Secure Remote Access on HPE Comware v5 Switches

How to configure SSH, HTTPS, local user accounts, RSA keys, and console authentication on HPE Comware v5 switches.

1 min readUpdated KNET Ltd

Legacy platform. Comware v5 is end-of-sale on most platforms. This guide is kept for anyone still running it; check syntax against your software release, and see the Comware v7 guides for current platforms.

By default, HPE Comware v5 has no remote access authentication configured. This guide covers local user setup, SSH, HTTPS, and console port protection.

Security note: Use 2048-bit RSA minimum. The 1024-bit size shown below is cryptographically weak and should not be used on switches still in active service.

Create a local user #

cli
system-view
 local-user admin
  password simple PASSWORD
  authorization-attribute level 3
  service-type web terminal
  service-type ssh

Use password cipher rather than password simple in production to store a hashed value.

Generate RSA keys #

cli
public-key local create rsa
2048

Configure VTY access #

cli
user-interface vty 0 15
 authentication-mode scheme
 user privilege level 3
 protocol inbound ssh

ssh server enable

Disable Telnet #

cli
undo telnet server enable

Secure the console port #

cli
user-interface aux 0
 authentication-mode scheme
 user privilege level 3

Disable HTTP, enable HTTPS #

cli
undo ip http enable
ip https enable

Related article #