Configuring the SSH service
By default, the SSH service is disabled. When enabled, the SSH service binds to the defined local IP-address-port combination.
Without an explicit local address, the SSH service attempts to bind to the management Ethernet interface. If the management Ethernet interface is not defined, the SSH service binds to all configured interfaces.
Be sure to define an explicit IP address to isolate management traffic from application data traffic.
If any of the Ethernet interfaces on the appliance are connected to the internet, or a similar open access network, you might want to prevent access to the SSH service from those interfaces. By restricting the Ethernet interface that can be used to access the SSH service, you can ensure that the service can be accessed only from an internal network. This restriction makes your environment more secure.
You can also fine tune the ciphers that are used by the SSH service, and the order that they are used in.
To establish an SSH session
Although many servers use password authentication for SSH login, the IBM® MQ Appliance requires an interactive process to protect credentials during the SSL handshake. The IBM MQ Appliance initiates a secure channel and provides for an encrypted login process.
As a side-effect of the initial connection, and depending on your SSH client, you might see the extraneous "login as:" prompt. To bypass, press Enter.
login as:
Unauthorized access prohibited.
login: