Wired Intelligent Edge

last person joined: 12 hours ago 

Bring performance and reliability to your network with the HPE Aruba Networking Core, Aggregation, and Access layer switches. Discuss the latest features and functionality of your switching devices, and find ways to improve security across your network to bring together a mobile-first solution
Back to discussions
Expand all | Collapse all

Switch login via SSH with no credentials

This thread has been viewed 6 times

  • 1.  Switch login via SSH with no credentials

    Posted Jun 24, 2020 10:11 AM

    I have a couple switches that allow logins to a read-only mode by using SSH with no credentials.

     

    How can I disable this via CLI?



  • 2.  RE: Switch login via SSH with no credentials

    Posted Jun 24, 2020 12:06 PM

    config t

    aaa authentication ssh login local (to use local account to login)

    aaa authentication ssh login tacacs local (to use tacacs and if tacacs not available, use local account)

     

    You also need to set the login privilege for the local account 

     



  • 3.  RE: Switch login via SSH with no credentials

    Posted Jun 26, 2020 08:36 AM

    Thanks for the info. It looks like "aaa authentication ssh login local" is the default state because it does not show up in the configuration when I do "show run."

    I looked at a few different resources but could not figure out how I could set local account login privileges to keep someone from being able to log into the switch with no credentials.



  • 4.  RE: Switch login via SSH with no credentials

    EMPLOYEE
    Posted Jun 26, 2020 08:58 AM

    Please see the security guide here:  https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-a00061590en_us

     

     

     

     



  • 5.  RE: Switch login via SSH with no credentials
    Best Answer

    Posted Jun 29, 2020 09:58 AM

    For anyone else having this problem, it was resolved for me by adding a password to the builtin "operator" account.  There are likely other ways to address this issue, but this one worked for me.