ssh server hmac

Function

The ssh server hmac command configures an HMAC algorithm list for an SSH server.

The undo ssh server hmac command restores the default HMAC algorithm list of an SSH server.

By default, an SSH server supports all HMAC algorithms.

Format

ssh server hmac sha2_256

undo ssh server hmac

Parameters

Parameter	Description	Value
sha2_256	Specifies the HMAC SHA2_256 algorithm.	-

Views

System view

Default Level

3: Management level

Usage Guidelines

Usage Scenario

An SSH server and a client need to negotiate an HMAC algorithm for the packets exchanged between them. You can run the ssh server hmac command to configure an HMAC algorithm list for the SSH server. After the server receives a packet from the client, the server matches the list of the client against its local list and selects the first matched HMAC algorithm. If no matched HMAC algorithms, the negotiation fails.

Precautions

The system software does not support the sha2_256_96, sha1, sha1_96, md5, and md5_96 parameters. To use the sha2_256_96, sha1, sha1_96, md5, or md5_96 parameter, you need to install the WEAKEA plug-in. For higher security purposes, you are advised to specify the sha2_256 parameter.

In V200R019C00 and later versions, when the device starts with the default configurations, it automatically performs the following configurations and saves the configurations to the configuration file:

Run the ssh server dh-exchange min-len 2048 command to set the minimum key length supported during Diffie-hellman-group-exchange key exchange between the SSH server and client to 2048 bytes.
Run the ssh server cipher aes256_ctr aes128_ctr command to configure CTR encryption algorithms for an SSH server.
Run the ssh server hmac sha2_256 command to configure the HMAC SHA2_256 algorithm for an SSH server.
Run the ssh client cipher aes256_ctr aes128_ctr command to configure CTR encryption algorithms for an SSH client.
Run the ssh client hmac sha2_256 command to configure the HMAC SHA2_256 algorithm for an SSH client.

Example

# Configure the HMAC SHA2_256 algorithm for an SSH server.

<HUAWEI> system-view
[HUAWEI] ssh server hmac sha2_256