Different SSH behavior between the V5 and V8 devices

Hello,

There are changes on the authentication mechanism of SSH when comparing the IP address of ACL list.

At V5 platform 

The SSH login process is as follows:

a.  When there is the user trying to access from the public network.

b.  The vty acl command takes effect when applying for VTY resources.

c.  After the TCP three-way handshake is complete and SSH negotiation is complete, the user name and password are authenticated.

d. After the authentication is successful, the VTY resource is applied.

e. The user can log in to the device only after the VTY resource is successfully applied.

At V8 platform

The SSH login process is as follows:

a.  After the TCP three-way handshake is complete and SSH negotiation is complete, the user name and password are authenticated.

b. After the authentication is successful, the VTY resource is applied.

c. The user can log in to the device only after the VTY resource is successfully applied.

d. The vty acl command takes effect when applying for VTY resources.

 Thus, you might found even if you used an IP address that is not allowed on ACL list under vty view, there is still a message prompt out to enter username/password. And during user authentication, logs are generated regardless of whether the authentication succeeds or fails.

The SSH service contains multiple login protocols. Some protocols require VTY resources while others do not. When a TCP connection is established, the protocol used by the user for login cannot be determined, and the VTY authentication process is not started, therefore, invalid IP cannot be intercepted in VTY mode.

Suggest configuring the ssh server acl 3001 command under system view to restrict users right before TCP establishment.