Markii hore, waxaan wax ka qoray sida aad awood ugu yeelan karto gelitaanka SSH ee beddelkaaga Cisco^{(how you can enable SSH access to your Cisco switch)} adoo awood u siinaya goobta GUI interface. Tani waa wax aad u fiican haddii aad rabto inaad gasho beddelkaaga CLI xiriir qarsoodi ah, laakiin wali waxay ku tiirsan tahay kaliya isticmaale-magaca iyo erayga sirta ah.

Haddii aad ku isticmaaleyso furahaan shabakad aad xasaasi u ah una baahan inuu ahaado mid aad ammaan u ah, markaas waxaa laga yaabaa inaad tixgeliso inaad awood u yeelatid aqoonsiga furaha dadweynaha ee xiriirkaaga SSH . Dhab ahaantii, si loo helo badbaadada ugu badan, waxaad awood u siin kartaa isticmaalaha/passwordka iyo aqoonsiga furaha dadweynaha si loo galo beddelkaaga.

Maqaalkan, waxaan ku tusi doonaa sida loo suurtageliyo aqoonsiga furaha dadweynaha ee SG300 Cisco iyo sida loo abuuro lammaanaha furaha dadweynaha iyo kuwa gaarka ah iyadoo la adeegsanayo putTTYGen. Waxaan markaas ku tusi doonaa sida loo galo adiga oo isticmaalaya furayaasha cusub. Intaa waxaa dheer, waxaan ku tusi doonaa sida loo habeeyo si aad midkood u isticmaali karto furaha kaliya si aad u gasho ama aad ugu qasabto isticmaalaha inuu ku qoro magaca isticmaalaha/passwordka oo uu la socdo furaha gaarka ah.

Fiiro gaar ah: Kahor intaadan bilaabin casharkan, iska hubi inaad mar hore karti u siisay adeegga SSH ee furaha, kaas oo aan ku sheegay maqaalkeygii hore ee kor kuxiran. ^{(Note: Before you get started on this tutorial, make sure you have already enabled the SSH service on the switch, which I mentioned in my previous article linked above. )}

Daar geli Xaqiijinta Isticmaalaha SSH^{(SSH User Authentication)} ee Furaha Dadweynaha^{(Public Key)}

Guud ahaan, habka lagu helo aqoonsiga furaha dadweynaha si loogu shaqeeyo SSH waa mid toos ah. Tusaalahayga, waxaan ku tusi doonaa sida aad awood ugu yeelan karto sifooyinka adoo isticmaalaya GUI -ku-salaysan mareegaha . Waxaan isku dayay inaan isticmaalo interface-ka CLI si aan awood ugu yeesho xaqiijinta furaha dadweynaha, laakiin ma aqbali doono qaabka furaha RSA -ga gaarka ah.

Markaan helo shaqadaas, waxaan ku cusboonaysiin doonaa boostada amarrada CLI ee fulin doona waxa aan ku samayn doono GUI hadda. Marka hore^(First) dhagsii Security , ka dib SSH Server iyo ugu dambayntii aqoonsiga isticmaale SSH^{( SSH User Authentication)} .

Shaxda gacanta midig, horay u soco oo calaamadee sanduuqa karti u leh ee ku xiga Xaqiijinta Isticmaalaha SSH ee Furaha Dadweynaha^{( Enable box next to SSH User Authentication by Public Key)} . Guji badhanka Codso^(Apply) si aad u badbaadiso isbeddellada. Ha^(Don) hubin badhanka karti^(Enable) u leh ee ku xiga si toos ah u gelid^{(Automatic login)} si toos ah wali markaan hoos u sii sharaxi doono.

Hadda waa inaan ku darnaa magaca isticmaalaha SSH . Kahor inta aynaan galin ku darida isticmaalaha, marka hore waa inaan abuurnaa fure guud iyo mid gaar ah. Tusaalahan, waxaan u adeegsan doonaa puttyGen, oo ah barnaamij la socda puTTY.

Samee furayaal gaar ah iyo kuwa guud

Si loo dhaliyo furayaasha, horay u soco oo fur putTTYGen marka hore. Waxaad arki doontaa shaashad maran oo runtii maaha inaad ka bedesho mid ka mid ah habaynnada hoos ku xusan.

Guji batoonka abuur ka dibna u dhaqaaq jiirkaaga^(Generate) agagaarka aagga banaan ilaa bar horuumarku ka gudbo.

Marka furayaasha la soo saaro, waxaad u baahan tahay inaad ku qorto erayga sirta ah, kaas oo asal ahaan u ah sida erayga sirta ah ee lagu furo furaha.

