Fips Compliance; Configuring The Device As An Ssh Server; Ssh Server Configuration Task List; Generating Local Key Pairs - HP FlexNetwork 10500 Series Security Configuration Manual

FIPS compliance

The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for
features, commands, and parameters might differ in FIPS mode and non-FIPS mode. For more
information about FIPS mode, see

Configuring the device as an SSH server

SSH server configuration task list

Tasks at a glance
(Required.)
(Required.)
(Required.)
(Required.) Enabling the SCP server
(Required.)
(Required.)
(Required.)
Configuring the PKI domain for verifying the client's
digital certificate
(Required/optional.)
(Optional.) Configuring the SSH management
parameters
(Optional.) Specifying a PKI domain for the SSH server

Generating local key pairs

The DSA, RSA, or ECDSA key pairs are required for generating the session keys and session ID in
the key exchange stage. They can also be used by a client to authenticate the server. When a client
authenticates the server, it compares the public key received from the server with the server's public
key that the client saved locally. If the keys are consistent, the client uses the locally saved server's
public key to decrypt the digital signature received from the server. If the decryption succeeds, the
server passes the authentication.
Configuration guidelines
When you generate local key pairs, follow these restrictions and guidelines:
Generating local key pairs
Enabling the Stelnet server
Enabling the SFTP server
Enabling NETCONF over SSH
Configuring the user lines for SSH login
Configuring a client's host public key
Configuring an SSH user
"Configuring FIPS."
Remarks
N/A
Required for Stelnet servers.
Required for SFTP servers.
Required for SCP servers.
Required for NETCONF-over-SSH servers.
Required for Stelnet servers and
NETCONF-over-SSH servers.
Required if the authentication method is
publickey, password-publickey, or any.
See
Required if the following conditions exist:
•
•
The PKI domain must have the CA certificate to
verify the client's digital certificate.
Required if the authentication method is
publickey, password-publickey, or any.
Optional if the authentication method is
password.
N/A
N/A
359
"Configuring PKI."
The authentication method is publickey.
The client sends its public keys to the server
through a digital certificate for validity check.