Configuring Security Settings > Configuring Remote Login

Configuring Remote Login

From the NMC-RX application, you can log in to routers remotely through Telnet or SSH. The selection of either Telnet or SSH is an NMC-RX application-wide setting and is accessible only to users with security privileges. Although the NMC-RX application automatically defaults to Telnet, SSH is considered a more secure alternative to Telnet for logging in to routers remotely.

Because there are a variety of SSH products and implementations, the NMC-RX application provides administrators with the flexibility to specify the desired command line and options for their SSH implementation. Administrators can specify the relationship between an individual NMC-RX user and an SSH session.

If you select SSH as your remote login choice, you must:

• Configure SSH on your router. For more information, see JUNOSe System Basics Configuration Guide, Chapter 6, Passwords and Security.
• Determine your Telnet policy before you configure SSH on your router. Effective use of SSH implies that you severely limit Telnet access to the system.
• Obtain and install a commercial SSH client on the same machine on which you are running the NMC-RX application.
• Install and configure a RADIUS server on a host machine before you configure SSH on your router. Refer to your RADIUS server documentation for information about choosing a host machine and installing the server hardware.
• Configure the RADIUS client on your E-series router. To configure RADIUS through the NMC-RX application, see Configuring RADIUS Servers in NMC-RX User Guide, Vol. 2, Chapter 3, Configuring Virtual Routers. For additional information about RADIUS, see the JUNOSe Broadband Access Configuration Guide.

This section provides procedures for the three tasks that are associated with configuring remote login:

• Set the SSH username source in the Create User Profile dialog box.
• Set the remote login settings.
• Test the remote login action that you specify.

Setting SSH Username Source

When SSH is the remote login type, users with security privileges must set this field to assign every user a username source for remote logins.

To set an SSH username source:

1. From the Configuration menu in either the Network Workshop or the Device Workshop, select Create, and click User Profiles.

The Create User Profile dialog box appears.

2. Set the parameters. See Table 25 (SNMPv2c) or Table 26 (SNMPv3).
   

   When modifying the user that is set as the Config Sync Services user or the Polling Service user, all Config Sync Services or the Polling Service are updated with the SNMP settings for the configured user. You cannot remove a user who is set as a Config Sync Services user or a Polling Service user.

   
   
3. To create the user profile and save the remote login settings, click OK.

Configuring Remote Login Settings

Only a user with security privileges can configure remote login settings. Otherwise, this menu item is disabled.

To configure the remote login settings:

1. From the Configuration menu in either the Network Workshop or the Device Workshop, select NMC-RX Application Settings, then click Remote Login.

The Remote Login tab appears.

2. Set the parameters as shown in Table 27. For example:

 Table 27:  Remote Login Parameters 

 Parameters
 Description

 Login Type

 Determines the type of login specified through the NMC-RX application:

  
 TELNET ONLY—Default. When selected, SSH is disabled. 
  
 SSH ONLY—When selected, the SSH command-line parameters are enabled and must be specified.



 SSH Command Line
 Specifies the parameters in this section for SSH authentication.


 Available NMC-RX Arguments


  
 <HOST>—Specifies the IP address of the device to which you are connecting. When clicked, the <HOST> token is added to the command-line string (see below). 
  
 <USER NAME>—Specifies the username, which is the SSH username set in the NMC-RX user profile. You can use either the NMC-RX username or another username specified by the administrator. When clicked, the <USER NAME> token is added to the command-line string (see below). 



 Command LIne String

 Specifies what is executed when the remote login action starts. The string contains arguments that are necessary for SSH authentication. Syntax example:
ssh2 <USER NAME>@<HOST>




  
 ssh2—SSH executable
  
 <USER NAME>—Parameter syntax for username
  
 <HOST>—Parameter syntax for IP address



 Test

 When clicked, the remote login action is started with the command-line string that you specified.



 

3. Click Save.

Testing Remote Login Action

When remote login is started, the arguments that you specified in the Command Line String field are translated to the specified username and IP address. For example,

ssh2 <USER NAME>@<HOST>

translates to:

ssh2 hsmith@10.5.129.39

To test the remote login action that you specified in the Command Line String field:

1. Click Test.

A Test SSH Session dialog box appears. One of these dialogs appears when a username and host argument are specified or when only a host argument is specified.

2. (Optional) Specify a username.
   

   NOTE: The username that appears in the text box is the SSH username that is specified in the user profile.

   
   
3. Enter the host IP address.
4. Click OK.

The SSH application remotely logs in to the command-line interface (CLI) of the router.

Logging In

After you configure SSH, you can remotely log in to the E-series router through the Tools menu. To log in:

1. Select Device Utilities and Remote Login.

The SSH Sessions dialog box appears.

2. Enter the host IP address, and click OK.

The CLI of the E-series router appears. For more information, see NMC-RX User Guide, Vol. 2, Chapter 14, Using Device Utilities.