What is Secure Shell (SSH)
Secure Shell is a protocol that can be used in the place of well known Telnet protocol to remotely connect to your Cisco Router or Switch. Telnet has long been used to manage network devices; however, Telnet traffic is sent in clear text. Anyone able to sniff that traffic would see your password and any other information sent during the Telnet session. Secure Shell (SSH) is a much more secure way to manage your routers and switches. It is a client/server protocol that encrypts the traffic in and out through the vty ports.
Cisco routers and switches can act as SSH clients by default, but must be configured to be SSH servers. That is, they can use SSH when connecting to another device, but require configuration before allowing devices to connect via SSH to them. They also require some method of authenticating the client. This can be either a local username and password, or authentication with a AAA server (AAA is detailed in the next section).
There are two versions of SSH. SSH Version 2 is an IETF standard that is more secure than version 1. Version 1 is more vulnerable to man-in-the-middle attacks, for instance. Cisco devices support both types of connections, but you can specify which version to use.
How to Configure SSH in Cisco Devices
Telnet is enabled by default, but configuring even a basic SSH server requires several following steps:
1. Ensure that your IOS supports SSH. You need a K9 image for this.
2. Configure a host name.
3. Configure a domain name.
4. Configure a client authentication method.
5. Tell the router or switch to generate the Rivest, Shamir, and Adelman (RSA) keys that will be used to encrypt the session.
6. Specify the SSH version, if you want to use version 2.
7. Disable Telnet on the VTY lines.
8. Enable SSH on the VTY lines.
Here are the configuration command to configure Secure Shell on Cisco Routers or Switches
router(config)# hostname R1
R1(config)# ip domain-name networkpcworld
R1(config)# username cisco password Cisco
R1(config)# crypto key generate rsa
The name for the keys will be: R1.networkpcworld
Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys …[OK]
R1(config)#
*May 22 02:06:51.923: %SSH-5-ENABLED: SSH 1.99 has been enabled
R1(config)# ip ssh version 2
!
R1(config)# line vty 0 4
R1(config-line)# transport input none
R1(config-line)# transport input ssh
R1(config-line)#^Z
!
R1# show ip ssh
SSH Enabled – version 2.0
Authentication timeout: 120 secs; Authentication retries: 3
Secure Shell is a protocol that can be used in the place of well known Telnet protocol to remotely connect to your Cisco Router or Switch. Telnet has long been used to manage network devices; however, Telnet traffic is sent in clear text. Anyone able to sniff that traffic would see your password and any other information sent during the Telnet session. Secure Shell (SSH) is a much more secure way to manage your routers and switches. It is a client/server protocol that encrypts the traffic in and out through the vty ports.
Cisco routers and switches can act as SSH clients by default, but must be configured to be SSH servers. That is, they can use SSH when connecting to another device, but require configuration before allowing devices to connect via SSH to them. They also require some method of authenticating the client. This can be either a local username and password, or authentication with a AAA server (AAA is detailed in the next section).
There are two versions of SSH. SSH Version 2 is an IETF standard that is more secure than version 1. Version 1 is more vulnerable to man-in-the-middle attacks, for instance. Cisco devices support both types of connections, but you can specify which version to use.
How to Configure SSH in Cisco Devices
Telnet is enabled by default, but configuring even a basic SSH server requires several following steps:
1. Ensure that your IOS supports SSH. You need a K9 image for this.
2. Configure a host name.
3. Configure a domain name.
4. Configure a client authentication method.
5. Tell the router or switch to generate the Rivest, Shamir, and Adelman (RSA) keys that will be used to encrypt the session.
6. Specify the SSH version, if you want to use version 2.
7. Disable Telnet on the VTY lines.
8. Enable SSH on the VTY lines.
Here are the configuration command to configure Secure Shell on Cisco Routers or Switches
router(config)# hostname R1
R1(config)# ip domain-name networkpcworld
R1(config)# username cisco password Cisco
R1(config)# crypto key generate rsa
The name for the keys will be: R1.networkpcworld
Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys …[OK]
R1(config)#
*May 22 02:06:51.923: %SSH-5-ENABLED: SSH 1.99 has been enabled
R1(config)# ip ssh version 2
!
R1(config)# line vty 0 4
R1(config-line)# transport input none
R1(config-line)# transport input ssh
R1(config-line)#^Z
!
R1# show ip ssh
SSH Enabled – version 2.0
Authentication timeout: 120 secs; Authentication retries: 3
Comments
Post a Comment