SSH Parameters

Secure Shell (SSH) parameters are described in the table below.

SSH Parameters

Parameter

Description

'Enable SSH Server'

configure system > cli-settings > ssh

[SSHServerEnable]

Enables the device's embedded SSH server.

■ [0] Check box cleared o = Disabled.
■ [1] Check box selected þ = (Default) Enabled.

'Public Key'

configure system > cli-settings > ssh-require-public-key

[SSHRequirePublicKey]

Enables RSA or ECDSA public keys for SSH.

■ [0] Check box cleared o = (Default) Disabled. RSA or ECDSA public keys are optional if a public key is configured.
■ [1] Check box selected þ = Enabled. RSA or ECDSA public keys are mandatory.

Note:

■ Public keys are configured per management user in the Local Users table (see Configuring Local Management User Accounts).
■ To configure the key size, use the [TLSPkeySize] parameter.

'Max Payload Size'

ssh-max-payload-size

[SSHMaxPayloadSize]

Defines the maximum uncompressed payload size (in bytes) for SSH packets.

The valid value is 550 to 32768. The default is 32768.

'Max Binary Packet Size'

configure system > cli-settings > ssh-max-binary-packet-size

[SSHMaxBinaryPacketSize]

Defines the maximum packet size (in bytes) for SSH packets.

The valid value is 582 to 35000. The default is 35000.

'Maximum SSH Sessions'

configure system > cli-settings > ssh-max-sessions

[SSHMaxSessions]

Defines the maximum number of simultaneous SSH sessions.

The valid range is 1 to 5. The default 5.

'Enable Last Login Message'

configure system > cli-settings > ssh-last-login-message

[SSHEnableLastLoginMessage]

Enables message display in SSH sessions of the time and date of the last SSH login. The message displays the number of unsuccessful login attempts since the last successful login.

■ [0] Check box cleared o = Disabled.
■ [1] Check box selected þ = (Default) Enabled.

Note: The last SSH login information is cleared when the device restarts.

'Max Login Attempts

configure system > cli-settings > ssh-max-login-attempts

[SSHMaxLoginAttempts]

Defines the maximum SSH login attempts allowed for entering an incorrect password by an administrator before the SSH session is rejected.

The valid range is 1 to 5. The default is 3.

Note: The new setting takes effect only for new subsequent SSH connections.

'Kex Algorithms String'

configure system > cli-settings > ssh-kex-algorithms-string

[SSHKexAlgorithmsString]

Defines the SSH Key Exchange Algorithms.

The valid values include:

■ diffie-hellman-group-exchange-sha256
■ diffie-hellman-group14-sha1
■ diffie-hellman-group1-sha1
■ diffie-hellman-group14-sha256
■ diffie-hellman-group16-sha512
■ ecdh-sha2-nistp256
■ ecdh-sha2-nistp384
■ ecdh-sha2-nistp521
■ curve25519-sha256

To configure the parameter with multiple values, use the colon (:) as a separator between each value. For example, diffie-hellman-group1-sha1:diffie-hellman-group-exchange-sha256.

The default is curve25519-sha256:ecdh-sha2-nistp256:ecdh-sha2-nistp384:ecdh-sha2-nistp521:diffie-hellman-group-exchange-sha256:diffie-hellman-group16-sha512:diffie-hellman-group14-sha256:diffie-hellman-group14-sha1.

Note: If you're configuring this parameter in the ini file, enclose the entire string in single quotation marks (e.g., 'diffie-hellman-group1-sha1:diffie-hellman-group-exchange-sha256').

'Ciphers String'

configure system > cli-settings > ssh-ciphers-string

[SSHCiphersString]

Defines the SSH cipher string.

The valid values include:

■ aes128-ctr
■ aes128-cbc
■ aes256-ctr
■ aes256-cbc

To configure the parameter with multiple values, use the colon (:) as a separator between each value. For example, aes128-ctr:aes128-cbc.

The default is aes128-ctr:aes128-cbc.

Note: If you're configuring this parameter in the ini file, enclose the entire string in single quotation marks (e.g., 'aes128-ctr:aes128-cbc').

'MACs String'

configure system > cli-settings > ssh-macs-string

[SSHMACsString]

Defines the SSH MAC algorithms.

The valid values include:

■ hmac-sha1
■ hmac-sha2-256

To configure the parameter with both values, use the colon (:) as a separator between each value (e.g., hmac-sha1:hmac-sha2-256).

The default is hmac-sha1:hmac-sha2-256.

Note: If you're configuring this parameter in the ini file, enclose the entire string in single quotation marks (e.g., 'hmac-sha1:hmac-sha2-256').

'Host Key Algorithms String'

configure system > cli-settings > ssh-host-key-algs-string

[SSHHostKeyAlgorithmsString]

Defines a list of allowed cryptographic algorithms that the device can use to generate and present its SSH host key during the SSH connection setup with an SSH client to establish a CLI session.

When an SSH client connects to the device (which acts as the SSH server), the device presents its host key to authenticate itself. During the SSH handshake, the client and device exchange their supported host key algorithms. The device then selects the algorithm based on the following rules:

■ The algorithm must appear in the client’s preference list.
■ The algorithm must also appear in the device’s allowed list (this parameter).
■ The algorithm must be compatible with the installed private key type (RSA or ECDSA).

The device selects the first client-preferred algorithm that meets all these conditions. If no compatible algorithm exists, the device rejects the SSH connection.

The valid values (supported algorithms) include:

■ rsa-sha2-256
■ rsa-sha2-512
■ ecdsa-sha2-nistp256
■ ecdsa-sha2-nistp384
■ ecdsa-sha2-nistp521
■ ssh-rsa

The default value is: rsa-sha2-256:rsa-sha2-512:ecdsa-sha2-nistp256:ecdsa-sha2-nistp384:ecdsa-sha2-nistp521:ssh-rsa

To configure multiple algorithms, separate the values with a colon (:). For example: ecdsa-sha2-nistp256:ecdsa-sha2-nistp384

Note: When you configure this parameter in an ini file, enclose the entire value in single quotation marks (e.g., 'ecdsa-sha2-nistp256:ecdsa-sha2-nistp384').