How,Configure,SSH,Secure,Shell computer How to Configure SSH (Secure Shell) for Remote Login on a Ci

Gone are those times when the companies and the organisations didn't need a hi-tech system to handle them. Owing to the considerable increase in the business sector and thus, an enormous increase in the complexity of the organisational struc ----------------------------------------------------------Permission is granted for the below article to forward,reprint, distribute, use for ezine, newsletter, website,offer as free bonus or part of a product for sale as longas no changes a

Copyright (c) 2008 Don R. CrawleyPrior to the introduction of SSH in the Cisco IOS, the only remote login protocol was Telnet. Although quite functional, Telnet is a non-secure protocol in which the entire session, including authentication, is in clear text and thus subject to snooping.SSH is both a protocol and an application that replaces Telnet and provides an encrypted connection for remote administration of a Cisco network device such as a router, switch, or security appliance.The Cisco IOS includes both an SSH server and an SSH client. This document is concerned only with the configuration of the SSH server component.PrerequisitesSoftwareThe SSH server component requires that you have an IPSec (DES or 3DES) encryption software image from Cisco IOS Release 12.1(1)T or later installed on your router. Advanced IP services images include the IPSec component. This document was written using c2800nm-advipservicesk9-mz.123-14.T5.bin.Pre-configurationYou must configure a hostname and a domain name on your router. For example:router#router#conf tEnter configuration commands, one per line. End with CNTL/Z.router01(config)#hostname router01router01(config)#ip domain-name soundtraining.netYou must also generate an RSA keypair for your router which automatically enables SSH. In the following example, note how the keypair is named for the combination of hostname and domain name that were previously configured. The modulus represents the key length. Cisco recommends a minimum key length of 1024 bits (even though the default key length is 512 bits):router01(config)#router01(config)#crypto key generate rsaThe name for the keys will be: router01.soundtraining.netChoose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.How many bits in the modulus [512]: 1024% Generating 1024 bit RSA keys ...[OK]Finally, you must either use an AAA server such as a RADIUS or TACACS+ server or create a local user database to authenticate remote users and enable authentication on the terminal lines. For the purpose of this document, we'll create a local user database on the router. In the following example, the user "donc" was created with a privilege level of 15 (the maximum allowed) and given an encrypted password of "p@ss5678". (The command "secret" followed by "0" tells the router to encrypt the following plaintext password. In the router's running configuration, the password would not be human readable.) We also used line configuration mode to tell the router to use its local user database for authentication (login local) on terminals lines 0-4.router01(config)#username donc privilege 15 secret 0 p@ss5678router01(config)#line vty 0 4router01(config-line)#login localEnabling SSHTo enable SSH, you must tell the router which keypair to use. Optionally, you can configure the SSH version (it defaults to SSH version 1), authentication timeout values, and several other parameters. In the following example, we told the router to use the previously created keypair and to use SSH version 2:router01(config)#router01(config)#ip ssh version 2router01(config)#ip ssh rsa keypair-name router01.soundtraining.netYou can now log on to your router securely using an SSH client such as TeraTerm.Viewing SSH Configurations and ConnectionsYou can use the privileged mode commands "view ssh" and "view ip ssh" to view SSH configurations and connections (if any). In the following example, the SSHv1 configuration from a Cisco 871 router is verified using "show ip ssh" and a single SSHv1 connection is displayed using the command "show ssh". Notice that we did not enable SSHv2 on this router, so it defaulted to SSH version 1.99. Also note in the output of the "show ssh" command that SSH version 1 defaults to 3DES. SSHv2 supports AES, a more robust and efficient encryption technology. SSHv2 is also not subject to the same security exploits as SSHv1. soundtraining.net recommends the use of SSHv2 and disabling a dropback to SSHv1. Enabling SSHv2 disables SSHv1. This example is included only to demonstrate backwards compatibility:router04#router04#show ip sshSSH Enabled - version 1.99Authentication timeout: 120 secs; Authentication retries: 3router04#router04#show sshConnection Version Encryption State Username2 1.5 3DES Session started donc%No SSHv2 server connections running.router04#You can also use the command "debug ip ssh" to troubleshoot SSH configurations. Article Tags: Local User Database, Remote Login, Following Example, Local User, User Database