Waa fikrad wanaagsan in la isticmaalo erayga sirta ah ee dheer si aad furaha uga ilaaliso weerarrada xoogga ah. Marka aad ku qorto erayga sirta ah laba jeer, waa in aad gujisaa Keydi furaha dadweynaha^{(Save public key)} iyo Keydi badhanka furaha gaarka ah . ^{(Save private key)}Hubi in faylashan lagu kaydiyay meel aamin ah, gaar ahaan weel qarsoon oo nooc ka mid ah oo u baahan furaha sirta ah. Fiiri qoraalkayga addoo isticmaalaya VeraCrypt si aad u abuurto mug qarsoon^{(VeraCrypt to create an encrypted volume)} .

Kudar Isticmaale & Furaha

Hadda ku soo noqo Shaashadda  Xaqiijinta Isticmaalaha SSH ee aan markii hore saarnay. ^{( SSH User Authentication)}Halkan waa meesha aad ka dooran karto laba doorasho oo kala duwan. Marka hore, u tag Maamulka^{(Administration)} - Xisaabaadka Isticmaalaha^{( User Accounts)} si aad u aragto akoonnada aad hadda haysato si aad u gasho.

Sida aad arki karto, waxaan leeyahay hal akoon oo la yiraahdo akishore si aan u galo beddelkayga. Hadda^(Currently) , waxaan u isticmaali karaa akoonkan si aan u galo GUI -ku-salaysan mareegaha iyo CLI -ga . Dib ugu noqo^(Back) bogga Xaqiijinta Isticmaalaha SSH^{(SSH User Authentication)} , isticmaalaha aad u baahan tahay inaad ku darto Shaxda Xaqiijinta Isticmaalaha SSH (ee Furaha Dadweynaha)^{(SSH User Authentication Table (by Public Key))}  wuxuu noqon karaa mid la mid ah waxa aad ku leedahay Maamulka - Xisaabaadka Isticmaalaha^{(Administration – User Accounts)} ama ka duwan.

Haddii aad doorato isla magaca isticmaalaha, markaa waxaad hubin kartaa batoonka Enable ee ku yaal ^(Enable)Automatic Login oo markaad gasho furaha, waxaad si fudud u yeelan doontaa inaad ku qorto magaca isticmaalaha iyo erayga sirta ah ee furaha khaaska ah oo aad geli doonto .

Haddii aad go'aansato inaad doorato isticmaale kale oo ka duwan halkan, markaa waxaad heli doontaa degdeg ah halkaas oo aad geliso magaca isticmaalaha gaarka ah ee SSH iyo erayga sirta ah ka dibna waa inaad gelisaa isticmaalehaaga caadiga ah iyo eraygaaga sirta ah (oo ku hoos qoran Admin - Accounts User^{(Admin – User Accounts)} ) . Haddii aad rabto ammaan dheeri ah, isticmaal magac isticmaale oo ka duwan, haddii kale kaliya u magacow mid la mid ah kan aad hadda leedahay.

Riix^(Click) badhanka ku dar^(Add) oo waxaad heli doontaa daaqada Isticmaalaha SSH ku dar oo soo booda.^{(Add SSH User)}

Hubi in Nooca Furaha^{(Key Type)} loo dhigay RSA ka dibna horay u sii fur oo fur faylkaaga furaha ee SSH ee aad hore u kaydsatay adigoo isticmaalaya barnaamijka sida Notepad . Nuqul ka koobbi dhammaan waxa ku jira oo ku dheji daaqadda Furaha Dadweynaha . ^{(Public Key)}Guji Codso^(Apply) kadibna ku dhufo Close haddii aad hesho fariinta Success xagga sare.

Soo gal Adigoo isticmaalaya Furaha Gaarka ah

Hadda waxa kaliya ee ay tahay inaan sameyno waa galitaanka annaga oo adeegsanayna furahayaga gaarka ah iyo erayga sirta ah. Halkaa marka ay marayso, markaad isku daydo inaad gasho, waxaad u baahan doontaa inaad geliso aqoonsiga gelitaanka laba jeer: hal mar furaha gaarka ah iyo hal koontada caadiga ah ee isticmaale. Marka aan awoodno gelitaanka otomaatiga ah, kaliya waxaad u baahan doontaa inaad geliso magaca isticmaalaha iyo erayga sirta ah ee furaha gaarka ah oo waxaad geli doontaa.

