security ssh add
Add SSH configuration options
Availability: This command is available to cluster and Vserver administrators at the admin privilege level.
The ` security ssh add ` command adds additional SSH key exchange algorithms or ciphers or MAC algorithms to the existing configurations of the cluster or a Vserver. The added algorithms or ciphers or MAC algorithms are enabled on the cluster or Vserver. If you change the cluster configuration settings, it is used as the default for all newly created Vservers. The existing SSH key exchange algorithms, ciphers, and MAC algorithms remain unchanged in the configuration. If the SSH key exchange algorithms or ciphers or MAC algorithms are already enabled in the current configuration, the command will does not not fail. Data ONTAP supports the
diffie-hellman-group-exchange-sha256 key exchange algorithm for SHA-2. Data ONTAP also supports the
diffie-hellman-group14-sha1 , and
diffie-hellman-group1-sha1 SSH key exchange algorithms for SHA-1. The SHA-2 key exchange algorithm is more secure than the SHA-1 key exchange algorithms. Data ONTAP also supports
ecdh-sha2-nistp521 , and
curve25519-sha256 . Data ONTAP also supports the AES and 3DES symmetric encryptions (also known as ciphers) of the following types:
aes256-gcm , and
3des-cbc . Data ONTAP supports MAC algorithms of the following types:
umac-64-etm , and
-vserver <Vserver Name>- Vserver
Identifies the Vserver to which you want to add additional SSH key exchange algorithms or ciphers.
[-key-exchange-algorithms <algorithm name>,…]- List of SSH Key Exchange Algorithms to Add
Adds the specified SSH key exchange algorithm or algorithms to the Vserver.
[-ciphers <cipher name>,…]- List of SSH Ciphers to Add
Adds the specified cipher or ciphers to the Vserver.
[-mac-algorithms <MAC name>,…]- List of SSH MAC Algorithms to Add
Adds the specified MAC algorithm or algorithms to the Vserver.
The following command adds the
diffie-hellman-group-exchange-sha1 key exchange algorithms for the cluster1 Vserver. It also adds the
aes192-cbc ciphers and the
hmac-sha2-256 MAC algorithms to the cluster1 Vserver.
cluster1::> security ssh add -vserver cluster1 -key-exchange-algorithms diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1 -ciphers aes256-cbc,aes192-cbc -mac-algorithms hmac-sha1,hmac-sha2-256