Users Guide

NOTE: RSA1 and DSA keys are not supported on the OS10 SSH server.
An SSH client must exchange the same public key to establish a secure SSH connection to the OS10 switch. If necessary, you
can regenerate the keys used by the SSH server with a customized bit size. You cannot change the default size of the Ed25519
key. The crypto key generate command is available only to the sysadmin and secadmin roles.
1. Regenerate keys for the SSH server in EXEC mode.
crypto ssh-key generate {rsa {2048|3072|4096} | ecdsa {256|384|521} | ed25519}
2. Enter yes at the prompt to overwrite an existing key.
Host key already exists. Overwrite [confirm yes/no]:yes
Generated 2048-bit RSA key
3. Display the SSH public keys in EXEC mode.
show crypto ssh-key
After you regenerate SSH public keys, disable and re-enable the SSH server to use the new public keys. Restarting the SSH
server does not impact current OS10 sessions.
RESTCONF API
RESTCONF API allows to configure and monitor an OS10 switch using HTTP with the Transport Layer Security (TLS) protocol.
For more information about RESTCONF API, see RESTCONF API.
Restrict SNMP access
To filter SNMP requests on the switch, assign access lists to an SNMP community. Both IPv4 and IPv6 access lists are
supported.
These points are applicable when you assign an ACL to an SNMP community:
● By default, SNMP requests from all hosts are allowed.
● You can only apply permit ACL rues to an SNMP community. deny ACL rules do not take effect if you apply them.
● To permit SNMP requests for multiple hosts, apply individual permit ACL rules for hosts or prefixes.
● Applying ACL rules for an SNMP community in a nondefault VRF is not supported.
1. Create access lists with permit or deny filters; for example:
OS10(config)# ip access-list snmp-read-only-acl
OS10(config-ipv4-acl)# permit ip 172.16.0.0 255.255.0.0 any
OS10(config-ipv4-acl)# exit
OS10(config)#
2. Apply ACLs to an SNMP community in CONFIGURATION mode.
OS10(config)# snmp-server community public ro acl snmp-read-only-acl
View SNMP ACL configuration
OS10# show snmp community
Community : public
Access : read-only
ACL : snmp-read-only-acl
Limit concurrent login sessions
To avoid an unlimited number of active sessions on a switch for the same user ID, limit the number of console and remote
connections. Log in from a console connection by cabling a terminal emulator to the console serial port on the switch. Log in to
the switch remotely through a virtual terminal line, such as Telnet and SSH.
Security
1343