Fur puTTY oo geli ciwaanka IP-ga ee beddelkaaga sanduuqa Magaca martida^{( Host Name)} sida caadiga ah. Si kastaba ha ahaatee, markan, waxaan u baahan doonaa inaan ku shubno furaha gaarka ah sidoo kale putTTY. Si tan loo sameeyo, balaadhi Connection , ka dibna balaadhi SSH ka dibna dhagsii Auth .

Guji badhanka Browse ee hoos yimaada ^(Browse)faylka gaarka ah si loo xaqiijiyo^{(Private key file for authentication)} oo dooro faylka gaarka ah ee aad hore uga badbaadisay putTTY. Hadda dhagsii badhanka Fur^(Open) si aad isugu xidho.

Dakhliga ugu horreeya wuxuu u gali doonaa sidii^{(login as)} oo taasi waa inay noqotaa magaca isticmaale ee aad ku dartay isticmaaleyaasha SSH . Haddii aad isticmaashay isla magacaaga isticmaale ee akoonkaaga isticmaale, markaa dhib ma yeelan doonto.

Kiiskeyga, waxaan u isticmaalay akishore labada akoonnada isticmaalaha, laakiin waxaan u adeegsaday furaha sirta ah ee kala duwan furaha gaarka ah iyo koontada isticmaaleheyga ugu weyn. Haddii aad jeceshahay, waxaad sidoo kale ka dhigi kartaa furaha sirta ah isku mid, laakiin ma jirto wax macno ah oo run ahaantii taas la sameeyo, gaar ahaan haddii aad awood u geliso si toos ah.

Hadda haddii aadan rabin inaad laba jeer gasho si aad u gasho furaha, calaamadi sanduuqa karti u leh ee ku xiga gal toos^{( Automatic login)} ah bogga Xaqiijinta ^(Enable)Isticmaalaha SSH^{(SSH User Authentication)} .

Marka tan la furo, waxa aad hadda ku qasbanaan doontaa in aad ku qorto aqoonsiga isticmaalaha SSH oo waa lagu gali doonaa.

Waa yara adagtahay, laakiin macno ayey samaynaysaa marka aad la ciyaarto. Sidii aan hore u soo sheegay, waxaan sidoo kale qori doonaa amarrada CLI marka aan helo furaha gaarka ah ee qaabka habboon. Iyadoo la raacayo tilmaamaha halkan, gelitaanka beddelka beddelka SSH waa inay noqotaa mid aad u ammaan badan hadda. Haddii aad la kulanto dhibaatooyin ama aad su'aalo qabto, ku dheji faallooyinka. Ku raaxayso!

Enable Public Key Authentication for SSH on Cisco SG300 Switches

Рreviouѕly, I wrote about how you can enable SSH access to your Cisco switch by enabling the setting in the GUI interface. This is great if you want to access your switch CLI over an encrypted connection, but it still relies on just a username and password.

If you are using this switch in a highly sensitive network that needs to be very secure, then you might want to consider enabling public key authentication for your SSH connection. Actually, for maximum security, you can enable a username/password and public key authentication for access to your switch.

In this article, I’ll show you how to enable public key authentication on an SG300 Cisco switch and how to generate the public and private key pairs using puTTYGen. I’ll then show you how to login using the new keys. In addition, I’ll show you how to configure it so that you can either use just the key to login or force the user to type in a username/password along with using the private key.

Note: Before you get started on this tutorial, make sure you have already enabled the SSH service on the switch, which I mentioned in my previous article linked above. 

Enable SSH User Authentication by Public Key

Overall, the process for getting public key authentication to work for SSH is straightforward. In my example, I’ll show you how to enable the features using the web-based GUI. I tried to use the CLI interface to enable public key authentication, but it would not accept the format for my private RSA key.

Once I get that working, I’ll update this post with the CLI commands that will accomplish what we will do through the GUI for now. First, click on Security, then SSH Server and finally SSH User Authentication.

In the right-hand pane, go ahead and check the Enable box next to SSH User Authentication by Public Key. Click the Apply button to save the changes. Don’t check the Enable button next to Automatic login just yet as I’ll explain that further down.

Now we have to add a SSH user name. Before we get into adding the user, we first have to generate a public and private key. In this example, we’ll be using puTTYGen, which is a program that comes with puTTY.

Generate Private and Public Keys

To generate the keys, go ahead and open puTTYGen first. You’ll see a blank screen and you really shouldn’t have to change any of the settings from the defaults shown below.

Click on the Generate button and then move your mouse around the blank area until the progress bar go all the way across.

Once the keys have been generated, you need to type in a passphrase, which is basically like a password to unlock the key.

