Administrator Guide

Authentication, Authorization, and Accounting 273
This authentication method is not implemented by Dell EMC Networking
N-Series switches. Use the Management ACL capability to perform the
equivalent function.
Public key authentication operates as follows:
The administrator first generates a pair of encryption keys, the “public” key
and the “private” key. Messages encrypted with the private key can be
decrypted only by the public key, and vice-versa. The administrator keeps the
private key on his/her local machine, and loads the public key on to the
switch. When the administrator attempts to log into the switch, the protocol
sends a brief message, encrypted with the public key. If the switch can decrypt
the message (and can send back some proof that it has done so) then the
response proves that switch must possess the public key, and user is
authenticated without giving a username/password.
The public key method is implemented in the Dell EMC Networking
N-Series switch as opposed to an external server. If the user does not present a
certificate, it is not considered an error, and authentication will continue with
challenge-response authentication.
Challenge-response authentication works as follows:
The switch sends an arbitrary “challenge” text and prompts for a response.
SSH-2 allows multiple challenges and responses; SSH-1 is restricted to one
challenge/response only. Examples of challenge-response authentication
include BSD Authentication.
Finally, if all other authentication methods fail, SSH prompts the user for a
password.
Enabling SSH Access
The following example enables the switch to be accessed using SSH. If RSA
or DSA keys exist, the switch will prompt to overwrite the keys as shown
below. The RSA and DSA keys are used to negotiate the symmetric
encryption algorithm used for the SSH session.
console(config)#crypto key generate rsa
Do you want to overwrite the existing RSA keys? (y/n):y
RSA key generation started, this may take a few minutes...
RSA key generation complete.
console(config)#crypto key generate dsa
Do you want to overwrite the existing DSA keys? (y/n):y
DSA key generation started, this may take a few minutes...