29
DarkStar User Guide
3: Software
www.xkl.com
3.2.5.3 SSH Access
A DarkStar system supports both SSH and telnet remote console access. SSH can add additional security protection.
Customers that have isolated and protected their DarkStar management network sufficiently find that telnet is acceptable for
day-to-day use. Both SSH and telnet can be configured upon first boot of the DarkStar system; setup is similar in each case.
A DarkStar system ships with the necessary SSH public and private keys pre-installed in its file system, and boots initially with
SSH remote console access disabled. To enable SSH on a vty console line, ensure that the line already has a password (use the
password
command), enable remote login (use the
login
command), and configure SSH as a transport type (use the
transport input ssh
command).
The following example illustrates how to configure remote SSH access to all configured Ethernet ports:
localhost>
enable
localhost#
configure
localhost CONF#
line vty
localhost CONF-LINE-VTY#
password
new password
localhost CONF-LINE-VTY#
login
localhost CONF-LINE-VTY#
transport input ssh
localhost CONF-LINE-VTY#
end
localhost#
write memory
Are you sure? [yes/no]
yes
localhost#
SSH hostkeys are used for SSH authentication. The authentication credentials are handled silently by the DarkStar system. SSH
console clients, whatever their platform, do not require additional SSH key generation or management to access the DarkStar
system. On first console access, an SSH client will ask the console operator to confirm the SSH access request; subsequent SSH
console access requests authenticate silently.
3.2.5.4 SSH Key Replacement
A DarkStar system ships with SSH keys already in place. To replace the DarkStar SSH keys, you must generate new SSH keys and
transfer them to the DarkStar system. The new SSH keys become activated at the next reload of DXMOS.
A DarkStar system stores its SSH keys in its file system. The public and private keys are referred to by their well-known names
"
hostkey-public
" and "
hostkey-private
"; the actual filenames in the DarkStar file system are "
/dxmos/hostkey-
public.dat
" and "
/dxmos/hostkey-private.dat
".
You can generate new SSH keys using any keygen utility that can create DSA key pairs for the SSH v2 protocol. The DarkStar
does not support RSA key pairs. Instructions for how to generate keys will vary by platform. For example, the keygen utility for
Linux is ssh-keygen, and similar tools exist for other platforms.
You must activate your new SSH keys by reloading DXMOS via a
reload
command. This forces a warm boot of the DarkStar
operating system, without disturbing existing traffic, and activates your new SSH keys. At the first ssh access request after the
reload, each client detects the change in the DarkStar keys and asks the console operator to take action, for example by
verifying that access is required or by confirming that the previously saved SSH public key should be removed. Subsequent ssh
access requests negotiate silently, as before.
The following example illustrates how to copy SSH keys to a DarkStar system:
localhost>
enable
localhost#
tftp get 10.15.1.98 id_dsa hostkey-private
Are you sure? [yes/no]
yes