It’s a good idea to use a long passphrase to protect the key from brute-force attacks. Once you have typed in the passphrase twice, you should click the Save public key and Save private key buttons. Make sure these files are saved in a secure location, preferably in an encrypted container of some sort that requires a password to open. Check out my post on using VeraCrypt to create an encrypted volume.

Add User & Key

Now back to the SSH User Authentication screen we were on earlier. Here’s where you can choose from two different options. Firstly, go to Administration – User Accounts to see what accounts you currently have for login.

As you can see, I have one account called akishore for accessing my switch. Currently, I can use this account to access the web-based GUI and the CLI. Back on the SSH User Authentication page, the user you need to add to the SSH User Authentication Table (by Public Key) can either be the same as what you have under Administration – User Accounts or different.

If you choose the same user name, then you can check the Enable button under Automatic Login and when you go to log into the switch, you’ll simply have to type the username and password for the private key and you’ll be logged in.

If you decide to choose a different username here, then you will get a prompt where you have to enter the SSH private key user name and password and then you’ll have to enter your normal username and password (listed under Admin – User Accounts). If you want the extra security, use a different username, otherwise just name it the same as your current one.

Click the Add button and you’ll get the Add SSH User window pop up.

Make sure the Key Type is set to RSA and then go ahead and open your public SSH key file that you saved earlier using a program like Notepad. Copy the entire contents and paste it into the Public Key window. Click Apply and then click Close if you get a Success message at the top.

Login Using Private Key

Now all we have to do is login using our private key and password. At this point, when you try to login, you’ll need to enter login credentials twice: once for the private key and once for the normal user account. Once we enable automatic login, you’ll just have to enter the username and password for the private key and you’ll be in.

Open puTTY and enter in the IP address of your switch in the Host Name box as usual. However, this time, we’ll need to load up the private key into puTTY also. To do this, expand Connection, then expand SSH and then click on Auth.

Click on the Browse button under Private key file for authentication and select the private key file you saved out of puTTY earlier. Now click the Open button to connect.

The first prompt will be login as and that should be the username you added under SSH users. If you used the same username as your main user account, then it won’t matter.

In my case, I used akishore for both user accounts, but I used different passwords for the private key and for my main user account. If you like, you can make the passwords the same too, but there’s no point in really doing that, especially if you enable automatic login.

Now if you don’t want to have to double login to get into the switch, check the Enable box next to Automatic login on the SSH User Authentication page.

When this is enabled, you’ll now just have to type in the credentials for the SSH user and you’ll be logged in.

It’s a bit complicated, but makes sense once you play around with it. Like I mentioned earlier, I’ll also write out the CLI commands once I can get the private key in the proper format. Following the instructions here, accessing your switch via SSH should be a lot more secure now. If you run into problems or have questions, post in the comments. Enjoy!

Related posts

• Sida loo sahlo gelitaanka SSH ee Cisco SG300 Switches

• Sida loo damiyo Furaha Daaqadaha

• Sida SSH ama SFTP loogu geliyo Raspberry Pi kaaga

• Sida loo sahlo Xaqiijinta Ilaalada Steam

• Soo celi furahaaga Amniga Shabakadda Wireless-ka ee Daaqadaha

• Sida loo soo dejiyo Google Chrome Offline (Standalone) Rakibaye

• Sida Sawirada WEBP loogu beddelo JPG, GIF, ama PNG

• Dib-u-eegis Buugaag - Hagaha sida-Geek-ga loo barto ee Windows 8

• Isticmaalka Interface Web Gudbinta

• Demi Koontaroolada Koontada Isticmaalaha (UAC) ee Codsi Gaar ah

• Isticmaal Netstat si aad u aragto Dekadaha Dhageysiga iyo PID gudaha Windows

• Sida Loo Arkiyo Bogagga Cajiska Ah Iyo Faylasha Ka Soo Baxa Browserkaaga

• 7 Farsamo Farsamo Kobcinta SEO ee Mareegaha Kasta

• Sida loo furo File quful marka barnaamij kale la isticmaalayo

• Sida Loo Ilaaliyo PC-gaaga Daaqadaha Adigoon taaban Jiirka

• Sida loo furo faylasha DDS gudaha Windows 10

• Sida Loo Sameeyo Foomka Dukumentiga Google-ka La Buuxin Karo

• 8 ka mid ah Fikradaha Farsamada ugu Fiican ee lagula tacaali karo Go'doominta

• Sida Loo Bedelo Kumbuyuutarkaaga Server-ka Warbaahinta DLNA

• Xakameyn gelitaanka Sisiko beddelka iyadoo ku saleysan cinwaanka IP-ga