Secure System Administration with SSH

The system supports the SSH protocol version 2 as a secure alternative to Telnet for system administration.

Note: Versions earlier than 2.0.12 of the SSH protocol client are not supported. The SSH server embedded within the router recognizes SSH clients that report an SSH protocol version of 1.99, with the expectation that such clients are compatible with SSH protocol version 2.0. Clients that report an SSH protocol version of 1.99 apparently do so to determine the protocol version supported by the server.

SSH provides the following major features:

• Server authentication through a Diffie-Hellman key exchange—Protects against hackers interjecting mimics to obtain your password. You can be confident that you are connected to your own router.
• User authentication—Ensures that the router is allowing connection from a permitted host and remote user.

  Note: Digital Signature Standard (DSS) public key user authentication for SSH is not supported. RADIUS password authentication is the only method of user authentication currently supported. It is enabled by default. If RADIUS authentication is disabled, then all SSH clients that pass protocol negotiation are accepted.

• Data encryption and key-protected hashing—Provides a secure, trustable session to the upper-layer user interface. Encryption provides confidentiality by preventing unauthorized persons from listening in on management traffic. Encryption and hashing ensure data integrity to obstruct man-in-the-middle attacks, in which unauthorized persons access messages and modify them without detection.

Copyright © 2008, Juniper Networks, Inc. All rights reserved. Trademark Notice.