close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Overview
play_arrow Configuring Administrative Credentials and Privileges
- Understanding the Associated Password Rules for an Authorized Administrator
- Configuring a Common Criteria Authorized Administrator
play_arrow Configuring Network Time Protocol
- Configuring Network Time Protocol
play_arrow Configuring Roles and Authentication Methods
play_arrow Configuring SSH and Console Connection
play_arrow Configuring the Remote Syslog Server
- Sample Syslog Server Configuration on a Linux System
play_arrow Configuring Audit Log Options
- Configuring Audit Log Options in the Evaluated Configuration
- Sample Code Audits of Configuration Changes
play_arrow Configuring Event Logging
play_arrow Configuring VPNs
- Configuring VPN on a Device Running Junos OS
play_arrow Configuring Security Flow Policies
- Understanding a Security Flow Policy on a Device Running Junos OS
play_arrow Configuring Traffic Filtering Rules
play_arrow Configuring Network Attacks
play_arrow Configuring the IDP Extended Package
- IDP Extended Package Configuration Overview
play_arrow Configuring Cluster Mode
play_arrow Performing Self-Tests on a Device
- Understanding FIPS Self-Tests
play_arrow Configuration Statements
play_arrow Junos-FIPS Configuration Restrictions

list Table of Contents

English

keyboard_arrow_right

Configuring SSH on the Evaluated Configuration

date_range 05-Dec-23

arrow_backward

arrow_forward

SSH is an allowed remote management interface in the evaluated configuration. This topic describes how to configure SSH on the device.

Before you begin, log in with your root account on the device running Junos OS Release 22.2R2 and edit the configuration.

Note:

The commands shown configure SSH to use all of the allowed cryptographic algorithms.

Note:

You can enter the configuration commands in any order and commit all the commands at once.

To configure SSH on the TOE:

Specify the permissible SSH host-key algorithms.
```
[edit system services ssh]
user@host# set hostkey-algorithm ssh-ecdsa
```
Note:
For Common Criteria compliance, use below host key algorithms : ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, and ecdsa-sha2-nistp521.
Specify the command to disable rsa-sha2-512 and rsa-sha2-256 hostkey algorithms.
```
[edit system services ssh] 
user@host# set hostkey-algorithm no-ssh-rsa 
```
Note: The set system services ssh hostkey-algorithm no-ssh-rsa command will disable the rsa-sha2-512, rsa-sha2-256, and ssh-rsa hostkey algorithms.

Specify the SSH key-exchange algorithms.

content_copy zoom_out_map
[edit system services ssh]
user@host#set key-exchange [ ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 Diffie-hellman-group14-sha1 ]

Specify all the permissible message authentication code algorithms.

content_copy zoom_out_map
[edit system services ssh]
user@host#set macs [ hmac-sha1 hmac-sha2-256 hmac-sha2-512 ] 

Specify the ciphers allowed for protocol version 2.

content_copy zoom_out_map
[edit system services ssh]
user@host#set ciphers [ aes128-cbc aes128-ctr aes192-cbc aes192-ctr aes256-cbc aes256-ctr ]

(Optional step) Specify the number of minutes or maximum amount of data, before a rekey is forced on a session. The time limit must not be set greater than one hour and the data limit must not be set greater than one gigabyte.
```
[edit system services ssh]
user@host#set rekey time-limit minutes
user@host#set rekey data-limit bytes
```

arrow_backward PREVIOUS Limiting the Number of User Login Attempts for SSH Sessions

NEXT arrow_forward Sample Syslog Server Configuration on a Linux System

Common Criteria Guide for vSRX3.0

Configuring SSH on the Evaluated Configuration

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Common Criteria Guide for vSRX3.0

Configuring SSH on the Evaluated Configuration

Related Documentation

Stay in touch