HP VPN Firewall Appliances System Management and Maintenance Configuration Guide

168
Sta
g
es Descri
p
tion
Algorithm negotiation
SSH supports multiple algorithms. Based on the local algorithms, the two parties
determine the key exchange algorithm for generating session keys, the encryption
algorithm for encrypting data, public key algorithm for digital signature and
authentication, and the HMAC algorithm for protecting data integrity.
Key exchange
The two parties use the Diffie-Hellman (DH) exchange algorithm to dynamically
generate the session key for protecting data transfer and the session ID for identifying
the SSH connection. In this stage, the client authenticates the server as well.
Authentication
The SSH server authenticates the client in response to the client's authentication
request.
Session request
After passing authentication, the client sends a session request to the server to request
the establishment of a session (Stelnet, SFTP, or SCP).
Interaction
After the server grants the request, the client and the server start to communicate with
each other in the session.
In the interaction stage, you can execute commands from the client by pasting the
commands in text format (the text must be within 2000 bytes). The commands must be
available in the same view. Otherwise, the server might not be able to execute the
commands correctly.
If you want to execute commands of more than 2000 bytes, you can save the
commands in a configuration file, upload it to the server through SFTP, and use it to
restart the server.
SSH authentication
When the device acts as an SSH server, it supports the following authentication methods:
• Password authentication—The SSH server uses AAA for authentication of the client. During
password authentication, the SSH client encrypts its username and password, encapsulates them
into an authentication request, and sends the request to the server. After receiving the request, the
SSH server decrypts the request to get the username and password in plain text, checks the validity
of the username and password locally or by a remote AAA server, and then informs the client of the
authentication result.
In a password authentication process, if the remote AAA server requires the user for a secondary
password authentication, it sends the SSH server an authentication response with a prompt. The
prompt is transparently transmitted to the client, and displayed on the client to notify the user to
enter the specified password. After the user enters the correct password and passes validity check
by the remote AAA server, the device returns an authentication success message to the client.
NOTE:
Only clients that run SSH2 or a later version support secondary password authentication that is
initiated by the AAA server.
• Publickey authentication—The server authenticates the client by the digital signature. During
publickey authentication, the client sends the server a publickey authentication request that contains
the following information:
{ Username.
{ Public key of the client.
{ Publickey algorithm information (or the digital certificate that carries the public key information).