Configuring Secure Shell (SSH) - Cisco

1 Configuring Secure Shell (SSH) FindingFeatureInformation,page 1 Prerequisitesfor ConfiguringSecureShell, page 1 Restrictionsfor ConfiguringSecureShell, page 2 Informationabout SSH, page 2 How to ConfigureSSH, page 5 Monitoringthe SSH Configurationand Status,page 9 AdditionalReferences,page 9 Finding Feature InformationYour softwarereleasemay not supportall the featuresdocumentedin this the latest caveatsandfeatureinformation,see Bug SearchTool and the releasenotes for your platformand informationabout the featuresdocumentedin this module,and to see a list of the releasesin which eachfeatureis supported,see the featureinformationtable at the end of this Cisco FeatureNavigatorto find informationabout platformsupportand Cisco softwareimage access Cisco FeatureNavigator, go to An accounton for Configuring Secure ShellThe followingare the prerequisitesfor configuringthe switch for Secure Shell (SSH).

2 For SSH to work, the switchneeds an Rivest,Shamir, and Adleman(RSA) public/privatekey pair. Thisis the same with SecureCopy Protocol(SCP),which relies on SSH for its Secure transport. BeforeenablingSCP,youmustcorrectlyconfig ureSSH,authentication,andauthorizationon theswitch. BecauseSCPreliesonSSHforitssecuretranspo rt,theroutermusthaveanRivest,Shamir,andA delman(RSA) key pair. SCP relies on SSH for 2960-X Switch Series Configuration Guide, Cisco IOS Release (2)EX OL-29640-011 SCP requiresthat authentication,authorization,and accounting(AAA)authorizationbe configuredsothe router can determinewhetherthe user has the correctprivilegelevel. A user must have appropriateauthorizationto use SCP. A user who has appropriateauthorizationcan use SCP to copy any file in the Cisco IOS File System(IFS) to and from a switch by using authorizedadministratorcan also do thisfrom a workstation.

3 TheSecureShell (SSH) serverrequiresanIPsec (DataEncryptionStandard[DES]or3 DES)encryptionsoftwareimage;the SSH client requiresan IPsec (DES or 3 DES)encryptionsoftwareimage.) Configurea hostnameand host domainfor your device by using thehostnameandip domain-namecommandsin global TopicsSecureCopy Protocol, on page 4 Restrictions for Configuring Secure ShellThe followingare restrictionsfor configuringthe Switchfor Secure Shell . The switch supportsRivest,Shamir, and Adelman(RSA) authentication. SSH supportsonly the execution-shellapplication. The SSH server and the SSH client are supportedonly on Data EncryptionStandard(DES) (56-bit)and3 DES(168-bit) , 3 DES softwareimages,both DES and 3 DES encryptionalgorithmsare available. TheSwitchsupportstheAdvancedEncryptionSt andard(AES)encryptionalgorithmwitha128-b itkey,192-bitkey, or 256-bitkey. However, symmetriccipher AES to encryptthe keys is not supported.

4 This softwarereleasedoes not supportIP Security(IPSec). When using SCP, you cannotenter the passwordinto must enter the passwordwhen prompted. The login banneris not supportedin SecureShell Version 1. It is supportedin SecureShell Version 2. The -l keywordand userid :{number}{ip-address}delimiterand argumentsare mandatorywhenconfiguringthe alternativemethodof ReverseSSH for TopicsSecureCopy Protocol, on page 4 Information about SSHS ecureShell (SSH) is a protocolthat providesa Secure ,remoteconnectionto a softwarereleasesupportsSSH Version 1 (SSHv1)and SSH Version 2 (SSHv2). Cisco 2960-X Switch Series Configuration Guide, Cisco IOS Release (2)EX2OL-29640-01 Configuring Secure Shell (SSH)Restrictions for Configuring Secure ShellSSH and Switch AccessSecureShell (SSH) is a protocolthat providesa Secure ,remoteconnectionto a softwarereleasesupportsSSH Version 1 (SSHv1)and SSH Version 2 (SSHv2).

