When switch acts as client for publickey authentication

As shown in Figure 88, Switch A (the SSH client) must pass publickey authentication to log in to Switch B (the SSH server) through the SSH protocol. Use the DSA public key algorithm.

During SSH server configuration, the client public key is required. Use the client software to generate a DSA key pair on the client before configuring the SSH server.

# Create VLAN-interface 1 and assign an IP address to it.

<SwitchA> system-view
[SwitchA] interface vlan-interface 1
[SwitchA-Vlan-interface1] ip address 10.165.87.137 255.255.255.0
[SwitchA-Vlan-interface1] quit

# Generate a DSA key pair.

[SwitchA] public-key local create dsa
The range of public key size is (512 ~ 2048).
NOTES: If the key modulus is greater than 512,
It will take a few minutes.
Press CTRL+C to abort.
Input the bits of the modulus[default = 1024]:
Generating Keys...
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++

# Export the DSA public key to file key.pub.

[SwitchA] public-key local export dsa ssh2 key.pub
[SwitchA] quit

Then, transmit the public key file to the server through FTP or TFTP.

# Generate RSA key pairs.

<SwitchB> system-view
[SwitchB] public-key local create rsa
The range of public key size is (512 ~ 2048).
NOTES: If the key modulus is greater than 512,
It will take a few minutes.
Press CTRL+C to abort.
Input the bits of the modulus[default = 1024]:
Generating Keys...
++++++++
++++++++++++++
+++++
++++++++

# Generate a DSA key pair.

[SwitchB] public-key local create dsa
The range of public key size is (512 ~ 2048).
NOTES: If the key modulus is greater than 512,
It will take a few minutes.
Press CTRL+C to abort.
Input the bits of the modulus[default = 1024]:
Generating Keys...
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++

# Enable the SSH server.

[SwitchB] ssh server enable

# Configure an IP address for VLAN-interface 1, which the SSH client will use as the destination for SSH connection.

[SwitchB] interface vlan-interface 1
[SwitchB-Vlan-interface1] ip address 10.165.87.136 255.255.255.0
[SwitchB-Vlan-interface1] quit

# Set the authentication mode for the user interfaces to AAA.

[SwitchB] user-interface vty 0 15
[SwitchB-ui-vty0-15] authentication-mode scheme

# Enable the user interfaces to support SSH.

[SwitchB-ui-vty0-15] protocol inbound ssh

# Set the user command privilege level to 3.

[SwitchB-ui-vty0-15] user privilege level 3
[SwitchB-ui-vty0-15] quit

# Import the peer public key from the file key.pub.

[SwitchB] public-key peer Switch001 import sshkey key.pub

# Specify the authentication method for user client002 as publickey, and assign the public key Switch001 to the user.

[SwitchB] ssh user client002 service-type stelnet authentication-type publickey assign publickey Switch001

<SwitchA> ssh2 10.165.87.136
Username: client002
Trying 10.165.87.136 ...
Press CTRL+K to abort
Connected to 10.165.87.136 ...

The Server is not authenticated. Continue? [Y/N]:y
Do you want to save the server public key? [Y/N]:n

Later, you will find that you have logged in to Switch B successfully.