华为SSH实验
实验拓扑：
实验要求：从SSH客户端AR1采用stelnet方式登录到SSH 服务器端。
实验步骤：
1.完成基本配置（略）
sys
Enter system view, return user view with Ctrl+Z.
AR1sys CLIENT
CLIENTINT g0/0/0
CLIENT-GigabitEthernet0/0/0ip add 10.1.1.2 24
sys
Enter system view, return user view with Ctrl+Z.
AR4sys SERVER
SERVERINT g0/0/0
SERVER-GigabitEthernet0/0/0ip add 10.1.1.2 24
2.在server端配置安全密钥对
SERVERrsa local-key-pair create
The key name will be: Host
% RSA keys defined for Host already exist.
Confirm to replace them? (y/n)n:y
The range of public key size is (512 ~ 2048).
NOTES: If the key modulus is greater than 512,
It will take a few minutes.
Input the bits in the modulusdefault = 512:512
Generating keys...
...++++++++++++
...++++++++++++
...++++++++
...++++++++
SERVER
SERVERdis rsa local-key-pair public 在服务器端查看刚刚配置的公钥
3.在服务器端创建VTY服务
SERVERuser-interface vty 0 4 启用VTY服务
SERVER-ui-vty0-4authentication-mode aaa 认证模式采用AAA
SERVER-ui-vty0-4protocol inbound ssh 定义流量（从外面进来的流量是ssh)
SERVER-ui-vty0-4q
4.在服务端配置AAA服务
SERVERaaa 启用AAA服务
SERVER-aaalocal-user zyh password cipher huawei 配置本地用户zyh密码是huawei
SERVER-aaalocal-user zyh service-type ssh 用户zyh服务类型是ssh
SERVER-aaalocal-user zyh privilege level 3 用户zyh的运行级别是三级
SERVER-aaaq
5.在服务端配置SSH用户的访问认证方式并启用stelnet服务
SERVERssh user zyh authentication-type password
Authentication type setted, and will be in effect next time
SERVERstelnet server enable 系统默认该服务是关闭的所以使用时候需要开启
6.配置客户端
sys
CLIENTssh client first-time enable 把客户端首次使用SSH开启
7.进行测试
CLIENTstelnet 10.1.1.2
Please input the username:zyh
Trying 10.1.1.2 ...
Press CTRL+K to abort
Connected to 10.1.1.2 ...
The server is not authenticated. Continue to access it? (y/n)n:y
Save the server's public key? (y/n)n:y
The server's public key will be saved with the name 10.1.1.2. Please wait...
Enter password:
采用SSH服务安全登录到远程服务端设备，实验成功。
小结：采用stelnet登录目标设备的配置虽有有点繁琐，但安全性却有了极大的提升，特别是密钥对的强度选择和SSH协议的配合使用，安全有了很大的保证。