5 SSH functionsthe same in IPv6 as in IPv4. For IPv6, SSH supportsIPv6 addressesand enablessecure,encryptedconnectionswith remoteIPv6 nodes over an IPv6 Servers, Integrated Clients, and Supported VersionsThe SecureShell (SSH) IntegratedClient featureis an applicationthat runs over the SSH protocolto providedevice authenticationand SSH client enablesa Cisco device to make a Secure ,encryptedconnectionto anotherCisco device or to any other device runningthe SSH server. This connectionprovidesfunctionalitysimilarto that of an outboundTelnet connectionexcept that the connectionis encryption,the SSH client allows for Secure communicationover an SSH client supportedin this releaseand with non-CiscoSSH SSH client works with publiclyand commerciallyavailableSSH SSH client supportsthe ciphersof Data EncryptionStandard(DES),3 DES, and switch supportsan SSHv1or an switch supportsan SSH client functionalityis availableonly when the SSH server is authenticationmethods: TACACS+ RADIUS Local authenticationand authorizationRelated TopicsConfiguringthe Switchfor Local Authenticationand AuthorizationTACACS+and SwitchAccessRADIUSand SwitchAccessSSH Configuration GuidelinesFollowthese guidelineswhen configuringthe switch as an SSH server or SSH client: An RSA key pair generatedby a SSHv1server can be used by an SSHv2server, and the reverse.

6 If the SSH server is runningon a stack masterand the stack masterfails, the new stack masteruses theRSA key pair generatedby the previousstack 2960-X Switch Series Configuration Guide, Cisco IOS Release (2)EX OL-29640-013 Configuring Secure Shell (SSH)SSH and Switch Access IfyougetCLIerrormessagesafterenteringthe cryptokeygeneratersaglobalconfigurationc ommand,an RSA key pair has not been hostnameand domain,and then enter more information,see RelatedTopics below. When generatingthe RSA key pair, the messageNo host name specifiedmight appear. If it does, youmust configurea hostnameby using thehostnameglobal configurationcommand. WhengeneratingtheRSAkeypair, ,youmustconfigurean IP domainname by using theip domain-nameglobal configurationcommand. Whenconfiguringthelocalauthenticationand authorizationauthenticationmethod,makesu rethatAAAis disabledon the TopicsSettingUp the Switchto Run SSH, on page 5 Configuringthe Switchfor Local Authenticationand AuthorizationSecure Copy Protocol OverviewThe SecureCopy Protocol(SCP) featureprovidesa Secure and authenticatedmethodfor copyingswitchconfigurationsor switch image files.

7 SCP relies on SecureShell (SSH),an applicationand a protocolthatprovidesa Secure replacementfor the SSH to work, the switch needs an RSA public/privatekey pair. This is the same with SCP, which relieson SSH for its Secure also relies on AAA authentication,and SCP relies furtheron AAA authorization,correctconfigurationis necessary. BeforeenablingSCP,youmustcorrectlyconfig ureSSH,authentication,andauthorizationon theswitch. BecauseSCPreliesonSSHforitssecuretranspo rt,theroutermusthaveanRivest,Shamir,andA delman(RSA) key using SCP, you cannotenter the passwordinto the copy must enter the passwordwhen Copy ProtocolThe SecureCopy Protocol(SCP) featureprovidesa Secure and authenticatedmethodfor (rcp),whichcomesfromtheBerkeleyr-toolssu ite, ,authorization,and accounting(AAA)authorizationbe configuredso the switch can determinewhethertheuser has the correctprivilegelevel. To configurethe SecureCopy feature,you shouldunderstandthe TopicsPrerequisitesfor ConfiguringSecureShell, on page 1 Cisco 2960-X Switch Series Configuration Guide, Cisco IOS Release (2)EX4OL-29640-01 Configuring Secure Shell (SSH) Secure Copy Protocol OverviewRestrictionsfor ConfiguringSecureShell, on page 2 How to Configure SSHS etting Up the Switch to Run SSHF ollowthese steps to set up your Switchto run SSH:Before You BeginConfigureuser authenticationfor local or step is more information,seeRelatedTopics STEPSP urposeCommand or 1 Example:Switch>enableEnters the global terminalExample:Switch#configureterminal Step 2 Configuresa hostnameand IP domainname for your 3 Example.

