Disable SSH access with password. Instead operators can ssh into the testbed only if their public keys are registered.
Having logged in, run the following commands to switch off password access:
configure
set service ssh disable-password-authentication
commit
save
exit
To add SSH public keys, the key must be saved in a file first, then be loaded.
vi /tmp/my_pubkey
configure
loadkey <user> /tmp/my_pubkey
commit
save
exit
Bring up the firewall
Follow the instructions here to establish a basic set of firewall rules: WAN_IN and WAN_LOCAL
configure
set firewall name WAN_IN default-action drop
set firewall name WAN_IN description 'WAN to internal'
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 description 'Allow established/related'
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable
set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 description 'Drop invalid state'
set firewall name WAN_IN rule 20 state invalid enable
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'WAN to router'
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 description 'Allow established/related'
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 description 'Drop invalid state'
set firewall name WAN_LOCAL rule 20 state invalid enable
set interfaces ethernet eth3 firewall in name WAN_IN
set interfaces ethernet eth3 firewall local name WAN_LOCAL
commit ; save
Then, we open only SSH port on the firewall.
Use the GUI to add a new rule to the WAN_LOCAL chain. It already has:
Rule 1 - allow established and related
Rule 2 - drop invalid.
So add Rule 3 -
On the Basic pane: Enable, Action accept, Protocol tcp