Publickey authentication enabled SFTP client configuration example

Network requirements

As shown in Figure 103:

Figure 103: Network diagram

Configuration procedure

In the server configuration, the client public key is required. Use the client software to generate RSA key pairs on the client before configuring the SFTP server.

  • Configure the SFTP client:

  • # Create VLAN-interface 2 and assign an IP address to it.

    <SwitchA> system-view
    [SwitchA] interface vlan-interface 2
    [SwitchA-Vlan-interface2] ip address 192.168.0.2 255.255.255.0
    [SwitchA-Vlan-interface2] quit
    

    # Generate RSA key pairs.

    [SwitchA] public-key local create rsa
    The range of public key size is (512 ~ 2048).
    NOTES: If the key modulus is greater than 512,
    It will take a few minutes.
    Press CTRL+C to abort.
    Input the bits of the modulus[default = 1024]:
    Generating Keys...
    ++++++++
    ++++++++++++++
    +++++
    ++++++++
    

    # Export the host public key to file pubkey.

    [SwitchA] public-key local export rsa ssh2 pubkey
    [SwitchA] quit
    

    # Transmit the public key file to the server through FTP or TFTP. (Details not shown.)

  • Configure the SFTP server:

  • # Generate RSA key pairs.

    <SwitchB> system-view
    [SwitchB] public-key local create rsa
    The range of public key size is (512 ~ 2048).
    NOTES: If the key modulus is greater than 512,
    It will take a few minutes.
    Press CTRL+C to abort.
    Input the bits of the modulus[default = 1024]:
    Generating Keys...
    ++++++++
    ++++++++++++++
    +++++
    ++++++++
    

    # Generate a DSA key pair.

    [SwitchB] public-key local create dsa
    The range of public key size is (512 ~ 2048).
    NOTES: If the key modulus is greater than 512,
    It will take a few minutes.
    Press CTRL+C to abort.
    Input the bits of the modulus[default = 1024]:
    Generating Keys...
    ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    +++++++++++++++++++++++++++++++++++
    

    # Enable the SSH server function.

    [SwitchB] ssh server enable
    

    # Enable the SFTP server function.

    [SwitchB] sftp server enable
    

    # Configure an IP address for VLAN-interface 2. The SSH client uses this address as the destination address for SSH connection.

    [SwitchB] interface vlan-interface 2
    [SwitchB-Vlan-interface2] ip address 192.168.0.1 255.255.255.0
    [SwitchB-Vlan-interface2] quit
    

    # Set the authentication mode to AAA for the user interfaces.

    [SwitchB] user-interface vty 0 15
    [SwitchB-ui-vty0-15] authentication-mode scheme
    

    # Set the protocol that a remote user uses to log in as SSH.

    [SwitchB-ui-vty0-15] protocol inbound ssh
    [SwitchB-ui-vty0-15] quit
    

    # Import the peer public key from the file pubkey, and name it SwitchKey.

    [SwitchB] public-key peer SwitchKey import sshkey pubkey
    

    # Create an SSH user client001. Specify the service type as SFTP and authentication method as publickey for the user. Assign the public key SwitchKey, and working folder flash:/ to the user.

    [SwitchB] ssh user client001 service-type sftp authentication-type publickey assign publickey SwitchKey work-directory flash:/
    
  • Establish a connection to the SFTP server:

  • # Establish a connection to the SFTP server and enter SFTP client view.

    <SwitchA> sftp 192.168.0.1 identity-key rsa
    Input Username: client001
    Trying 192.168.0.1 ...
    Press CTRL+K to abort
    Connected to 192.168.0.1 ...
    
    The Server is not authenticated. Continue? [Y/N]:y
    Do you want to save the server public key? [Y/N]:n
    
    sftp-client>
    

    # Display files under the current directory of the server, delete the file z, and verify the result.

    sftp-client> dir
    -rwxrwxrwx   1 noone    nogroup      1759 Aug 23 06:52 config.cfg
    -rwxrwxrwx   1 noone    nogroup       225 Aug 24 08:01 pubkey2
    -rwxrwxrwx   1 noone    nogroup       283 Aug 24 07:39 pubkey
    drwxrwxrwx   1 noone    nogroup         0 Sep 01 06:22 new
    -rwxrwxrwx   1 noone    nogroup       225 Sep 01 06:55 pub
    -rwxrwxrwx   1 noone    nogroup         0 Sep 01 08:00 z
    sftp-client> delete z
    The following File will be deleted:
    /z
    Are you sure to delete it? [Y/N]:y
    This operation might take a long time.Please wait...
    
    File successfully Removed
    sftp-client> dir
    -rwxrwxrwx   1 noone    nogroup      1759 Aug 23 06:52 config.cfg
    -rwxrwxrwx   1 noone    nogroup       225 Aug 24 08:01 pubkey2
    -rwxrwxrwx   1 noone    nogroup       283 Aug 24 07:39 pubkey
    drwxrwxrwx   1 noone    nogroup         0 Sep 01 06:22 new
    -rwxrwxrwx   1 noone    nogroup       225 Sep 01 06:55 pub
    

    # Add a directory named new1 and examine if it has been created successfully.

    sftp-client> mkdir new1
    New directory created
    sftp-client> dir
    -rwxrwxrwx   1 noone    nogroup      1759 Aug 23 06:52 config.cfg
    -rwxrwxrwx   1 noone    nogroup       225 Aug 24 08:01 pubkey2
    -rwxrwxrwx   1 noone    nogroup       283 Aug 24 07:39 pubkey
    drwxrwxrwx   1 noone    nogroup         0 Sep 01 06:22 new
    -rwxrwxrwx   1 noone    nogroup       225 Sep 01 06:55 pub
    drwxrwxrwx   1 noone    nogroup         0 Sep 02 06:30 new1
    

    # Rename directory new1 to new2 and verify the result.

    sftp-client> rename new1 new2
    File successfully renamed
    sftp-client> dir
    -rwxrwxrwx   1 noone    nogroup      1759 Aug 23 06:52 config.cfg
    -rwxrwxrwx   1 noone    nogroup       225 Aug 24 08:01 pubkey2
    -rwxrwxrwx   1 noone    nogroup       283 Aug 24 07:39 pubkey
    drwxrwxrwx   1 noone    nogroup         0 Sep 01 06:22 new
    -rwxrwxrwx   1 noone    nogroup       225 Sep 01 06:55 pub
    drwxrwxrwx   1 noone    nogroup         0 Sep 02 06:33 new2
    

    # Download the pubkey2 file from the server and save it as local file public.

    sftp-client> get pubkey2 public
    Remote  file:/pubkey2 --->  Local file: public
    Downloading file successfully ended
    

    # Upload the local file pu to the server, save it as puk, and verify the result.

    sftp-client> put pu puk
    Local file:pu --->  Remote file: /puk
    Uploading file successfully ended
    sftp-client> dir
    -rwxrwxrwx   1 noone    nogroup      1759 Aug 23 06:52 config.cfg
    -rwxrwxrwx   1 noone    nogroup       225 Aug 24 08:01 pubkey2
    -rwxrwxrwx   1 noone    nogroup       283 Aug 24 07:39 pubkey
    drwxrwxrwx   1 noone    nogroup         0 Sep 01 06:22 new
    drwxrwxrwx   1 noone    nogroup         0 Sep 02 06:33 new2
    -rwxrwxrwx   1 noone    nogroup       283 Sep 02 06:35 pub
    -rwxrwxrwx   1 noone    nogroup       283 Sep 02 06:36 puk
    sftp-client>
    

    # Exit SFTP client view.

    sftp-client> quit
    Bye
    Connection closed.
    <SwitchA>