8 Switch(config)#hostnameyour_hostnameFoll owthis procedureonly if you are configuringtheSwitchas an SSH 2960-X Switch Series Configuration Guide, Cisco IOS Release (2)EX OL-29640-015 Configuring Secure Shell (SSH)How to Configure SSHP urposeCommand or ActionConfiguresa host domainfor your domain-namedomain_nameExample:Switch(con fig)#ip domain-nameStep 4your_domainEnablesthe SSH server for local and remoteauthenticationon theSwitchand generatesan RSA key pair. Generatingan RSA keypair for the :Switch(config)#cryptokey generatersaStep 5We recommendthat a minimummodulussize of 1024 , ,butittakeslonger to generateand to procedureonly if you are configuringtheSwitchas an SSH privilegedEXEC :Switch(config)#endStep 6 Verifies your :Switch#showrunning-configStep 7(Optional)Saves your entriesin the :Switch#copyrunning-configStep 8startup-configRelated TopicsSSH ConfigurationGuidelines, on page 3 Configuringthe Switchfor Local Authenticationand AuthorizationConfiguring the SSH ServerFollowthese steps to configurethe SSH server.

9 Cisco 2960-X Switch Series Configuration Guide, Cisco IOS Release (2)EX6OL-29640-01 Configuring Secure Shell (SSH) Configuring the SSH ServerThis procedureis only requiredif you are configuringthe Switchas an SSH sshversion[1|2] ssh{timeoutseconds|authentication-retrie snumber} one or both of the following: linevtyline_number[ending_line_number] STEPSP urposeCommand or ActionEnablesprivilegedEXEC mode. Enter your passwordif 1 Example:Switch>enableEnters the global terminalExample:Switch#configureterminal Step 2(Optional)Configuresthe Switchto run SSH Version 1 or SSH sshversion[1|2]Example:Switch(config)#ip ssh version1 Step 3 1 Configurethe Switchto run SSH Version 1. 2 Configurethe Switchto run SSH Version you do not enter this commandor do not specifya keyword,the SSHserver selectsthe latest SSH versionsupportedby the SSH client. Forexample,if the SSH client supportsSSHv1and SSHv2,the SSH SSH controlparameters:ip ssh{timeoutseconds|authentication-retrie snumber}Step 4 Cisco 2960-X Switch Series Configuration Guide, Cisco IOS Release (2)EX OL-29640-017 Configuring Secure Shell (SSH) Configuring the SSH ServerPurposeCommand or Action Specifythe time-outvalue in seconds;the defaultis 120 range is 0 to 120 parameterappliesto the SSHE xample:Switch(config)#ip ssh timeout90negotiationphase.

10 After the connectionis established,the Switchuses the defaulttime-outvalues of the default,up to five simultaneous,encryptedSSH connectionsformultipleCLI-basedsessionso ver thenetworkareavailable(session0tosession 4).Aftertheexecutionshellstarts,theCLI-b asedsessiontime-outvalue returnsto the defaultof 10 minutes. Specifythe numberof times that a client can re-authenticateto theserver. The defaultis 3; the range is 0 to step when configuringboth parameters.(Optional)Configuresthe virtual terminalline one or both of the following:Step 5 linevtyline_number[ending_line_number] Enterslineconfigurationmode to configurethe , specifya pairof lines. The range is 0 to 15. transportinputssh Specifiesthat the Switchpreventnon-SSHT elnet the router to only SSH :Switch(config)#linevty 1 10orSwitch(config-line)#transportinputss hReturnsto privilegedEXEC :Switch(config-line)#endStep 6 Verifies your :Switch#showrunning-configStep 7(Optional)Saves your entriesin the :Switch#copyrunning-configStep 8startup-config Cisco 2960-X Switch Series Configuration Guide, Cisco IOS Release (2)EX8OL-29640-01 Configuring Secure Shell (SSH) Configuring the SSH ServerMonitoring the SSH Configuration and StatusThis table displaysthe SSH server configurationand 1.