr security-administrator@host:fips# set system services ssh ciphers aes256-ctr
注意：
要禁用 SSH 服务，您可以停用 SSH 配置：
user@host# deactivate system services ssh
注意：
要禁用 Netconf 服务，您可以停用 netconf 配置：
user@host# deactivate system services netconf ssh
支持的 SSH 主机密钥算法：
支持的 SSH 密钥交换算法：
dh-group14-sha1 The RFC 4253 mandated group14 with SHA1 hash ecdh-sha2-nistp256 The EC Diffie-Hellman on nistp256 with SHA2-256 ecdh-sha2-nistp384 The EC Diffie-Hellman on nistp384 with SHA2-384 ecdh-sha2-nistp521 The EC Diffie-Hellman on nistp521 with SHA2-512
支持的 MAC 算法：
hmac-sha1 Hash-based MAC using Secure Hash Algorithm (SHA1) hmac-sha2-256 Hash-based MAC using Secure Hash Algorithm (SHA2) hmac-sha2-512 Hash-based MAC using Secure Hash Algorithm (SHA2)
支持的 SSH 密码算法：
aes128-cbc 128-bit AES with Cipher Block Chaining aes128-ctr 128-bit AES with Counter Mode aes256-cbc 256-bit AES with Cipher Block Chaining aes256-ctr 256-bit AES with Counter Mode